--- sourceDocument: brazil Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/delta-zurich-brazil Release : - brazil ft:locale : - en-US ft:publication_title : - brazil Combined Product Files ft:clusterId : - delta3bz bundleId : - delta3bz --- # Combined Policy and Compliance Management release notes for upgrades from Zurich to Brazil # Combined Policy and Compliance Management release notes for upgrades from Zurich to Brazil {#ariaid-title1} Release version: Brazil Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 13 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Policy and Compliance Management Release Notes for Upgrades from Zurich to Brazil This consolidated release notes document covers key updates, new features, changes, and upgrade considerations for Policy and Compliance Management from the Zurich through Australia releases up to Brazil. It is designed to help ServiceNow customers prepare for and understand enhancements and modifications across these versions. Notably, there are no updates specific to the Brazil release itself. Show full answer Show less ## New Features * **Association of Citations to Controls (Zurich):** Allows direct linking of controls with multiple citations across standards and regulations, preventing duplication and ensuring accurate compliance scoring. * **Enhanced Control Objectives Rationalization (Zurich):** Automates rationalization initiation, simplifies recommendation workflows into two steps, skips approvals for reviewers who are owners, and improves UI navigation and commenting. * **Now Assist for IRM Citation Impact Analysis (Zurich):** Utilizes AI to detect and suggest updates to control objectives affected by changes in citation descriptions or guidance, enabling streamlined review and approval within the Now Assist panel. * **Control Objectives and Controls Enhancements (Zurich):** Introduces granular control objective requirements, automatic control requirement generation under entity types, and attestation capabilities at the control requirement level. * **Policy Exception and Extension Request Improvements (Zurich):** Approvers can view detailed pop-ups before decisions; indicator tasks are suppressed for exempt controls; requesters can provide additional information via a new interface button; linking requirements for issue-based exceptions have been broadened; and the GRC Approval Configurator now supports multi-level, multi-user group policy exception and extension approvals. * **Common Control Objective Creation (Zurich):** Uses generative AI to merge similar control objectives automatically, populating fields to streamline consolidation. * **Entity-Based Record Access Rules (Zurich):** New settings allow automatic inheritance of entity-based access restrictions on newly created controls and related records, improving security and reducing manual updates. * **Personal Authentication for Policy Authoring (Australia):** Enables a hybrid authentication model for Microsoft SharePoint and Google Drive, improving audit traceability by registering document operations under individual user credentials. * **Dashboard Access from Compliance Workspace (Australia):** Provides direct access to key Policy and Compliance Management dashboards without additional apps, enhancing monitoring capabilities. * **Assessment Template Versioning (Australia):** Supports version control for CRI tiering questionnaires, profile assessments, and control assessment templates to ensure assessments use the latest published versions. * **Role-Based Workspace Redirection (Australia):** Email notification links now direct users to workspaces appropriate to their roles, improving navigation efficiency across multiple record types. * **Control Objective Workflow (Australia):** Introduces a structured lifecycle management for control objectives with states, revision types, and owner controls, allowing editing without disrupting published records. * **Unified Rationalization of UCF and Non-UCF Control Objectives (Australia):** Enables combined rationalization processes with clear guidance on retaining Unified Compliance Framework objectives. ## Changes * **Coral Theme (Zurich):** Adopted as the default for new portals and UI experiences, providing a modern, brand-neutral look with optional dark theme support and improved widget and page layouts. * **Compliance Workspace Enhancements (Zurich):** Removal of the Tasks panel to improve page performance. * **Rationalization Process UI and Functionality (Zurich):** UI redesigned for clearer actions, validations added, support for multiple AI providers introduced, and better display of recommendation statuses. * **ServiceNow Otto AI Platform Updates (Australia):** Renaming of Now Assist to ServiceNow Otto, introduction of three AI licensing tiers (Foundation, Advanced, Prime), and default selection changes for large language model providers, enhancing AI capabilities in governance workflows. * **Control Attestations List View (Australia):** Addition of Control and Entity columns for better visibility into assessment instances across multiple interface points. ## Removed and Deprecated Features No features or functionalities were removed or deprecated between Zurich and Brazil releases. ## Activation and Requirements * **Activation:** Policy and Compliance Management must be requested and installed via the ServiceNow Store. * **Browser Support:** Supports the latest public release and two previous versions of Google Chrome, Firefox (including ESR), Microsoft Edge Chromium, and Safari 12.0+. ## Accessibility and Localization The Coral theme includes a dark mode option to enhance readability and reduce eye strain. No additional localization updates or accessibility changes were introduced. ## Practical Implications for ServiceNow Customers Upgrading to Brazil from Zurich or Australia enables customers to leverage enhanced AI-driven compliance management, more granular control and attestation capabilities, streamlined rationalization processes, and improved UI/UX with the Coral theme. Multi-level approval workflows and role-based access improvements foster better governance. Customers managing policy authoring with Microsoft SharePoint or Google Drive gain improved authentication tracking. The availability Consolidated page of all release notes for Policy and Compliance Management from Zurich to Brazil. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Policy and Compliance Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Zurich to Brazil. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Policy and Compliance Management to Brazil Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-policyandcompliancemanagement-summary__entry__2} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## New features Between your current release family and Brazil, new features were introduced for Policy and Compliance Management. {#dfrn3-policyandcompliancemanagement-summary__entry__10} | Release | Release notes | |-|-| | Zurich | [Association of citations to controls](https://www.servicenow.com/docs/access?context=citation-to-control-mapping&family=zurich&ft:locale=en-US) : In many compliance frameworks, a single control objective may be referenced by multiple citations across different standards, regulations, or policy requirements. Without proper association management, organizations risk duplicating controls, misinterpreting coverage, or inaccurately reporting compliance. The association of citations to controls feature addresses this challenge by enabling users to associate controls with citations directly. When this feature is enabled, compliance scores update dynamically based on the status of directly associated active controls. [Enhancements to control objectives rationalization process](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : The following enhancements have been introduced to the rationalization process of control objectives: * Rationalization process is now automatically created when selecting the Rationalize button in the control objective page.
 * The recommendation workflow has been simplified into a two-step process: Step 1 identifies duplicates by accepting or dismissing recommendations; Step 2 finalizes by retaining one recommendation or creating a new common control objective. * Approvals for the rationalization process are skipped for owners who are reviewers, and levels where all reviewers are owners are automatically approved.
 * Owners and approvers can add comments and justifications directly on recommendation cards and reply to existing comments.
 * The user interface has been updated with better navigation, quick summaries, visual improvements, and clear error messages. [Citation impact analysis and updates with Now Assist for IRM](https://www.servicenow.com/docs/access?context=control-objective-change-agent&family=zurich&ft:locale=en-US) : When a citation's description or supplemental guidance is updated, Now Assist identifies related control objectives that might be affected. It reviews these control objectives to determine whether the descriptions or guidance need changes and provides suggested updates. Users can review, provide feedback, and approve these updates directly in the Now Assist panel, ensuring that citation changes are reflected in associated control objectives. [Enhancements to control objectives and controls](https://www.servicenow.com/docs/access?context=co-overview-pc-ws&family=zurich&ft:locale=en-US) : The following enhancements have been introduced to control objectives and controls: * The Control objective requirements option provides a granular layer under a control objective. When each control objective has multiple statements, each statement becomes a control objective requirement. * The Create control requirements option generates control requirements automatically for every control generated under an entity type. * The Attestation at control requirement level enables attestation at a granular level for individual control requirements within a control. [Enhancements to policy exception and extension requests](https://www.servicenow.com/docs/access?context=review-policy-ext-and-extension-req-ws&family=zurich&ft:locale=en-US) : The following enhancements have been introduced: * For policy exception and extension requests, approvers can now view key details, such as justification, reason, and validity period, within a pop-up before approving or rejecting a policy exception or policy exception extension. * For manual indicators, if the associated control is marked as exempt, no indicator task is generated. * When a policy exception is in the Analyze state and the Awaiting Requested Information sub-state, the interface now includes a Send Information button that allows the requester to provide additional details or clarifications requested by the approver. * Previously, an issue-based exception required a linked policy or control objective for additional approvals. Now, it requires any one of the following: a linked policy, control objective, or control. The control must be linked to the policy exception itself, not just to the issue. [GRC Approval Configurator](https://www.servicenow.com/docs/access?context=grc-approval-configurator-for-policy-extension-and-exception&family=zurich&ft:locale=en-US) : The GRC Approval Configurator can now be used to manage both policy exception and extension approvals. It allows verification, approval, and extension rules to be defined based on state, sub-state, and other filter conditions, with support for multiple user groups and multi-level approvals. This enhancement provides greater flexibility in assigning appropriate approvers at each level based on defined conditions, facilitating structured and collaborative reviews. For extension approvals, users can now configure multiple approvers, overcoming the previous limitation of a single default approver (Compliance Manager). [Common Control Objective Creation](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : Use Generative AI to merge similar control objectives into a single, consolidated common control objective. The system automatically populates the name, description, and guidance fields from the accepted duplicates, eliminating the need to manually select a primary control objective. [Entity based record access rules to secure new records](https://www.servicenow.com/docs/access?context=c_GRCControls&family=zurich&ft:locale=en-US) : When entity based record access rules are enabled on the Entity Based Access Configuration Properties page, any newly created controls, control attestations, indicators, and indicator tasks associated with a configured entity will automatically inherit the entity-based access (EBA) value from that entity. Previously, users had to run bulk access updates to apply EBA restrictions whenever new objects were created. Additionally, when a standard control is converted to a common control, the Entity based access restriction option is inactive by default. Users can manually enable the EBA option for common controls directly from the Access Settings section in the Details tab of the respective control. | | Australia | [Personal authentication and document access permissions in policy authoring](https://www.servicenow.com/docs/access?context=personal-auth-and-document-access-policy-authoring&family=australia&ft:locale=en-US) : After upgrading Policy and Compliance Management to 22.3.2, you can enable personal authentication for policy authoring in Microsoft SharePoint and Google Drive. When enabled, policy authoring uses a hybrid authentication model. Create, connect, and upload operations run under the logged-in user's personal credentials, while document access permission grants and content sync always run under the shared service account. This approach supports audit traceability at the individual user level for document operations and keeps access management and sync consistent regardless of who initiates them. [Dashboard access from Compliance Workspace](https://www.servicenow.com/docs/access?context=view-dashboards-in-compliance-workspace&family=australia&ft:locale=en-US) : After upgrading to 22.3.2, you can access Policy and Compliance Management dashboards directly from the Compliance Workspace.The following dashboards are available: * Compliance Overview * Policy Acknowledgement * Policy Exception Overview * Policy Overview These dashboards are also accessible from the Platform Analytics application. [Assessment template versioning](https://www.servicenow.com/docs/access?context=template-versioning&family=australia&ft:locale=en-US) : After upgrading Policy and Compliance Management to 22.3.2, CRI tiering questionnaire, CRI profile assessment, and control assessment templates support versioning. Template managers can create and publish new versions of these templates over time. When a CRI tiering questionnaire, CRI profile assessment, or control assessment is initiated, the assessment is generated using the latest published version of the template. [Role-based workspace redirection for email notification links](https://www.servicenow.com/docs/access?context=grc-tasks-pol-comp-ws&family=australia&ft:locale=en-US) : After upgrading Policy and Compliance Management to 22.3.2, email notification links for Policy and Compliance Management records redirect users to their appropriate workspace based on their assigned roles. Users without a workspace role are redirected to the GRC Task Page, or to the classic UI if the common workspace is not installed. The following record types support workspace redirection: Controls, Evidence, Control risk indicators, Indicator task, Policy acknowledgments, and Policy exceptions. [Control objective workflow](https://www.servicenow.com/docs/access?context=concept_cob_workflow&family=australia&ft:locale=en-US) : After upgrading Policy and Compliance Management to 22.0.1, the new Control objective workflow feature introduces a structured lifecycle for managing control objective records. Enable this feature using the Enable Control Objective Workflow property under Policy and ComplianceAllProperties and is disabled by default. * When disabled, only the State field is added to control objective records. Active records show Published, inactive records show Retired, and new records default to Draft. * When enabled, control objectives move through: Draft, Review, Approved, Current version, and Retired. The following new fields are also introduced: State, Effective date, Revision type, and Record nature. * Editing a published control objective creates a working draft, keeping the published record active until approved changes are published. * Users must select a revision type: Major or Minor. A Major revision moves associated controls back to Draft. A Minor revision applies updates without moving controls back to Draft. * The Owner and Owning Group fields control who can edit the control objective and perform workflow actions. [Rationalizing control objectives](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=australia&ft:locale=en-US) : After upgrading Policy and Compliance Management to 22.0.1, both Unified Compliance Framework (UCF) control objectives and non-UCF control objectives can be rationalized together. * Recommendation cards show a Source field to indicate whether it originates from UCF or a non-UCF source. * As UCF control objectives cannot be deactivated, the Identify Duplicates and Finalize sub-states guide the users to retain the UCF control objective. Any UCF recommendations that are not retained are automatically dismissed when the user requests review. * Only one UCF control objective can be retained at a time. If you retain a different UCF control objective, the previously retained one is automatically dismissed. * When rationalization is complete, the retained UCF control objective stays active, accepted non-UCF recommendations are deactivated, and any dismissed UCF control objectives remain active and unchanged. | | Brazil | No updates for this release. | [ ] ## Changes Between your current release family and Brazil, some changes were made to existing Policy and Compliance Management features. {#dfrn3-policyandcompliancemanagement-summary__entry__18} | Release | Release notes | |-|-| | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Improved widget presentation and page layouts](https://www.servicenow.com/docs/access?context=compliance-manager-compliance-ws&family=zurich&ft:locale=en-US) : As part of the Coral theme enhancements, rounded card containers with drop shadows have been introduced for widgets across Compliance pages, and the gray background has been removed from the Compliance home page to simplify the interface. [Tasks panel in Compliance Home page](https://www.servicenow.com/docs/access?context=compliance-manager-compliance-ws&family=zurich&ft:locale=en-US) : The Tasks section has been removed from the Compliance Workspace to improve page performance. [Improvements to the rationalization process of control objectives](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : Several enhancements have been made to the rationalization process: * Redesigned the rationalization UI with a reordered layout and highlighted primary actions. * Validations added for deactivated and deleted control objectives. Introduced the "Restart Analyze" option to support reevaluation of recommendations. * Introduced support for Azure OpenAI, Amazon Bedrock, and Google Gemini for recommendations of control objectives. * Updated the Consolidate state UI to show the recommendation panel with retained and accepted control objectives and their associated items. | | Australia | [ServiceNow Otto® name announcement](https://www.servicenow.com/docs/access?context=sn-ai-implementation-landing&family=australia&ft:locale=en-US) : ServiceNow Otto introduced AI on the platform. As that experience has evolved, there's a new name for the experience. ServiceNow Otto® is the conversational AI platform integrated into ServiceNow workflows. It provides agentic capabilities, supports multimodal interactions across web, mobile, and messaging channels, and enables autonomous orchestration for cross-system workflows.The Now Assist for IRM (sn_irm_gen_ai) plugin, which provides generative AI capabilities for RCM, has been renamed to ServiceNow Otto for IRM. [Large language models on the ServiceNow AI Platform](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=australia&ft:locale=en-US) : The Now LLM Service is no longer the default model provider for new or inactive AI assets. A third-party LLM is now selected by default, while existing configurations using the Now LLM Service continue unchanged. The Now LLM Service is still available for manual selection. [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&family=australia&ft:locale=en-US) : The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available: * Foundation: AI basics to deliver insights * Advanced: AI to boost productivity across relevant use cases * Prime: Act autonomously with all AI assets, and create your own Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. [SAE columns in Control Attestations list view](https://www.servicenow.com/docs/access?context=c_Attestations&family=australia&ft:locale=en-US) : The Control Attestations list view now displays the Control and Entity columns, showing the control name and associated entity for each assessment instance. These columns are visible on the Compliance Workspace, Tasks page, Employee Center, and Risk Portal. | | Brazil | No updates for this release. | [ ] ## Removed Between your current release family and Brazil, some Policy and Compliance Management features or functionality were removed. {#dfrn3-policyandcompliancemanagement-summary__entry__26} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Deprecations Between your current release family and Brazil, some Policy and Compliance Management features or functionality were deprecated. {#dfrn3-policyandcompliancemanagement-summary__entry__34} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Activation information Review information on how to activate Policy and Compliance Management. {#dfrn3-policyandcompliancemanagement-summary__entry__42} | Release | Release notes | |-|-| | Zurich | Activation information : Install Policy and Compliance Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Policy and Compliance Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | Activation information : Install Policy and Compliance Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Policy and Compliance Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Brazil | No updates for this release. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__50} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__58} | Release | Release notes | |-|-| | Zurich | Browser requirements : Policy and Compliance Management supports the latest public release and the two preceding versions of the following web browsers: * Google Chrome * Firefox and Firefox Extended Support Release (ESR) * Microsoft Edge Chromium * Safari 12.0 and later versions | | Australia | Browser requirements : Policy and Compliance Management supports the latest public release and the two preceding versions of the following web browsers: * Google Chrome * Firefox and Firefox Extended Support Release (ESR) * Microsoft Edge Chromium * Safari 12.0 and later versions | | Brazil | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Policy and Compliance Management, such as specific requirements or compliance levels. {#dfrn3-policyandcompliancemanagement-summary__entry__66} | Release | Release notes | |-|-| | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__74} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__82} | Release | Release notes | |-|-| | Zurich | * Association of citations to controls feature enables users to associate controls with citations directly to avoid duplicated controls and ensure accurate compliance reporting. * Multiple enhancements to control objectives rationalization process, including improvements including automatic rationalization process creation, simplified two-step workflow for recommendations, skipped approvals for owner-reviewers, comment capabilities, and improved UI. * Now Assist for IRM includes skills and AI agent to identify affected control objectives when citation descriptions change and to provide suggested updates for review and approval. * Enhancements to control objectives and controls, including control objective requirements for granular statements, automatic control requirement generation, and attestation at control requirement level. * Enhancements to policy exception and extension requests, including approver pop-ups with key details, no indicator tasks for exempt controls, Send Information button for requesters, and expanded linking requirements for issue-based policy exceptions. See [Privacy Management](https://www.servicenow.com/docs/access?context=privacy-management&family=zurich&ft:locale=en-US) for more information. | | Australia | * ServiceNow Otto is the new name for the Now Assist experience, delivering agentic AI, multimodal interactions, and autonomous cross-system workflow orchestration. * Enable personal authentication for policy authoring in Microsoft SharePoint and Google Drive to register policy documents under the logged-in user's identity instead of a shared service account. * Access Policy and Compliance Management dashboards directly from the Compliance Workspace, without installing Platform Analytics application. * Manage control objective changes through a structured workflow without affecting the active published record. * Rationalize UCF and non-UCF control objectives together in a single rationalization process. * Email notification links redirect users to their appropriate workspace based on their assigned roles. See [Policy and Compliance Management](https://www.servicenow.com/docs/access?context=r_PolicyComplianceMgmt&family=australia&ft:locale=en-US) for more information. | | Brazil | No updates for this release. | [ ] *[\>]: and then