AI in ServiceNow: The Complete Guide (2026)
Oct 19, 2026 · @mohammad karimi
Why this guide
ServiceNow's AI went from guessing which team owns a ticket to agents that resolve the ticket themselves, and most of us learned it one release note at a time. This guide puts the whole story in one place.
It is written for admins, developers, architects and process owners who know the platform but want a clear map of the AI side: what each module does, how the pieces fit, and what you can build with them today. Questions and corrections are very welcome in the comments.
The problem AI was brought in to solve
Every ticket used to go through the same manual loop: read it, decide the category and priority, route it to a group, search the knowledge base, fix it, then write the resolution notes. Multiply that by thousands of records a day across ITSM, CSM, HR and SecOps, and you get slow resolution, misrouting and burned-out agents.
AI entered that loop in three steps: first to predict and classify, then to write and summarize, and now to do the work itself.
1. Three waves: predict, generate, act
AI arrived in ServiceNow in three waves, and none of them replaced the one before; today all three run side by side.
- Wave 1, classic machine learning (roughly 2017 to 2022): the platform learned from historical records to classify and route new ones. This is Predictive Intelligence, strengthened by acquisitions such as Element AI and Loom Systems.
- Wave 2, generative AI (from 2023): large language models arrived as the Now Assist family. The platform could now summarize, draft, generate code and answer in natural language.
- Wave 3, agentic AI (from 2025): AI Agents that plan and execute multi-step work, with AI Control Tower governing them.
Key milestones (dates for pre-2026 releases are approximate):
When | Release or event | What changed |
2019 to 2022 | Madrid through Tokyo | Predictive Intelligence, Virtual Agent and AI Search become core platform capabilities |
2023 | Vancouver | Now Assist reaches general availability: summarization, text and code generation |
2024 | Washington DC, Xanadu | Now Assist expands across workflows; Now Assist Skill Kit and the first AI Agents appear |
2025 | Yokohama, Zurich | AI Agent Orchestrator and AI Agent Studio; AI Control Tower introduced at Knowledge 2025; Moveworks acquisition |
May 2026 | Australia, Knowledge 2026 | AI Control Tower expanded; Otto, Action Fabric, Autonomous Workforce and Autonomous CRM announced |
H2 2026 | Brazil | Latest family release; agents and skills keep expanding |
A concrete example of the three waves working together: an agent (wave 3) can call a Predictive Intelligence model to classify a ticket (wave 1) and a Now Assist skill to draft the reply (wave 2).
2. The big picture
Before going module by module, here is the whole map: five stacked layers, with AI Control Tower governing all of them.
ServiceNow AI architecture · five layers, one governance tower
Read it top down: users enter through the experience layer, agents plan the work, they draw on skills and predictions, LLMs understand and generate text, and everything runs on enterprise data. The next sections open each layer in turn.
3. Predictive Intelligence: the prediction engine
Predictive Intelligence is the oldest AI layer on the platform: it learns from historical records and makes predictions about new ones.
Say you have 200,000 closed incidents, each with a short description and the group that finally resolved it. A new ticket arrives saying "VPN won't connect", and the model answers: network team, 92% confidence.
- Pick the data: a table (e.g. Incident), input fields (e.g. Short description) and an output field (e.g. Assignment group).
- Train: the platform trains a solution definition on historical data.
- Evaluate: review precision and coverage before you trust it.
- Use it: call the prediction from forms, business rules or Flow Designer.
Framework | What it does | Typical use |
Classification | Predicts a label | Category, priority, assignment group |
Similarity | Finds similar records | Similar resolved incidents, related KB articles |
Clustering | Groups records | Spotting that 300 tickets today share one root cause |
Regression | Predicts a number | Expected time to resolve |
Where you meet it: similar records and suggested articles in Agent Workspace, earlier detection of major incidents through clustering, change risk prediction based on past changes, and automatic routing in HR and CSM. Newer releases add Task Intelligence, which covers the common cases with much simpler, admin-friendly configuration.
4. Now Assist: generative AI in every workflow
Now Assist is the family of generative AI capabilities: an LLM summarizes, drafts, generates code and answers questions inside the workflows you already run.
Each capability is a skill. "Incident summarization" is one skill, "KB article generation" is another. In Now Assist Admin you decide which skills are on, for which roles, and on which model.
Area | Application | Headline skills |
IT | Now Assist for ITSM | Incident and change summaries, resolution notes, chat summaries, KB generation from resolved tickets |
Customer service | Now Assist for CSM | Case summaries, email reply recommendations, live chat assistance |
HR | Now Assist for HRSD | HR case summaries, policy Q&A, knowledge content |
IT operations | Alert Assist, AIOps | Plain-language alert explanations, probable root cause, operational summaries |
Security | Now Assist for SIR | Security incident summaries, attack analysis, next-step recommendations |
Risk | Now Assist for IRM | Issue and control summaries, policy drafting |
Development | Now Assist for Creator, code generation | Text-to-code, flows, playbooks and catalog items from a description |
Analytics | Now Assist Analytics | Ask your data questions in plain language, get dashboards |
Field service | Now Assist for FSM | Work order summaries for technicians |
More | Contract Analysis, CPQ, Talent, Voice | Contract review, quoting support, talent management, voice assistant |
Where users see it: the Now Assist Panel (a chat panel available across the platform), the Now Assist context menu (AI actions directly on forms), and suggestions inside Agent Workspace.
Example: an agent opens an incident with 45 work notes and three reassignments. One click on Summarize shows what the problem was, what has been tried and what it is waiting on. After the fix, Now Assist drafts the resolution notes and offers to turn them into a KB article.
5. The front door: Virtual Agent, AI Search, EmployeeWorks and Otto
These are the parts end users actually touch: where an employee or customer asks a question and gets an answer or a service.
Virtual Agent
The classic Virtual Agent ran on designed topics: one conversation tree per scenario, such as password reset. Now Assist in Virtual Agent replaces much of that with an LLM that understands free text, answers from knowledge, or files the right request directly. It runs in the portal, Microsoft Teams, Slack and mobile.
Example: "My laptop is crawling and I present tomorrow." The assistant offers quick fixes and, if they fail, opens an incident with the right priority and the conversation summarized in it.
AI Search
Semantic search that matches meaning, not keywords. Genius Results put a direct answer above the result list, Now Assist Q&A generates an answer from knowledge articles with citations (retrieval-augmented generation, RAG), and external content connectors bring in sources such as SharePoint and Confluence.
EmployeeWorks (Moveworks)
ServiceNow acquired Moveworks in 2025. The result is EmployeeWorks: one assistant for IT, HR, facilities and finance requests instead of a portal per department.
Otto
Announced at Knowledge 2026, Otto combines conversational AI, enterprise search, voice agents and a data explorer in one experience. In the keynote demo it built a workforce readiness brief, flagged staffing gaps, recommended a hiring approach and blocked interview slots in calendars (KANINI recap).
6. AI Agents: from suggesting to doing
Now Assist suggests; an AI Agent takes a goal, plans, calls the right tools and carries the work to the end, asking a human only where it matters.
A simple way to put it: Now Assist is a brilliant assistant who drafts whatever you ask, but you decide and act. An AI Agent is a colleague you hand a ticket to; it investigates, tries the fix, and checks with you only before anything sensitive.
Component | Role |
AI Agent | A digital worker with one clear specialty, e.g. network troubleshooting |
Tool | What the agent can do: run a flow or script, search knowledge, call a skill or an external API |
AI Agent Orchestrator | The team lead that coordinates several agents toward one goal |
Agentic workflow | A complete business objective that several agents deliver together |
AI Agent Studio | No-code workspace to build, test and publish agents from natural-language instructions |
AI Agent Advisor | Helps identify where a new agent would pay off |
How an agent works through a ticket
- Receive the goal: "Investigate and resolve INC0012345."
- Gather context: read the ticket, find similar incidents and KB articles, check the affected CI in the CMDB.
- Plan: decide which steps and which tools are needed.
- Act: restart a service, reset a password, update a record.
- Human in the loop: request approval before sensitive actions.
- Report: document the outcome, then resolve or hand off to a person.
Prebuilt agents and the Autonomous Workforce
ServiceNow now ships prebuilt agents across the portfolio, for example for AIOps, Discovery, order management, complaint cases and contact centers in banking and insurance (Now Assist release notes). At Knowledge 2026 this was framed as the Autonomous Workforce across every major function, alongside Autonomous CRM, where agents qualify leads, generate quotes and resolve invoice disputes (KANINI recap).
Working beyond ServiceNow
- AI Agent Fabric lets ServiceNow agents work with agents from other vendors, with support for open protocols such as MCP and A2A.
- Action Fabric (2026) lets people trigger ServiceNow work from assistants they already use, such as Microsoft Copilot or Anthropic's Claude, without opening ServiceNow.
7. The builder toolkit
When out-of-the-box skills and agents aren't enough, these tools let you build your own.
Model options. Now LLM Service (ServiceNow's own models, tuned for enterprise workflows), partner models such as Azure OpenAI, Google Gemini and Anthropic Claude, or bring your own LLM.
Tool | What it's for | Example |
Generative AI Controller | Call an LLM from a flow or script with ready actions (summarize, translate, generate, answer) | Summarize an inbound customer email and detect sentiment inside a flow |
Now Assist Skill Kit | Build a custom skill with your own prompt, test it on real records, publish it | "Check this contract against our procurement policy" |
AI Agent Studio | Build agents by writing a role and instructions and choosing tools | A new-hire laptop provisioning agent |
Now Assist Data Kit | Prepare evaluation data to measure output quality | A test set to compare two prompt versions |
Now Assist for Creator, Build Agent | Generate apps, tables, forms and code from a description | "Build an app to book meeting rooms" |
Spoke Generation | Generate an integration spoke from API documentation | A spoke for an in-house finance system |
Building a custom skill, step by step
- Pick one narrow problem, e.g. "Does this customer email signal churn risk?"
- Define inputs: email body, account history, contract value.
- Write the prompt and pick the model.
- Test on real records and iterate.
- Publish, then use it on a form, in a flow or as an agent tool.
8. Data and governance: the fuel and the brakes
AI is only as good as its data and only as safe as its oversight; these two layers cover both.
The fuel
- CMDB: the map of your services, CIs and their dependencies. Agents use it to understand what is connected to what.
- Workflow Data Fabric: access to data in other systems (SAP, Snowflake, Databricks and others) without copying it in.
- RaptorDB: the platform's high-performance database for real-time analytics.
- Knowledge Graph and Context Engine: relationships between people, assets and work that give AI its context.
The brakes: AI Control Tower
AI Control Tower governs all AI in the enterprise, not only ServiceNow's. At Knowledge 2026 it was rebuilt around five dimensions (KANINI recap😞
Dimension | What it means |
Discover | Inventory every AI asset, including shadow AI running outside IT's view |
Govern | Assess risk against frameworks such as NIST and the EU AI Act |
Secure | Manage agent identities and permissions |
Observe | Monitor agent behavior at runtime |
Measure | Track cost and ROI |
Two changes stand out: Control Tower can detect an agent acting beyond its permissions and shut it down in real time (ERP Today), and its capabilities are now included across all product tiers (NAND Research).
Other guardrails
- Now Assist Guardian: checks model input and output for offensive content, prompt injection and sensitive topics.
- Sensitive Data Handler: masks personal data such as card or national ID numbers before anything reaches the model.
- Now Assist Admin Console: controls which skills are active for which roles, and reports usage.
9. Supporting modules worth knowing
These get less airtime but do a lot of the quiet work.
Module | What it does | Example |
Process Mining | Reconstructs real process paths from platform logs and surfaces bottlenecks; since Australia it can mine AI agent workflows too | 40% of incidents bounce between three groups |
Task Mining | Analyzes desktop activity to find repetitive manual work | Agents copy data from Excel into a form every day |
Document Intelligence | Extracts fields from documents such as invoices, forms and contracts | Reads amount and due date from a PDF invoice |
AIOps, Event Management | Correlates and deduplicates alerts, predicts failures | 500 alerts become one actionable incident |
Health Log Analytics | Detects anomalies in logs before users notice | Unusual error spike in a payments service |
Performance Analytics | KPIs and trend forecasting | Next week's ticket volume |
Language Services | Real-time translation and language detection | User writes in Persian, agent reads English |
RPA Hub | Software robots for legacy systems with no API | Data entry into an old desktop app |
Workforce Optimization | Forecasts workload and plans shifts | Staffing for Monday morning |
10. A day in the life: every module in one workday
To see how the pieces combine, follow one fictional company, Aria Corp, through a single day.
08:00, email outage (ITOM + ITSM). Monitoring fires 600 alerts. AIOps correlates them into one incident and Alert Assist explains it plainly: the mail server's SSL certificate has likely expired. Meanwhile 120 employees raise tickets; clustering links them all to one major incident. An agent checks the certificate, proposes renewal, and executes once an engineer approves.
09:30, new hire (HRSD + agents). Sara starts today. An agentic workflow runs three agents: HR verifies her documents, IT provisions her account and laptop, Facilities books her desk. Sara only talks to Virtual Agent in Teams and asks for the guest Wi-Fi password, answered from knowledge.
11:00, an angry customer (CSM). A sharp email about a wrong invoice arrives. Now Assist condenses six months of case history into three lines and drafts a calm reply; a CRM agent checks the invoice dispute and prepares the correction. The human agent reviews and sends.
14:00, a risky change. Infrastructure wants to upgrade a database. Predictive Intelligence rates the risk high based on past changes, and Now Assist writes the risk summary for the CAB.
16:00, a new app (Creator). Facilities asks for an app to log and track building repairs. A developer describes it in Now Assist for Creator and gets tables, a form and a flow in minutes.
17:30, the manager's view. The IT manager asks Now Assist Analytics how many tickets agents closed today and how much time that saved, and gets a chart. In AI Control Tower, every agent stayed within its permissions.
More use cases in one line each: phishing response summaries in SecOps, invoice-to-PO matching with Document Intelligence, risky-clause detection in Contract Analysis, pre-visit briefs for field technicians, and auto-generated test scripts and release notes for developers.
11. Where to start, and over to you
In one line: ServiceNow AI went from guessing who owns a ticket to agents that close it, all governed through AI Control Tower.
A learning path that works: Predictive Intelligence and Virtual Agent first, then out-of-the-box Now Assist skills, then Skill Kit and AI Agent Studio, and finally AI Control Tower. A free Personal Developer Instance from developer.servicenow.com is enough to try most of it.
Over to you: which layer is your team investing in right now, and what is missing from this map? If you have run agents in production, I'd especially like to hear what surprised you.
Glossary
Term | Plain meaning |
LLM | Large language model: AI that understands and generates text |
Agentic AI | AI that plans and executes work, not just suggests |
Skill | One Now Assist capability, such as summarization |
Tool | An action an agent is allowed to take |
RAG | Generating answers from retrieved knowledge, with sources |
Human in the loop | Human approval before an agent's sensitive actions |
MCP, A2A | Open protocols connecting agents to tools and to each other |
Shadow AI | AI in use without IT's knowledge |
Hallucination | A confident but wrong model answer |
Sources
- ServiceNow Knowledge 2026: Key Takeaways (KANINI)
- ServiceNow repositioned around AI security and governance (ERP Today)
- The agentic enterprise takes shape (NAND Research)
- Now Assist Suite release notes, July 2026 (ServiceNow Docs)
- Brazil release notes (ServiceNow Docs)
Release dates before 2026 and some module details are from general knowledge and approximate. Corrections are welcome in the comments.
