--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Policy and Compliance Management release notes for upgrades from Yokohama to Zurich # Combined Policy and Compliance Management release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Policy and Compliance Management Release Notes for Upgrades from Yokohama to Zurich This document consolidates the release notes for Policy and Compliance Management upgrades from the Yokohama to the Zurich release. It highlights new features, changes, deprecations, activation details, and additional requirements to assist ServiceNow customers in preparing for and implementing the upgrade effectively. Show full answer Show less ## New Features * **Compliance Scoring and Entity Roll-up (Yokohama):** View comprehensive compliance scores rolled up from child entities to parent entities, improving oversight at the entity level. * **Duplicate Citation Elimination:** Remove duplicate citations from UCF downloads by marking duplicates inactive and consolidating control objectives to a single active citation. * **Compliance Workspace Performance:** Improved by removing the issue widget; issue details remain accessible via the Issues Overview section. * **Entity-Based Access:** Provides granular data access control for controls, attestations, and policy exception mappings. Administrators can assign access by users, groups, or entity user fields. * **Generative AI for Control Objective Deduplication:** Identifies and recommends similar control objectives for merging or dismissal, automatically consolidating related records to maintain comprehensive information. * **Association of Citations to Controls (Zurich):** Allows direct association of multiple citations to a single control objective to avoid duplication and improve compliance reporting accuracy. Compliance scores update dynamically based on active controls. * **Control Objectives Rationalization Enhancements:** Automates rationalization initiation, simplifies workflow into two steps, skips approvals for certain roles, enables commenting on recommendations, and improves UI navigation and error handling. * **Now Assist for IRM Citation Impact Analysis:** AI identifies control objectives affected by citation changes and suggests updates for user review and approval within the Now Assist panel. * **Control Objectives and Controls Enhancements:** Introduces granular control objective requirements, automatic generation of control requirements per entity, and attestation capabilities at the control requirement level. * **Policy Exception and Extension Request Improvements:** Approvers can view key request details via pop-ups; exempt controls no longer generate indicator tasks; requesters can send additional information during analysis; and linking requirements for issue-based exceptions are expanded. * **GRC Approval Configurator:** Now supports multi-level and multi-user group approvals for policy exceptions and extensions with flexible rule definitions based on states and filters. * **Common Control Objective Creation via Generative AI:** Merges similar control objectives automatically, populating relevant fields to streamline consolidation. * **Entity-Based Record Access Automation:** Newly created controls, attestations, and indicators inherit entity-based access settings automatically, reducing manual access updates. ## Changes * **Now Assist Skills Default Activation (Yokohama):** Certain Now Assist skills are enabled by default for new customers and unconfigured skills on upgrade, optimizing AI capabilities. * **Now Assist Usage Measurement Update:** Transition from a 365-day look-back to a burn-down model aligned with contract anniversary dates for more accurate usage tracking. * **Coral Theme (Zurich):** Introduces a fresh, brand-neutral default theme with improved widget presentation, rounded containers, removal of gray backgrounds, and a new dark theme option for web and mobile for better user experience. * **Compliance Home Page Updates:** Removal of the Tasks section from the Compliance Workspace to enhance page performance. * **Control Objectives Rationalization UI Improvements:** Redesigned UI with reordered layouts, validations for deactivated/deleted objectives, support for Azure OpenAI, Amazon Bedrock, Google Gemini, and enhanced recommendation displays. ## Deprecations * **GRC DevOps Accelerator (Yokohama):** Deprecated and no longer supported or available for new activation. ## Activation Information Policy and Compliance Management must be requested and installed from the ServiceNow Store. This applies to both Yokohama and Zurich releases. Customers should refer to the ServiceNow Store for app availability, version history, and activation procedures. ## Additional Requirements and Browser Support * No new additional requirements were introduced in these releases. * Supported browsers include the latest public release and two previous versions of Google Chrome, Firefox (and ESR), Microsoft Edge Chromium, and Safari 12.0 or later. ## Accessibility and Localization * **Dark Theme Availability:** The new Coral theme offers a dark mode option for web and mobile to improve readability and reduce eye strain. * No specific localization updates were noted for these releases. ## Why This Matters for ServiceNow Customers Upgrading to Zurich enhances Policy and Compliance Management with improved compliance scoring, AI-driven deduplication, granular access controls, and streamlined approval workflows. These enhancements increase data accuracy, reduce manual effort, and improve user experience, enabling better compliance oversight and reporting. The new Coral theme and UI Consolidated page of all release notes for Policy and Compliance Management from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Policy and Compliance Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Policy and Compliance Management to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-policyandcompliancemanagement-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Policy and Compliance Management. {#dfrn3-policyandcompliancemanagement-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Calculate compliance score and roll up to entity](https://www.servicenow.com/docs/access?context=compliance-score-calculation-pc-ws&family=yokohama&ft:locale=en-US) : View a comprehensive compliance score at the entity level that includes all the child entities rolled up to the parent entity along with the compliance score of the parent entity's direct controls. [Elimination of duplicate citations from UCF Shared list download](https://www.servicenow.com/docs/access?context=ucf-deduplication-pc&family=yokohama&ft:locale=en-US) : Eliminate duplicate citations associated with the authority documents when you download UCF content. You can retain one citation as active and mark the duplicate citations as inactive. Move the control objectives of the duplicate citations to the active citation, and update the duplicate citation records with the Source ID of the active citation. [Improve compliance workspace performance](https://www.servicenow.com/docs/access?context=compliance-manager-compliance-ws&family=yokohama&ft:locale=en-US) : Improved the performance of the compliance workspace by removing the issue widget to ensure a faster and smoother user experience. You can still access issue details from the "Issues Overview" section. [Entity based access](https://www.servicenow.com/docs/access?context=c_GRCControls&family=yokohama&ft:locale=en-US) : Entity based access aims to provide a more granular approach to data access, ensuring that users can only access data through entity-based access. The entity-based access has been enabled for controls, attestations and policy exception to control mappings. Administrators can grant access to an entity's related records by adding users or user groups, or by using entity user fields for entity-based access configuration. [Deduplication of control objectives](https://www.servicenow.com/docs/access?context=now-assist-for-irm&family=yokohama&ft:locale=en-US) : Using Generative AI, identify and recommend similar control objectives. You can choose to accept a control objective as duplicate, dismiss those that are not similar, or retain a control objective as primary in which details from all other similar control objectives are merged. Additionally, the system automatically copies related records, including policies and risk statements, to ensure comprehensive information is maintained in one location after retiring the accepted control objectives. | | Zurich | [Association of citations to controls](https://www.servicenow.com/docs/access?context=citation-to-control-mapping&family=zurich&ft:locale=en-US) : In many compliance frameworks, a single control objective may be referenced by multiple citations across different standards, regulations, or policy requirements. Without proper association management, organizations risk duplicating controls, misinterpreting coverage, or inaccurately reporting compliance. The association of citations to controls feature addresses this challenge by enabling users to associate controls with citations directly. When this feature is enabled, compliance scores update dynamically based on the status of directly associated active controls. [Enhancements to control objectives rationalization process](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : The following enhancements have been introduced to the rationalization process of control objectives: * Rationalization process is now automatically created when selecting the Rationalize button in the control objective page.
 * The recommendation workflow has been simplified into a two-step process: Step 1 identifies duplicates by accepting or dismissing recommendations; Step 2 finalizes by retaining one recommendation or creating a new common control objective. * Approvals for the rationalization process are skipped for owners who are reviewers, and levels where all reviewers are owners are automatically approved.
 * Owners and approvers can add comments and justifications directly on recommendation cards and reply to existing comments.
 * The user interface has been updated with better navigation, quick summaries, visual improvements, and clear error messages. [Citation impact analysis and updates with Now Assist for IRM](https://www.servicenow.com/docs/access?context=control-objective-change-agent&family=zurich&ft:locale=en-US) : When a citation's description or supplemental guidance is updated, Now Assist identifies related control objectives that might be affected. It reviews these control objectives to determine whether the descriptions or guidance need changes and provides suggested updates. Users can review, provide feedback, and approve these updates directly in the Now Assist panel, ensuring that citation changes are reflected in associated control objectives. [Enhancements to control objectives and controls](https://www.servicenow.com/docs/access?context=co-overview-pc-ws&family=zurich&ft:locale=en-US) : The following enhancements have been introduced to control objectives and controls: * The Control objective requirements option provides a granular layer under a control objective. When each control objective has multiple statements, each statement becomes a control objective requirement. * The Create control requirements option generates control requirements automatically for every control generated under an entity type. * The Attestation at control requirement level enables attestation at a granular level for individual control requirements within a control. [Enhancements to policy exception and extension requests](https://www.servicenow.com/docs/access?context=review-policy-ext-and-extension-req-ws&family=zurich&ft:locale=en-US) : The following enhancements have been introduced: * For policy exception and extension requests, approvers can now view key details, such as justification, reason, and validity period, within a pop-up before approving or rejecting a policy exception or policy exception extension. * For manual indicators, if the associated control is marked as exempt, no indicator task is generated. * When a policy exception is in the Analyze state and the Awaiting Requested Information sub-state, the interface now includes a Send Information button that allows the requester to provide additional details or clarifications requested by the approver. * Previously, an issue-based exception required a linked policy or control objective for additional approvals. Now, it requires any one of the following: a linked policy, control objective, or control. The control must be linked to the policy exception itself, not just to the issue. [GRC Approval Configurator](https://www.servicenow.com/docs/access?context=grc-approval-configurator-for-policy-extension-and-exception&family=zurich&ft:locale=en-US) : The GRC Approval Configurator can now be used to manage both policy exception and extension approvals. It allows verification, approval, and extension rules to be defined based on state, sub-state, and other filter conditions, with support for multiple user groups and multi-level approvals. This enhancement provides greater flexibility in assigning appropriate approvers at each level based on defined conditions, facilitating structured and collaborative reviews. For extension approvals, users can now configure multiple approvers, overcoming the previous limitation of a single default approver (Compliance Manager). [Common Control Objective Creation](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : Use Generative AI to merge similar control objectives into a single, consolidated common control objective. The system automatically populates the name, description, and guidance fields from the accepted duplicates, eliminating the need to manually select a primary control objective. [Entity based record access rules to secure new records](https://www.servicenow.com/docs/access?context=c_GRCControls&family=zurich&ft:locale=en-US) : When entity based record access rules are enabled on the Entity Based Access Configuration Properties page, any newly created controls, control attestations, indicators, and indicator tasks associated with a configured entity will automatically inherit the entity-based access (EBA) value from that entity. Previously, users had to run bulk access updates to apply EBA restrictions whenever new objects were created. Additionally, when a standard control is converted to a common control, the Entity based access restriction option is inactive by default. Users can manually enable the EBA option for common controls directly from the Access Settings section in the Details tab of the respective control. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Policy and Compliance Management features. {#dfrn3-policyandcompliancemanagement-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Some Now Assist skills are turned on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&family=yokohama&ft:locale=en-US) : The new default behavior works as follows: * New customers: When you install a Now Assist product, designated skills are turned on automatically. * Existing customers who are upgrading (starting with Yokohama Patch 11): Any previously unconfigured skill is turned on automatically (the skill was never configured and turned on, then turned off again). Previously configured skills that were turned on, then off, remain inactive. [Changes to Now Assist usage measurement](https://www.servicenow.com/docs/access?context=monitoring-now-assist-usage&family=yokohama&ft:locale=en-US) : Starting with Yokohama Patch 5, Now Assist usage measurement is transitioning from a 365-day look-back model to a 365-day burn-down model, with usage resetting at the contract anniversary date. For more information, refer to [KB KB2704710: Now Assist Usage - Overview \& New Measurement Logic](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2704710). | | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Improved widget presentation and page layouts](https://www.servicenow.com/docs/access?context=compliance-manager-compliance-ws&family=zurich&ft:locale=en-US) : As part of the Coral theme enhancements, rounded card containers with drop shadows have been introduced for widgets across Compliance pages, and the gray background has been removed from the Compliance home page to simplify the interface. [Tasks panel in Compliance Home page](https://www.servicenow.com/docs/access?context=compliance-manager-compliance-ws&family=zurich&ft:locale=en-US) : The Tasks section has been removed from the Compliance Workspace to improve page performance. [Improvements to the rationalization process of control objectives](https://www.servicenow.com/docs/access?context=take-actions-on-the-recommendations-for-similar-control-objectives&family=zurich&ft:locale=en-US) : Several enhancements have been made to the rationalization process: * Redesigned the rationalization UI with a reordered layout and highlighted primary actions. * Validations added for deactivated and deleted control objectives. Introduced the "Restart Analyze" option to support reevaluation of recommendations. * Introduced support for Azure OpenAI, Amazon Bedrock, and Google Gemini for recommendations of control objectives. * Updated the Consolidate state UI to show the recommendation panel with retained and accepted control objectives and their associated items. | [ ] ## Removed Between your current release family and Zurich, some Policy and Compliance Management features or functionality were removed. {#dfrn3-policyandcompliancemanagement-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Policy and Compliance Management features or functionality were deprecated. {#dfrn3-policyandcompliancemanagement-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | GRC DevOps Accelerator is now deprecated and no longer supported or available for new activation. For details, see the [Deprecation process \[KB0867184\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Policy and Compliance Management. {#dfrn3-policyandcompliancemanagement-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | Activation information : Install Policy and Compliance Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Policy and Compliance Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Policy and Compliance Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Policy and Compliance Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | Browser requirements : GRC: Policy and Compliance Management requires the latest public release and two previous release versions of the following browsers: * Google Chrome * Firefox and Firefox Extended Support Release (ESR) * Microsoft Edge Chromium * Safari 12.0 and later versions | | Zurich | Browser requirements : Policy and Compliance Management supports the latest public release and the two preceding versions of the following web browsers: * Google Chrome * Firefox and Firefox Extended Support Release (ESR) * Microsoft Edge Chromium * Safari 12.0 and later versions | [ ] ## Accessibility information Review details on accessibility information for Policy and Compliance Management, such as specific requirements or compliance levels. {#dfrn3-policyandcompliancemanagement-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Policy and Compliance Management we have noted them here. {#dfrn3-policyandcompliancemanagement-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | * View the compliance score at the entity level based on the hierarchy of entities. * Eliminate duplicate citations associated with the authority documents when you download UCF content. * Revise your policies and update the policy text periodically by integrating with Microsoft SharePoint. * Enable policy owners and reviewers to collaborate, review, and redline policies by using policy authoring and the redlining feature. * The Issues widget has been removed from the Compliance Workspace landing page to enhance the performance. * Enable data access by implementing Entity-Based Access controls. * Recommend similar control objectives using generative AI. You can then retain, dismiss, or merge duplicate control objectives. See [Policy and Compliance Management](https://www.servicenow.com/docs/access?context=r_PolicyComplianceMgmt&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Association of citations to controls feature enables users to associate controls with citations directly to avoid duplicated controls and ensure accurate compliance reporting. * Multiple enhancements to control objectives rationalization process, including improvements including automatic rationalization process creation, simplified two-step workflow for recommendations, skipped approvals for owner-reviewers, comment capabilities, and improved UI. * Now Assist for IRM includes skills and AI agent to identify affected control objectives when citation descriptions change and to provide suggested updates for review and approval. * Enhancements to control objectives and controls, including control objective requirements for granular statements, automatic control requirement generation, and attestation at control requirement level. * Enhancements to policy exception and extension requests, including approver pop-ups with key details, no indicator tasks for exempt controls, Send Information button for requesters, and expanded linking requirements for issue-based policy exceptions. See [Privacy Management](https://www.servicenow.com/docs/access?context=privacy-management&family=zurich&ft:locale=en-US) for more information. | [ ]