This blog’s for you if your organization owns ServiceNow IRM Foundation or IRM Standard. (Note: IRM Foundation is the entry-level licensing we introduced in April 2026. IRM Standard is its precedessor program that is now being phased out.)
IRM Packaging Changes
In Q3 2026, we made two IRM packaging updates that expanded the capabilities available to you in the IRM Foundation and IRM Standard tiers. These packaging changes give you more options in managing your risk program and improve your program outcomes.
Update 1 - Explore Advanced Risk Assessment (ARAs) in enterprise or cyber risk management programs
IRM Foundation includes classic risk assessments that enable a single assessment methodology. With the Q3 2026 release (GA on September 10, 2026), this has expanded to include Risk Assessment Methodologies (RAMs). This means you can use ServiceNow Advanced Risk Assessment (ARA) without stepping up to the IRM Advanced SKU.
With ARAs, you can run up to three active RAMs at once, each with unlimited manual and automated factors and configure each one end-to-end, from risk appetite through scoping, identification workflows, and rollups.
This expanded capability enables you to explore adding advanced risk assessments in your program that ultimately improve your decision-making.
Update 2 - Boost corporate and regulatory compliance program with new ServiceNow Regulatory Change Management features at the standard and foundational levels
Regulatory Change Management (RCM), which analyzes the impact of regulatory changes and helps you operationalize the changes within your organization, is now available with IRM Foundation and IRM Standard V2. Previously, it was available at the Advanced and Professional levels.
- With IRM Standard V2, you can use RCM’s core workflows to identify and operationalize regulatory changes. More on RCM here.
- With IRM Foundation, you can enable core workflows to identify and operationalize regulatory changes. IRM Foundation also offers RCM AI-powered alert summarization and recommendations. This AI capability surfaces affected citations, controls, risks, and policies resulting following a regulatory change and then proposes changes for team review and approval.
Takeaways
With these two changes, your ServiceNow Risk investment can unlock more value, whether by using ARA or by conducting deeper, more extensive risk assessments or RCM to streamline the manual analysis of your regulatory alerts. The next step is to talk to your product owners about enabling these capabilities for your program.
If you have questions about the new Risk packaging or SKU entitlements, please reach out to your account team. They have the account knowledge to understand your IRM environment and discuss the impact of these new account-level packaging entitlement questions in this blog.
Resources
Check out our series of articles exploring capabilities on the ServiceNow AI Platform that you may not be aware of but could be useful in improving your risk program. Now Assist summarization, AI Data Explorer, Workflow Data Fabric, Process Mining, AI Reporting Assistant)
