---
title: "Contract Management Pro (with ServiceNow Otto for Contract Management Pro) (ServiceNow, Inc.)"
url: "https://ailawframework.com/software/servicenow-contract-management-pro"
type: "software_profile"
site: "AI Law Framework"
id: "servicenow-contract-management-pro"
vendor: "ServiceNow, Inc."
category: "Legal-specific"
segment: "Contract review and CLM"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Contract Management Pro (with ServiceNow Otto for Contract Management Pro) (ServiceNow, Inc.)

> Contract request, template, clause and repository application on the ServiceNow platform for in-house legal and procurement teams, with AI clause analysis, metadata and obligation extraction, conversational search and…

Canonical page: https://ailawframework.com/software/servicenow-contract-management-pro  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Contract Management Pro plus the ServiceNow Otto for Contract Management Pro plugin, Brazil release docs updated 2026-09-10, with the platform Data Security Addendum. Subscription terms, privacy statement and subprocessor list not read.

Contract request, template, clause and repository application on the ServiceNow platform for in-house legal and procurement teams, with AI clause analysis, metadata and obligation extraction, conversational search and e-signature.

## Capabilities

- Contract review and redlining
- Clause libraries and playbooks
- Document automation
- Data extraction
- Knowledge search
- Document summarisation
- Agentic workflows
- Compliance monitoring
- Intake and triage
- Electronic signing and execution

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, Multiple specified locations |
| Australian region | Yes |
| Model providers | Now LLM Service, Azure OpenAI, Google Gemini, Anthropic Claude on AWS |
| Assurance | ISO/IEC 27001:2022 (certified organisation since 2012; certificate linked from the compliance page), ISO/IEC 27017:2015 (since 2018), ISO/IEC 27018:2019 (since 2016), ISO/IEC 27701:2019 (received 2020), ISO/IEC 42001 Artificial Intelligence Management System, ISO 9001:2015, ISO/IEC 20000-1:2018, SSAE 18 SOC 1 Type 2 (since 2011; report via ServiceNow CORE), SSAE 18 SOC 2 Type 2 (since 2013; report via ServiceNow CORE), BSI C5 attestation report (received 2020), CSA STAR Level 2 certification, EU Cloud Code of Conduct (externally validated), APEC Privacy Recognition for Processors, MTCS Level 3 (Singapore), ASD IRAP assessed for OFFICIAL and PROTECTED cloud services (Australian Platforms), FedRAMP High P-ATO for Government Community Cloud (2019) and DoD IL4 provisional authorisation, HITRUST certification, UK Cyber Essentials Plus (scoped to the UK region), EU-U.S., UK Extension and Swiss-U.S. Data Privacy Framework participant |
| Training on customer content | Unknown |
| Retention | The Data Security Addendum requires back-ups of all Customer Data 'in accordance with the then-current operating procedure available in the CORE Portal' (clause 4.2) and industry-standard sanitisation of media containing Customer Data before final disposal (clause 3.1.2). It states no retention period for contract documents, AI prompts, outputs, extraction results or logs, and the CORE Portal procedure sits behind a customer login and was not read. |
| Integrations | SharePoint Online Search Connector, Universal Request, Universal Task, External storage systems (documented generically; no provider named on the pages read), E-signature and wet signature (no e-signature provider named on the pages read) |
| Legal content coverage | No primary-law, case-law or legislative content. The application operates over the customer's own contract documents, templates, clauses and clause variations held in the customer's ServiceNow instance (Contract Management Pro documentation, Brazil release, updated 10 September 2026). |
| Pricing | No price is published on the pages read. Contract Management Pro is documented as a solution installed and configured in the customer's ServiceNow instance, and ServiceNow Otto for Contract Management Pro is documented as a plugin installed by an administrator holding the sn_cm_gen_ai.ai_contract_admin role, with skills activated separately. The Data Security Addendum refers to instances 'purchased' under an Order Form. A ServiceNow entitlements and packages page exists but was not read within the credit cap. |
| Australian presence | Yes. No Australian contracting entity, ACN or ABN was found on the pages read. The trust and compliance page states that 'ServiceNow's Australian Platforms has been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data', names Australian Government agencies and critical infrastructure providers as the intended users of that assessment, points Australian regulated customers to a separate portal, and publishes an Australia/NZ English locale of the same page. Data Security Addendum clause 4.1 requires purchased instances to be hosted in data centres in the geographic region specified on the Order Form. Which ServiceNow entity signs an Australian order, and its ACN, would be settled by the Order Form and the regional entity schedule; neither was read within the credit cap. |
| Website | https://www.servicenow.com |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product boundary and components | Public claim only | Documentation read 2026-09-27 (Brazil release, updated 10 September 2026) states: 'The ServiceNow Contract Management Pro solution enables you to set up contract document templates, clauses, and clause variations, and to initiate contract and amendment requests. The solution uses AI to analyze non-standard and missing clauses in contracts, extract obligations and metadata, and provide AI-assisted search. It also supports e-signatures, wet signatures, and external storage systems.' The generative features are a separate documented component, ServiceNow Otto for Contract Management Pro, installed as a plugin with skills activated by an administrator. Three application roles are named: sn_cm_gen_ai.ai_contract_admin, sn_cm_gen_ai.ai_contract_config and sn_cm_gen_ai.ai_contract_fulfiller. | Which subscription entitles us to Contract Management Pro, and is ServiceNow Otto for Contract Management Pro included in it or licensed and metered separately? | [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Deployment and instance model | Public claim only | The Data Security Addendum, clause 4.1, states that ServiceNow 'will host the purchased instances in data centers located in the geographic region specified on the Order Form which have attained SSAE 18 Type 2 attestations or have ISO 27001 certifications (or equivalent or successor attestations or certifications)'. The Contract Management Pro documentation describes installation and configuration into the customer's own instance, and a domain separation topic for the application. Documentation for the sibling AI application in the same portfolio refers to 'self-hosted customers' as a distinct category, so a non-hosted option appears to exist on the platform; that was not confirmed for Contract Management Pro. | Which data centre region will our instance sit in, will it be named on the Order Form, and is Contract Management Pro with its AI capabilities supported on a self-hosted deployment? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| AI functions documented for this application | Public claim only | The AI capabilities page, read 2026-09-27, documents four capabilities. AI skills extract metadata from signed contracts and analyse contracts for clause compliance, identifying non-standard and missing clauses. An agentic workflow named 'manage contract repository' extracts metadata and obligations from signed contracts, 'calculates reminder dates based on contract end dates and renewal clauses, and enables users to review and update contract information through a playbook interface'. Conversational search lets a user query contract metadata and perform semantic search inside signed contract documents from the ServiceNow Otto panel. The vendor's own benefit table records that extracted information is reviewed and approved 'through a playbook interface before updating the contract repository'. Contract Workspace widgets categorise and prioritise contract requests and a Contracts Dashboard reports on contract request trends. | For each of the four documented capabilities, which release do we need, which skills must be activated, and what does the fulfiller see when the model is uncertain about an extracted value? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html) |
| Governing law and Australian regulatory position | Not confirmed | No governing law or forum clause was found. The Data Security Addendum is a security schedule and contains no governing law provision; the subscription agreement it attaches to was not read within the credit cap. The trust and compliance page addresses Australian regulatory expectations only through the ASD IRAP assessment of ServiceNow's Australian Platforms for OFFICIAL and PROTECTED data and a separate portal for Australian regulated customers. Nothing read names an Australian contracting entity or an Australian Privacy Principles addendum. | Which ServiceNow entity contracts with Australian customers, what is its ACN, what law and forum govern the subscription agreement, and will you sign an Australian Privacy Principles addendum covering notifiable data breaches? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Documented integrations and storage | Public claim only | The Contract Management Pro documentation navigation read 2026-09-27 lists a SharePoint Online Search Connector, Universal Request, Universal Task, a 'Better Together integrations' section and a domain separation topic. The landing page states the solution 'supports e-signatures, wet signatures, and external storage systems' without naming an e-signature provider or an external storage provider. No connector permission scopes or data-flow descriptions were read. | Name the e-signature and external storage providers supported for Contract Management Pro, and document for each connector what contract content leaves the instance and under whose credentials. | [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html) |
| Published evidence of output quality | Not confirmed | No accuracy figures, evaluation method, test set or error rate for clause analysis, metadata extraction, obligation extraction or conversational search was published on the pages read, checked 2026-09-27. The documentation describes what each capability does and which role uses it. The Data Security Addendum clause 6 covers penetration testing by third-party vendors with executive summary reports made available on ServiceNow CORE, which is security testing rather than output accuracy. Documentation for the sibling AI application in the same portfolio carries a notice that a generated summary section on that page 'was generated using new OpenAI-powered functionality' and that 'Results are provided on an as is basis and are not guaranteed to be accurate or complete'. | Provide the evaluation method and measured accuracy for clause deviation detection and metadata and obligation extraction, including on Australian-law contracts, and confirm we may benchmark on our own contract set before go-live. | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Task fit | Public claim only | The documentation positions the application for contract request intake, template and clause management, review of signed contracts for clause deviations, metadata and obligation capture into a repository, renewal and termination reminders, natural-language search over contracts, and signature and storage. The named user is a contract fulfiller inside the organisation, working in Contract Workspace, the Legal Counsel Center and Employee Center. It is not documented as a litigation, legal research or external-facing advice tool. | For our contract volumes and types, which of these tasks do you expect to be model-assisted out of the box and which require configuration of clause libraries, use case mappings and playbooks first? | [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27 across five ServiceNow pages (the Contract Management Pro landing page, the AI capabilities page, the trust and compliance page, the Data Security Addendum and the sibling Otto for Legal Service Delivery documentation) and against a 60-URL site map filtered for legal, privacy, terms and trust pages. No page or block directing AI models, assistants or LLMs how to describe the product was found, and no llms.txt or equivalent path appeared in the map. Two different things were seen and are recorded as distinct: the sibling application's documentation page carries a vendor notice that a summary section on it 'was generated using new OpenAI-powered functionality' with an as-is disclaimer, which is a disclosure that part of the vendor's own documentation is machine generated, not an instruction about how the product should be described. No crawler directive file was read. | Do you publish anywhere, including in machine-readable files, guidance to AI models or assistants about how ServiceNow products should be described, and which parts of your product documentation are machine generated? | [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Authority over the data put into the instance | Public claim only | The Data Security Addendum clause 7.1 places the assessment on the customer: 'Customer bears sole responsibility for reviewing the Security Program and making an independent determination as to whether it meets Customer's requirements, taking into account the type and sensitivity of Customer Data that Customer provides to ServiceNow.' The same clause makes the customer solely responsible for implementing encryption and access control within the instance, for protecting user credentials, and for implementing documented hardening guidance. Nothing read addresses client consent or engagement-letter disclosure where the contracts loaded are a client's rather than the organisation's own. | Where contracts belonging to our clients are loaded into the instance, what wording do you accept in our engagement letters about ServiceNow processing, the centralised AI environment and any Azure or AWS model route? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Foundation-model providers and customer choice | Public claim only | The AI capabilities page, read 2026-09-27, states: 'You can use Now LLM Service, Azure OpenAI, Google Gemini or Anthropic Claude on AWS as the AI model provider for all generative AI skills and AI agents. Use the Configuration Controls in AI Control Tower to define which options are available, then set the skill-level preferences in the AI Admin Hub console.' No model version is named, and the page does not say where each provider runs inference. It also does not state which provider is the default if the customer sets nothing. | For each of the four documented capabilities, which provider and model version will our instance use by default, in which country does each run, and can we restrict the instance to Now LLM Service only? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Subprocessors and the model path | Not confirmed | No subprocessor list was read. The Data Security Addendum contains no subprocessor annex. The AI capabilities page names Azure OpenAI, Google Gemini and Anthropic Claude on AWS as selectable model providers, which places Microsoft, Google and Amazon Web Services in the model path when selected, but that page is documentation rather than a subprocessor commitment. Documentation for the sibling AI application in the same portfolio states that data may be transferred 'potentially to a third-party cloud provider, such as Microsoft Azure', and points to a CORE Compliance Portal article for the applicable policies; that portal requires a customer login and was not read. ServiceNow's privacy statement was identified from the compliance page but not read within the credit cap. | Provide the dated subprocessor list that will apply to our instance, identifying every entity in the AI path, its country, and the notice period before a new one is added or a model provider is changed. | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Use of customer content to develop models | Not confirmed | No statement about training on customer content appears on the Contract Management Pro landing page, the AI capabilities page, the trust and compliance page or the Data Security Addendum, all read 2026-09-27. Documentation for a different application in the same portfolio, ServiceNow Otto for Legal Service Delivery, does carry such a notice: 'ServiceNow collects and uses the inputs, outputs, and edits to outputs of this application to develop and improve ServiceNow technologies including ServiceNow models and AI products', with the statement that 'Customers can opt out of future data collection at any time, as described in the Now Assist Opt-Out page'. That notice is published for the Legal Service Delivery application, not for Contract Management Pro, and no equivalent notice was found on the Contract Management Pro pages read. ServiceNow holds ISO/IEC 42001 certification for an artificial intelligence management system. | Does the same input, output and edit collection notice apply to ServiceNow Otto for Contract Management Pro, is the opt-out available to us at instance level before go-live, and will that be recorded in the Order? | [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Use of corrections and feedback | Not confirmed | Nothing on the Contract Management Pro pages read addresses what happens to a fulfiller's corrections. The documented workflow generates exactly that data: the agentic workflow 'enables users to review and update contract information through a playbook interface' and the benefit table refers to reviewing and approving extracted information before the repository is updated. For the sibling Legal Service Delivery application the vendor states it collects 'edits to outputs' to develop and improve its technologies, with an opt-out. Whether the same applies here was not established. The documentation pages also carry a per-page 'Rate this content' feedback control, which concerns the documentation rather than the product. | When a fulfiller corrects an extracted value or rejects a clause finding, is that correction used beyond our instance, and can it be confined to our instance or switched off? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Retention of contract data, prompts and logs | Public claim only | The Data Security Addendum, read 2026-09-27, addresses back-ups at clause 4.2: back-ups of all Customer Data are performed 'in accordance with the then-current operating procedure available in the CORE Portal'. Clause 3.1.2 requires an industry-standard method for deletion of media containing Customer Data before final disposal. The Addendum sets no retention period for contract documents, AI prompts, model outputs, extraction results or application logs, and the CORE Portal operating procedure was not read because it requires a customer login. | State the retention period for contract documents, AI prompts and outputs, extraction results, application logs and back-ups, including any copy held in the centralised AI environment, and which of those we can configure. | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Deletion on instruction and on exit | Not confirmed | The Data Security Addendum covers sanitisation of physical media before final disposal (clause 3.1.2) but contains no obligation to delete or return Customer Data on termination, no deletion timeframe and no deletion certificate. The subscription agreement and any data processing addendum, which would carry those obligations, were not read within the credit cap. No deletion statement for data held in the centralised AI environment described for the sibling application was found. | Which clause obliges you to delete or return our contract data on termination, in how many days, does it cover back-ups and any copy in the centralised AI environment, and will you certify deletion in writing? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Vendor access to customer content | Not confirmed | The Data Security Addendum requires a designated Chief Information Security Officer or equivalent, documented and management-approved security policies communicated to personnel and contractors, and workstation controls including full disk encryption with a minimum of AES 128-bit, and it restricts personnel from disabling security mechanisms. It does not set out when ServiceNow personnel may access data inside a customer instance, whether customer approval is required, or whether an access log is available to the customer. No support-access or break-glass process was found on the pages read. | Under what circumstances can ServiceNow personnel or contractors read contract documents inside our instance, is our per-incident approval required, and can we export a log of every such access? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Authentication, roles and audit logs | Public claim only | The Data Security Addendum clause 7.1 states that functionality is provided to authenticate users before accessing the customer's instance, encrypt passwords, allow users to manage passwords and access instance application logs, and that the customer 'will manage each user's access to and use of the Subscription Services by assigning to each user a credential and user type that controls the level of access'. The customer bears sole responsibility for implementing access control within the instance and for hardening. Application-level control for this application is by the three named roles: sn_cm_gen_ai.ai_contract_admin, sn_cm_gen_ai.ai_contract_config and sn_cm_gen_ai.ai_contract_fulfiller. Single sign-on, multi-factor authentication and audit log export are not specified in the Addendum. | Confirm single-sign-on-only enforcement, multi-factor authentication, provisioning and IP restriction for our instance, and show the exportable audit record of AI skill invocations, prompts and repository updates. | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Encryption in transit and at rest | Public claim only | The Data Security Addendum, read 2026-09-27, splits these. Clause 3.2.8 requires industry-standard encryption for Customer Data in transit over public networks. Clause 3.2.9 states that 'The encryption of Customer Data at rest will be determined by Customer and, if encrypted, will be encrypted as determined by Customer according to the applicable offering.' Clause 7.1 reinforces that the customer 'bears sole responsibility for implementing encryption and access control functionalities within the instance to protect Customer Data and assumes all liability for damages directly resulting from any decision not to encrypt Customer Data.' Encryption at rest is therefore a customer configuration decision and a customer liability, not a vendor default stated in this document. | Which encryption-at-rest offering applies to our contract documents and attachments, what does it cost, does it cover attachments, indexes and back-ups, and who holds the keys? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Independent assurance and Australian assessment | Public claim only | The trust and compliance page, read 2026-09-27, lists ISO/IEC 27001:2022 (certified since 2012, with a certificate link), ISO/IEC 27017:2015 (since 2018), ISO/IEC 27018:2019 (since 2016), ISO/IEC 27701:2019 (2020), ISO/IEC 42001 for artificial intelligence management, ISO 9001:2015, ISO/IEC 20000-1:2018, SSAE 18 SOC 1 Type 2 (since 2011) and SOC 2 Type 2 (since 2013) with stated report periods and bridge letters available via ServiceNow CORE, BSI C5, CSA STAR Level 2, the EU Cloud Code of Conduct, APEC Privacy Recognition for Processors, MTCS Level 3 for Singapore, FedRAMP High P-ATO and DoD IL4 for the Government Community Cloud, HITRUST, UK Cyber Essentials Plus scoped to the UK region, and Data Privacy Framework participation. For Australia it states that 'ServiceNow's Australian Platforms has been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data'. No report was opened; SOC reports sit behind the CORE portal. The Data Security Addendum clause 1 commits to a security programme aligned to the ISO 27001 series or a substantially equivalent standard, and clause 6 to third-party penetration testing with executive summaries on CORE and a customer right to request its own test subject to ServiceNow's policy and agreement. | Provide the current SOC 2 Type 2 report and the ISO/IEC 27001:2022 and ISO/IEC 42001 certificate scope statements, confirm whether Contract Management Pro and its AI skills are inside those scopes, and supply the IRAP assessment report date and scope for the Australian platform. | [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Contract documents read and not read | Public claim only | The Data Security Addendum was read in full on 2026-09-27. It is a bilingual English and Japanese schedule which states that the English version prevails, and it governs the security programme, physical and logical controls, data location, back-up, disaster recovery and business continuity, incident and breach notification, penetration testing and customer responsibilities. It contains no liability cap, warranty, intellectual property, output ownership or governing law provision; those sit in the subscription agreement, which was not read within the credit cap, along with any data processing addendum and the privacy statement. | Send the subscription agreement, data processing addendum and AI-specific terms that would apply to us, and identify the liability cap, who owns AI outputs, and any carve-out for the AI features. | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Data location, cross-border transfer and where inference runs | Not confirmed | Two published positions sit at different levels and pull in different directions. Data Security Addendum clause 4.1 ties the instance to data centres in the geographic region named on the Order Form, and the trust and compliance page states that ServiceNow's Australian Platforms are IRAP assessed for OFFICIAL and PROTECTED data, so an Australian instance region is available. Documentation for the sibling AI application in the same portfolio states that using it 'requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment, which may be located in a different data center region from the one where your instance is, and potentially to a third-party cloud provider, such as Microsoft Azure', and that 'Some AI products/features are currently unavailable for customers in the FedRAMP, NSC DOD IL5, or Australia IRAP-Protected data centers, self-hosted customers, or in other restricted' environments, referring the reader to knowledge base articles for availability by region and model provider. Whether either statement governs Contract Management Pro was not established; no equivalent notice was found on the Contract Management Pro pages read, and nothing read states where inference for its AI skills runs. ServiceNow also participates in the EU-U.S., UK and Swiss-U.S. Data Privacy Framework. | If our instance is in an Australian data centre, does ServiceNow Otto for Contract Management Pro work at all, and if so does the prompt and contract text leave Australia for a centralised environment, Azure OpenAI, Google Gemini or Anthropic Claude on AWS, and in which country does each run? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Breach notification | Public claim only | Data Security Addendum clause 5.2.1 requires ServiceNow to report to the customer any 'accidental or unlawful destruction, loss, alteration, unauthorized disclosure, of or access to Customer Data' as a Breach 'without undue delay following determination by ServiceNow that a Breach has occurred'. There is no fixed hour or day deadline, and the clock starts on ServiceNow's own determination. Clause 5.2.2 sends the initial report to the security or privacy contacts the customer has designated in the support portal, or failing that the primary technical contact, and requires the information described in Article 33 of the GDPR to the extent reasonably possible. Clause 5.2.3 states the customer 'is solely responsible for determining whether to notify the relevant supervisory or regulatory authorities and impacted Data Subjects'. Clause 5.1 covers monitoring and escalation, and clause 7.2 requires the customer to maintain security contacts in the support portal. | Will you accept a fixed notification deadline in hours measured from awareness of a suspected incident rather than from your determination, and will you cooperate with an Australian notifiable data breach assessment within that window? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) |
| Change of security programme, models and features | Public claim only | Data Security Addendum clause 1 allows ServiceNow to update the Security Program 'to address new and evolving security technologies, changes to industry standard practices, and changing security threats, provided that no such update will materially reduce the overall level of commitments or protections provided to Customer as described herein.' There is no notice period for such an update. On the AI side, the AI capabilities page presents the model provider as a configurable choice through AI Control Tower and the AI Admin Hub, and documentation for the sibling application states that availability of AI model providers and features 'may vary based on geographic region, data center environment, and regulatory requirements' and directs customers to knowledge base articles for the latest information, which places the burden of tracking change on the customer. | What advance written notice will we get before a model provider, region or AI feature availability changes for our instance, and will you pin our configuration so a platform release cannot change the provider without our approval? | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Export, continuity and transition | Not confirmed | The Data Security Addendum addresses the vendor's own continuity rather than customer exit: clause 4.3 requires an Information Security Contingency Plan tested at least annually with summary test results including actual recovery point and recovery times and documented action plans, and clause 4.4 an annually tested business continuity plan. No export format, bulk export mechanism, post-termination retrieval window, transition assistance or escrow was found in the Addendum or on the Contract Management Pro pages read. | Demonstrate a full export of contract records, attachments, extracted metadata, obligations, clause libraries and audit history in open formats, and state the retrieval window after termination and any transition assistance rate. | [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf); [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html) |
| Connectors and what leaves the instance | Not confirmed | The documentation names a SharePoint Online Search Connector, Universal Request and Universal Task, and states that the solution supports e-signatures, wet signatures and external storage systems without naming providers. Separately, the AI path is itself an outbound route: the AI capabilities page names Azure OpenAI, Google Gemini and Anthropic Claude on AWS as selectable providers, and the sibling application's documentation describes transfer to a centralised ServiceNow environment and potentially to a third-party cloud provider. No permission scopes, credentials or payload descriptions were read for any of these. | For each connector and for each model provider option, document the credential used, the payload sent, whether full contract text or only an extract leaves the instance, and how we disable a route we do not accept. | [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html); [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Open-web retrieval | Not confirmed | No open-web search or external browsing is described for this application on the pages read, checked 2026-09-27. Conversational search is documented as querying contract metadata and performing semantic search inside the customer's signed contract documents, and the agentic workflow as operating over signed contracts in the repository. Absence of a description is not confirmation that no AI agent on the wider platform can reach the open web. | Can any AI agent or skill reachable from Contract Management Pro retrieve content from the open internet, and if so what payload leaves our instance and can we block it at instance level? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |
| Actions taken and confirmation gates | Public claim only | The documented agentic workflow acts on the repository: it extracts metadata and obligations from signed contracts, calculates reminder dates from contract end dates and renewal clauses, and updates contract information. The vendor's own benefit table states that users 'review and approve extracted information through a playbook interface before updating the contract repository', which is a documented approval step before a write. Other documented actions are request routing, signature requests and external storage writes. No list of which actions can run without a human, and no statement about isolating instructions embedded in an uploaded counterparty document, was found on the pages read. | Which actions can the manage contract repository workflow take without a fulfiller approving, and how is text inside an uploaded counterparty contract prevented from being treated as an instruction to the agent? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw); [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html) |
| Human review before a result is relied on | Public claim only | The AI capabilities page documents a review step for the extraction path: the agentic workflow 'enables users to review and update contract information through a playbook interface', and the benefit table records that users 'review and approve extracted information through a playbook interface before updating the contract repository'. The role that does this is the AI contract fulfiller, sn_cm_gen_ai.ai_contract_fulfiller. No equivalent mandatory review step is documented for clause deviation findings or for conversational search answers, and no per-output record of which model produced a result and who approved it was found on the pages read. | Is the playbook approval step mandatory or can it be bypassed by configuration, and can we export a per-result record showing which model provider produced each clause finding or extraction and which fulfiller approved it? | [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) |

## Notes

Five firecrawl operations were available and all five were used: the Contract Management Pro documentation landing page and the AI capabilities page, one filtered site map, the trust and compliance page, and the Data Security Addendum. A fifth source, the Otto for Legal Service Delivery documentation, was read from the research cache at no credit cost and is used only where the finding says plainly that it documents a different application. Not read, and therefore unverified: the ServiceNow subscription agreement, the privacy statement, any data processing addendum, the subprocessor list, the CORE Compliance Portal and the knowledge base articles on AI feature and model availability by region, all of which sit behind a customer login or outside the credit cap. The Australian position is split and is recorded that way: an Australian instance region exists and is IRAP assessed for OFFICIAL and PROTECTED, while the sibling application's documentation states that some AI features are unavailable in Australia IRAP-Protected data centres and that data may move to a centralised environment in another region and potentially to Microsoft Azure. Whether that governs Contract Management Pro is the single most important open question. No Australian contracting entity or ACN was found. Training on customer content is recorded as unknown for this application because the collection notice found is published for a different one. No content directing how AI should describe the product was found.

## Sources

- [Contract Management Pro — product documentation (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cncore-cmpro-landing-page.html) (checked 2026-09-27)
- [AI capabilities in Contract Management Pro — ServiceNow Otto for Contract Management Pro (Brazil release, updated 10 September 2026)](https://www.servicenow.com/docs/r/lQvlMH7wms_OXLbvKPDm7g/Z_w6vGPqRI8LvW1atFd0Sw) (checked 2026-09-27)
- [ServiceNow trust and compliance — certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) (checked 2026-09-27)
- [ServiceNow Data Security Addendum (contract schedule, English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Data-Security-Addendum.pdf) (checked 2026-09-27)
- [ServiceNow Otto for Legal Service Delivery — documentation for a different application in the same portfolio, read for its AI data-handling notices](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.