Our summaries of what's happening across the ServiceNow ecosystem: release families, upgrade deadlines, GRC and IRM updates, AI, government audit and financial management, and public-sector contracts. Last updated October 14, 2026.
Release tracker
Where the release families stand
Q3 2025 · GA Sep 2025Zurich N-1 · plan upgrade
Q2 2026 · GA May 2026Australia Current (N)
Q4 2026 · GA Nov 2026Brazil Early Availability
Q2 2027 · GA TBACanada Upcoming
Dates reflect ServiceNow and community sources as of October 14, 2026. Always confirm against official ServiceNow release notes before scheduling an upgrade.
Industry
Q3 results due October 28 as analysts point to federal demand
ServiceNow will report third-quarter 2026 results after the market closes on Wednesday, October 28, with a conference call at 5 p.m. Eastern. Ahead of the report, BNP Paribas raised its fiscal 2026 outlook for the company, citing AI adoption and strong federal-sector demand.
PivotClear take: Federal demand at the license level shows up later as implementation, audit-readiness, and sustainment work. Watch the federal commentary on the call for where agencies are investing next.
Brazil still on track for November general availability
Brazil has been in Early Availability since September, and community trackers updated in October still point to general availability in November 2026. No delay to the GA window has been announced.
PivotClear take: Use the remaining Early Availability window to finish regression testing in sub-production. Lock your upgrade date once ServiceNow confirms GA.
State Department awards $5.1M ServiceNow development contract
The State Department’s Bureau of Information Resource Management awarded a one-year, $5.1 million contract for ServiceNow development and business process and form automation. The award record lists Incentive Technology Group as the contractor.
PivotClear take: Development and automation awards like this one often lead to follow-on governance and audit work. Agencies automating forms and processes on ServiceNow need controls and evidence designed in from the start.
ServiceNow: AI agent “kill switches” need business context
ServiceNow says containing an AI agent should not be all-or-nothing. The response should scale with the risk, following a discover, observe, govern, secure, and measure approach. ServiceNow is also working with Okta to secure agent identities and session tokens.
PivotClear take: Treat AI agents like any other risk-bearing asset: inventory them, assign owners, and tie containment decisions to documented controls.
Upgrade planning: Zurich customers, the clock is running
ServiceNow supports only the current release family and the one before it (N-1). Australia has been current since its May 5, 2026 GA, which puts Zurich at N-1. When Brazil reaches GA, Zurich becomes N-2 and falls outside the support window. Release cadence has also shifted: major releases now land in Q2 and Q4 rather than Q1 and Q3.
PivotClear take: If you are still on Zurich, schedule the move to Australia or Brazil now, stay on the latest patch, and confirm every Store app you depend on supports the target family.
What's new for GRC teams: risk grid, simpler audit evidence, entity-based access
ServiceNow's recent IRM updates for Zurich introduced a new grid interface for Risk Management, streamlined evidence request and response in Audit Management, and improvements to Regulatory Change Management and Privacy Management. Common core risk tooling also gained entity-based user access, which scopes what users can see by the entities they are responsible for.
PivotClear take: Entity-based access is a big deal for agencies with many components. Review your entity and profile design before turning it on so access maps cleanly to your organizational structure.
What to expect in Brazil: AI governance takes center stage
Partner previews of Brazil point to themes carried over from Knowledge 2026: expansion of AI Control Tower, maturing AI specialists within the Autonomous Workforce, the evolving Build Agent, and new partner integrations including Armis and Veza. Official Brazil release notes arrived alongside Early Availability.
PivotClear take: For regulated customers, the governance story matters as much as the AI features. Treat AI agents like any other risk-bearing asset: inventory them, assign owners, and map them to controls.
ServiceNow's second country-named release family, Brazil, opened Early Availability in late September after the date slipped from mid-month; Brazil Personal Developer Instances became available the same week. Early Availability lets customers upgrade both sub-production and production instances ahead of General Availability, which ServiceNow community sources expect in early November 2026.
PivotClear take: Start Brazil testing in a sub-production instance now. Early findings on customizations and skipped records are far cheaper to fix before GA than after.
AI Control Tower adds runtime monitoring and a kill switch
The August and September AI Control Tower update adds runtime monitoring with real-time agent evaluations, credential-revocation containment, connectors for Anthropic, OpenAI, and Microsoft Agent 365, AI cost attribution, and governance of the tools agents can call.
PivotClear take: This is the governance layer auditors will ask about. Map AI Control Tower evidence to your existing IRM controls rather than standing up a separate program.
Source: ServiceNow Community: AI Control Tower, Aug & Sep 2026
Contracts
ServiceNow now operating in nearly every U.S. state
ServiceNow announced that its platform is now in use at some level in nearly every U.S. state, highlighting state and local customers using AI-driven automation to cut service desk costs and reclaim staff hours.
PivotClear take: State adoption is accelerating. That creates demand for GRC and ITSM expertise in state programs, not just federal ones.
DoD shifted from fixing every material weakness to validating major line items with supporting documentation, using large samples and AI. GAO flagged unresolved IT weaknesses, fraud risk, and whether results can be sustained. The target is a clean opinion by the end of FY 2028, with the Working Capital Fund in FY 2027.
PivotClear take: The new approach runs on evidence — the same ground FIAR milestones and the GAO Green Book’s control activities push programs toward. Programs that can trace a line item to its source documents in one system will be ready first.
GAO reports $186 billion in improper payments across 64 programs at 15 agencies in FY 2025, up $24 billion from FY 2024. About 82% were overpayments, and 19 programs had error rates of 10% or more.
PivotClear take: Payment integrity is an internal-controls problem, and OMB Circular A-123 Appendix C is where agencies answer for it. Testing and remediation tracked in one system is how agencies show progress.
ServiceNow closed its acquisition of Armis, adding real-time cyber exposure management, cyber asset visibility, and identity intelligence to the platform's security and risk workflows.
PivotClear take: Better asset and exposure data flowing into ServiceNow means richer inputs for risk scoring and continuous control monitoring in IRM.
Government Forum: EmployeeWorks and Autonomous Workforce for agencies
At its annual Government Forum, ServiceNow introduced EmployeeWorks, which pairs Moveworks conversational AI with Employee Center as a single front door for agency staff. It also announced that its Autonomous Workforce capabilities are available in GCC NSC environments.
PivotClear take: Availability in government community cloud environments is the gating factor for most federal AI adoption. Watch which capabilities are authorized for your hosting environment before planning around them.
Source: ServiceNow Newsroom: Government Forum 2026
Audit & Finance
GAO: AI can fight fraud, but only with good data and skilled people
GAO testified that AI and data analytics can help agencies catch fraud and improper payments, but only with reliable data, human oversight, and an AI-ready workforce.
PivotClear take: AI is only as auditable as the data and controls under it. The GAO Green Book calls for quality information before reliance, so clean control and evidence records come first.
Air Force orders up to $510M in ServiceNow software via Carahsoft
The Department of the Air Force placed a firm-fixed-price call order with Carahsoft for cloud-based ServiceNow enterprise software, with a maximum value of $510 million.
PivotClear take: Large enterprise license buys are typically followed by implementation and sustainment work, which is where specialized small-business partners fit.
Official sources we follow: ServiceNow Community forums, ServiceNow release notes, and ServiceNow Newsroom (all at servicenow.com), and SAM.gov for contract opportunities.
PivotClear summaries are our own commentary and are not affiliated with or endorsed by ServiceNow, Inc.
GAO Watch
Latest GAO reports on audit and financial management
Based on the limited procedures GAO performed to review the performance of the independent public accountant’s (IPA) audit of the Congressional Award Foundation’s financial statements for fiscal year 2025, GAO did not identify any significant issues it…
GAO’s audit of the fiscal year 2025 consolidated financial statements of the U.S. government (CFS) identified control deficiencies in the processes the Department of the Treasury used to prepare the CFS.
The Department of Government Efficiency (DOGE) began posting its estimated savings on a web page known as the Wall of Receipts on February 17, 2025. As of July 7, 2026, the Wall of Receipts reported savings of $110 billion across contracts, grants, and…
Twenty programs, supporting a broad range of services from health care to disaster assistance, made up nearly 90 percent of federal obligations among programs administered by state and other government entities with obligations of over $100 million in…
The Office of Management and Budget annually designates a list of programs considered high-priority for improper payments. The Department of Veterans Affairs (VA) Community Care program and the Centers for Medicare & Medicaid Services’ (CMS) Medicare…
The Department of Veterans Affairs (VA) reported approximately $1 billion in cumulative estimated improper payments—including overpayments, underpayments, and unknown payments—across the Beneficiary Travel (BT) Program from fiscal years 2018 through 2024.…
Mature your Risk management program with expanded capabilties at the IRM base tier
ServiceNow Community forum
How to prevent past date selection on a GRC Control Attestation metric field?
ServiceNow Community forum
Best Practice for Cloning GRC Workspace (Custom Shell and using OOB Core Tables)
ServiceNow Community forum
Entity Based Access: how to hide upstream and other-branch entities (not just their linked records)?
Pulled automatically from the ServiceNow Community and ServiceNow's YouTube channels, filtered to GRC and IRM topics, and refreshed daily. Links open the original posts. Last refreshed Oct 2, 2026.
Headlines from DefenseScoop on Advana (renamed the War Data Platform in 2026) and DoD financial audit, refreshed daily. Links open the original articles. PivotClear is not affiliated with DefenseScoop. Last refreshed Oct 21, 2026.
Planning a GRC build or upgrade?
We drive solutions from requirement to audit-ready.
We use cookies. Essential cookies keep this site working. With your permission we also use analytics cookies to understand which pages are useful and how long visits last. See our Privacy & Cookie Policy.
Cookie settings
Strictly necessary
Required for the site to function and to remember your cookie choice. Always on.
Analytics
Google Analytics and Microsoft Clarity measure visits, time on page, and navigation so we can improve the site. No data is sold.
