Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
This profile covers the ServiceNow Store application listed as 'ServiceNow Otto for Contract Management Pro', app scope sn_cm_gen_ai, latest version 2.5.2, 'Sold by ServiceNow', application type recorded on the listing as 'Generative AI' and pricing shown only as 'Paid' (listing read 2026-09-27). The listing names install requirements: Platform Document Intelligence (com.glide.platform_ml_di), ServiceNow Otto for Platform (com.sn_genai_platform) and Document Intelligence for Contract Management Content Pack (com.sn_docintel_cm_cp); Contract Management Pro (com.sn_cm_pro) and Contract Workspace (com.sn_cm_workspace) are listed as optional applications. The underlying Contract Management Pro licence and the platform subscription are separate and are not covered here.
Ask: What does our order need to include for these AI capabilities to work - the Store application, Contract Management Pro, Contract Workspace, Platform Document Intelligence and ServiceNow Otto for Platform - and which of those are already on our subscription?
Deployment model and hosting location
Public claim only
The application installs into a ServiceNow instance, so hosting follows the instance. Nothing on the Store listing or the Contract Management Pro AI documentation states where an instance or the AI processing sits. ServiceNow's documentation for the sibling Otto for Legal Service Delivery application states that 'Some AI products/features are currently unavailable for customers in the FedRAMP, NSC DOD IL5, or Australia IRAP-Protected data centers, self-hosted customers, or in other restricted environments' and points to knowledge base article KB0743854, and that 'Not all model providers are available for customers with in-country SKUs'. That statement is about the Legal Service Delivery application; the Contract Management Pro AI documentation read on 2026-09-27 carries no equivalent statement.
Ask: Are these Contract Management Pro AI capabilities available in the Australia IRAP-Protected data centre and to in-country SKU customers, and will you confirm that in writing against KB0743854 and KB1584492?
AI features in scope
Public claim only
The documentation page 'AI capabilities in Contract Management Pro' (Brazil release, updated 10 September 2026) names two groups. AI skills 'enable users to extract metadata from signed contracts and analyze contracts for clause compliance'. Agentic workflows: 'The manage contract repository agentic workflow supports metadata and obligation extraction from signed contracts, calculates reminder dates based on contract end dates and renewal clauses, and enables users to review and update contract information through a playbook interface. Conversational search enables users to query contract metadata and documents using natural language.' The benefits table names four features - contract analysis, metadata extraction, conversational search and manage contract repository - each assigned to the role 'Contract AI fulfiller'.
Ask: Which of these four features can be activated independently, and can conversational search be enabled without enabling the agentic workflow that writes to the contract repository?
Jurisdiction and legal content
Not confirmed
The application carries no legal content library: nothing on the Store listing or the documentation claims coverage of any jurisdiction's law, and clause analysis is described as running against the customer's own material - the listing says contracts are reviewed 'for missing or non-standard clauses ... as per the company's standard playbook'. The compatibility list on the Store listing reads 'Brazil, Australia Patch 6 ... Zurich ... Yokohama'; these are ServiceNow release family names, not countries or hosting regions, and must not be read as an Australian deployment statement.
Ask: Is any jurisdiction-specific clause content supplied with the application, or must every standard and playbook be configured by us?
Who the vendor addresses
Public claim only
The Store listing addresses 'attorneys' and 'contract attorneys'; the documentation defines three roles - Administrator [sn_cm_gen_ai.ai_contract_admin], Configurator [sn_cm_gen_ai.ai_contract_config] and AI contract fulfiller [sn_cm_gen_ai.ai_contract_fulfiller]. The vendor is a general-purpose platform company and the documentation tree is the Contract Management Pro product rather than a legal product line, so the classification of this application as legal-specific rests on the addressee and the named roles rather than on a legal product range.
Ask: Is this application sold to in-house legal teams, to procurement or to both, and which team does ServiceNow expect to own the clause playbook configuration?
Release stage and version history
Public claim only
The Store listing shows latest version 2.5.2 with compatibility across four ServiceNow release families (Brazil, Australia and its patches 1 to 6, Zurich and its patches, and Yokohama and its patches). The documentation page carries 'Version: Brazil' and 'Updated 10 September 2026'. The listing shows 'Rating: No reviews'. Nothing on the pages read marks any feature as beta, limited availability or early access.
Ask: Which release family would our instance be on, and are any of these four AI features limited-availability or early-access on that release?
Vendor content addressed to AI tools
Not confirmed
Checked deliberately on 2026-09-27. None of the five ServiceNow pages read - the Store listing, the Contract Management Pro AI documentation, the Services Privacy Statement, the trust privacy page and the sibling Otto for Legal Service Delivery documentation - contains a block or heading addressed to AI models, assistants or language models setting out how the product should be described, and a search of those pages for 'llms.txt', 'instructions for AI', 'AI assistants' and 'language model' returned nothing. No site-wide check for an llms.txt or similar path was made: the one firecrawl map run against www.servicenow.com was filtered for trust, privacy, terms and subprocessor pages, so such a path elsewhere on the site has not been ruled out. Separately, the documentation carries machine-generated page content of its own: the sibling application's documentation page states 'This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete' above an AI-written summary, which sits above the authored documentation sections.
Ask: Do you publish any file or page addressed to AI models or crawlers - an llms.txt or similar - that describes your products or how they should be described, and which parts of your documentation pages are machine-generated?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client material into the tool
Not confirmed
Nothing on the Store listing or the documentation addresses client confidentiality, legal professional privilege or a firm's authority to upload client contracts. ServiceNow's documentation for the sibling Legal Service Delivery application states that 'None of the Advanced AI and Data Products provide legal or professional advice', that 'Customer assumes all responsibility and obligations with respect to any decisions, advice, conclusions, legal opinions, recommendations made or given as a result of the use of the services', and that the products 'do not create an attorney-client relationship'. The Services Privacy Statement recommends that 'Users do not submit sensitive or confidential information to Now Support or the Flow by ServiceNow Service', which are support channels rather than the Subscription Service.
Ask: Do you make any representation about privilege or confidentiality for contract documents processed by the AI capabilities, and does your recommendation against submitting confidential information extend beyond Now Support?
Model provider and model
Public claim only
The documentation page states: 'You can use Now LLM Service, Azure OpenAI, Google Gemini or Anthropic Claude on AWS as the AI model provider for all generative AI skills and AI agents. Use the Configuration Controls in AI Control Tower to define which options are available, then set the skill-level preferences in the AI Admin Hub console.' The Store listing itself names no model provider; the 'Microsoft Azure OpenAI Generative AI Spoke' and 'OpenAI Generative AI Spoke' entries in its 188-row dependency table are integration spokes and are not a statement of which model performs the analysis. ServiceNow's documentation for the sibling application states availability of model providers 'may vary based on geographic region, data center environment, and regulatory requirements' and that 'Not all model providers are available for customers with in-country SKUs'.
Ask: Which of the four model providers would be available to our instance, where does each run, and can we restrict contract analysis to one named provider in AI Control Tower?
Subprocessors and where they sit
Not confirmed
No subprocessor list for this application was reached. The ServiceNow trust privacy page (read 2026-09-27) names a document called 'ServiceNow Sub-Processors' under 'Other Documents' but the page as read gave no link target for it, and the Services Privacy Statement expressly does not apply where ServiceNow processes personal data as processor on behalf of customers, which is the position for contract documents in the Subscription Service. The Services Privacy Statement does say ServiceNow may disclose data to 'contractors, Partners, and service providers we use to support the hosting, development, deployment or management of our Services ... (including AI and ML service providers, where applicable)'. ServiceNow's documentation for the sibling Legal Service Delivery application states that using that application 'requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment ... and potentially to a third-party cloud provider, such as Microsoft Azure'; the Contract Management Pro AI documentation carries no equivalent statement.
Ask: Please provide the current ServiceNow sub-processor list that applies to the Contract Management Pro AI capabilities, naming every model and hosting provider and the country each processes in.
Use of our content to train models
Not confirmed
Two ServiceNow documents say different things and neither is about this application. The Services Privacy Statement (effective 20 July 2026) states 'Where we have a Customer's prior authorization and agreement, we may process their Customer Data for the purpose of training ServiceNow's artificial intelligence (“AI”) and machine learning (“ML”) models' - a consent gate. ServiceNow's documentation for the sibling Legal Service Delivery application states, under 'Data collection', that 'ServiceNow collects and uses the inputs, outputs, and edits to outputs of this application to develop and improve ServiceNow technologies including ServiceNow models and AI products' and that 'Customers can opt out of future data collection at any time' - collection by default with an opt-out. The Contract Management Pro AI documentation read on 2026-09-27 carries no data-collection statement at all, so which position applies to contract documents, prompts and outputs is not established.
Ask: For the Contract Management Pro AI capabilities specifically, are inputs, outputs and edits collected by default, is the switch opt-in or opt-out, and where is the opt-out recorded for our instance?
Use of corrections, ratings and edits
Not confirmed
For this application, nothing published states whether a fulfiller's edits are retained or used. The documentation describes the agentic workflow as enabling 'users to review and update contract information through a playbook interface' and to 'review and approve extracted information ... before updating the contract repository', so corrections are part of the design, but the page says nothing about what happens to them. ServiceNow's documentation for the sibling Legal Service Delivery application states that ServiceNow collects 'the inputs, outputs, and edits to outputs of this application to develop and improve ServiceNow technologies'. The Services Privacy Statement states ServiceNow may process Usage Data 'for general maintenance, support, security, and to improve the Services' and that Usage Data 'does not include or form part of Customer Data'.
Ask: Are the corrections a contract fulfiller makes in the playbook interface retained beyond our instance, and can that be switched off without switching off the feature?
Retention periods
Not confirmed
No retention period for contract documents, extracted metadata, prompts or model outputs was found. The Services Privacy Statement's retention section says only that ServiceNow retains personal data 'only for so long as we have an ongoing legitimate business need to do so', and that statement expressly does not cover processing as processor on behalf of customers. Neither the Store listing nor the Contract Management Pro AI documentation states a retention period, and ServiceNow's documentation for the sibling application points retention questions to internal policies 'available through our CORE Compliance Portal', which was not opened.
Ask: How long are contract documents, prompts, model outputs and extracted metadata held in the centralised AI environment and by any model provider, and is that period in our agreement?
Deletion on request and on exit
Not confirmed
Nothing read states how contract documents, prompts or outputs held outside the customer instance are deleted. The Services Privacy Statement gives individuals a right to 'request deletion of personal data' where ServiceNow acts as controller, which is not the position for contract content in the Subscription Service. No deletion commitment for the centralised AI environment referred to in ServiceNow's sibling-application documentation was found on any page read.
Ask: If we delete a contract from our instance, what is deleted from the centralised AI environment and from the model provider, within what period, and will you certify it?
Who at the vendor can see our documents
Not confirmed
Nothing on the pages read states whether ServiceNow personnel or its AI service providers can access contract documents, prompts or outputs, or under what controls. The Services Privacy Statement states only that 'ServiceNow personnel and service providers with access to such data are required to keep them confidential and secure', in relation to the data that statement covers, which excludes processing as processor for customers. The trust privacy page invites customers to 'Visit Security Portal' for 'visibility into when, where, and how data gets accessed'; that portal was not opened.
Ask: Can ServiceNow personnel or a model provider's personnel access our contract documents or prompts, is that access logged, and is the log visible to us in the Customer Security Portal?
Access control available to us
Public claim only
The documentation publishes three application roles: Administrator [sn_cm_gen_ai.ai_contract_admin], who 'Installs ServiceNow Otto for Contract Management Pro plugin, and activates the required skills'; Configurator [sn_cm_gen_ai.ai_contract_config], who 'Configures the use case mappings'; and AI contract fulfiller [sn_cm_gen_ai.ai_contract_fulfiller], who uses the capabilities and the conversational search from the ServiceNow Otto panel. The documentation also states that which model providers are available is set with 'Configuration Controls in AI Control Tower' and that skill-level preferences are set in the AI Admin Hub console. Nothing read states whether conversational search respects the instance's existing record-level access controls over contract records and attachments.
Ask: Does conversational search over contract metadata and signed documents honour our existing record and attachment ACLs, or can a fulfiller retrieve content from a contract they cannot otherwise open?
Encryption
Not confirmed
No statement about encryption of contract documents, prompts or outputs - in transit, at rest, or in the centralised AI environment - was found on the Store listing, the Contract Management Pro AI documentation, the Services Privacy Statement or the trust privacy page. The Services Privacy Statement states in general terms that ServiceNow 'maintains appropriate technical and organisational measures designed to protect the data covered by this Services Notice from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and access', without naming any algorithm, key management or customer-managed key option.
Ask: How are contract documents and prompts encrypted in transit to and at rest in the centralised AI environment, and can platform encryption or customer-managed keys cover the AI pipeline?
Independent assurance
Public claim only
No certification, audit report or assessment for this application was found on the pages read. The trust privacy page names resource documents, including a 'Data Privacy Framework Policy' and a GDPR white paper, but no certification list was reached, and the ServiceNow Customer Security Portal and CORE Compliance Portal were not opened. The only assessment referenced anywhere read is indirect and comes from the sibling application's documentation, which names an 'Australia IRAP-Protected' data centre environment while stating that 'Some AI products/features are currently unavailable' in it. GDPR: the vendor's own page states ". . . . . . . . . . . . . . 17 Regulatory and industry compliance . . . . . . . . . . . . . . . .18 GDPR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 DORA" (https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook/ebk-how-servicenow-delivers-safe-and-secure-cloud-services.pdf, checked 2026-10-10). HIPAA: the vendor's own page states "nity Cloud and FedRAMP white paper • ServiceNow National Security Cloud • ServiceNow Security and HIPAA white paper • A Secure Platform for Financial Services white paper • Critical" (https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook/ebk-how-servicenow-delivers-safe-and-secure-cloud-services.pdf, checked 2026-10-10). SOC 2: the vendor's own page states "• Shared Assessments Standardized Information Gathering(SIG) Questionnaire (Spreadsheet file) ## SOC 2 Type 2 (reports from third-party auditors that validate ServiceNow security co" (https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook/ebk-how-servicenow-delivers-safe-and-secure-cloud-services.pdf, checked 2026-10-10). Unverified, not applied (2026-10-10): security claim ISO 27001 (https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook/ebk-how-servicenow-delivers-safe-and-secure-cloud-services.pdf). the quote does not state this certification. Unverified, not applied (2026-10-10): security claim ISO 42001 (https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook/ebk-how-servicenow-delivers-safe-and-secure-cloud-services.pdf). the quote does not state this certification.
Ask: Which certifications and assessments cover the Contract Management Pro AI capabilities and the centralised AI environment specifically - SOC 2, ISO/IEC 27001, ISO/IEC 42001, IRAP - and to what scope?
Contract terms
Not confirmed
No contractual document for this application was read. The Store listing shows headings for 'Licensing requirements' and 'Terms and conditions' whose content was not displayed on the page as read. The Services Privacy Statement refers to a 'Customer Agreement', meaning 'the definitive agreement between Customer and ServiceNow under which the Customer purchased access to the Services', but does not set out its terms. ServiceNow's documentation for the sibling application states 'You agree to abide by ServiceNow's AI Acceptable Use Policy, which may be updated by ServiceNow'; that policy was not opened.
Ask: Please provide the Customer Agreement terms, the data processing addendum and the AI Acceptable Use Policy that would apply to these AI capabilities, and tell us which of them ServiceNow may change unilaterally.
Cross-border transfer
Public claim only
The Services Privacy Statement states ServiceNow 'may store and process data covered by this Services Notice in: (i) any country where we have facilities; and (ii) any country in which we engage service providers, when delegation or storage is necessary', and that transfers out of the EEA, UK or Switzerland use Standard Contractual Clauses or another lawful mechanism; it names no safeguard for transfers out of Australia. ServiceNow's documentation for the sibling Legal Service Delivery application states that using that application 'requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment, which may be located in a different data center region from the one where your instance is, and potentially to a third-party cloud provider, such as Microsoft Azure'. The Contract Management Pro AI documentation read on 2026-09-27 carries no transfer statement.
Ask: For the Contract Management Pro AI capabilities, where is the centralised AI environment located, does contract content leave Australia, and what contractual safeguard applies to that transfer?
Breach and incident notification
Not confirmed
No incident or breach notification commitment for this application, and no notification period, was found. The Services Privacy Statement's section headed 'Security and Breach Notification' states only that ServiceNow 'maintains appropriate technical and organisational measures' and that personnel and service providers with access are required to keep data confidential and secure; it sets out no notification obligation, timeframe or recipient. The trust privacy page carries a responsible-disclosure invitation for reporting flaws to ServiceNow, which is the reverse direction.
Ask: Within what period will ServiceNow notify us of a security incident affecting contract content processed by the AI capabilities, including an incident at a model provider, and where is that period committed?
Notice of change
Public claim only
Change is published by version and release rather than by notice. The Store listing shows version 2.5.2 with release notes recording behaviour changes, including that 'Contract document-based conversational search queries now return all matching results instead of 10 results'. The documentation is versioned by release family and the page read is dated 'Updated 10 September 2026'. The Services Privacy Statement is dated 'Effective as of 20 July 2026'. ServiceNow's documentation for the sibling application states model provider and feature availability 'may vary' and directs customers to check knowledge base articles KB1584492, KB0743854 and KB2593939 'for the latest information on feature availability', and states the AI Acceptable Use Policy 'may be updated by ServiceNow'. No advance-notice commitment to customers was found.
Ask: How and how far in advance are we told when a model provider changes, when an AI feature's availability in our data centre changes, or when the AI Acceptable Use Policy is updated?
Getting out and taking our data
Not confirmed
Nothing read addresses exit for this application. Because the extracted metadata and obligations are written into the Contract Management Pro contract repository in the customer's own instance, exit is bound up with exit from the platform subscription, and no export, migration or transition provision was found on the Store listing, the documentation or the Services Privacy Statement. The relationship between uninstalling the Store application and retaining previously extracted metadata is not described.
Ask: If we stop licensing the AI capabilities but keep Contract Management Pro, what happens to metadata, obligations and reminders the AI already wrote into the repository?
Connectors and what they can reach
Public claim only
The application's reach is defined by its install requirements and the instance it sits in. The Store listing names Platform Document Intelligence, ServiceNow Otto for Platform and the Document Intelligence for Contract Management Content Pack as required, with Contract Management Pro and Contract Workspace optional, and lists 188 dependencies including Microsoft Azure and OpenAI generative-AI spokes and a Microsoft Azure OEM Translator Service spoke. The documentation states conversational search runs across 'contract metadata and documents' and 'semantic search inside the signed contract documents from the ServiceNow Otto panel'. Nothing read states whether the AI capabilities can reach records or attachments outside the contract tables.
Ask: Which tables and attachment scopes can the AI skills and agents read, and can that scope be narrowed to nominated contract records?
Whether the tool reaches the internet
Not confirmed
Nothing on the pages read states whether the AI skills or agents in this application can retrieve anything from the internet. The published description is repository-bound: conversational search is described as querying 'the contract repository', 'contract metadata and documents' and performing 'semantic search inside the signed contract documents'. Whether the underlying model providers or the platform's AI agents can perform a web retrieval is not addressed on the Contract Management Pro AI documentation or the Store listing.
Ask: Can the AI skills or agents in this application retrieve anything from outside our instance - a web search or an external data source - and can that be disabled?
What the tool can do without being asked
Not confirmed
The application is described as taking actions of its own. The Store listing states it 'supports the Agentic AI workflow for signed contracts to manage the metadata extraction, obligation extraction and automatically create reminders for the notice period of contract renewals or terminations of the contract', and names 'AI agents that create notice-period reminders'. The documentation states the manage contract repository workflow 'calculates reminder dates based on contract end dates and renewal clauses' and 'enables users to review and update contract information through a playbook interface', and the benefits table says users 'review and approve extracted information through a playbook interface before updating the contract repository'. So a human approval step is described for repository updates, while reminder creation is described as automatic.
Ask: Which actions in the agentic workflow run without human approval - specifically reminder creation and any repository write - and can the approval step be made mandatory for every field?
Human review of output
Public claim only
The documentation describes a review step in the workflow: users 'review and approve extracted information through a playbook interface before updating the contract repository'. ServiceNow's documentation for the sibling Legal Service Delivery application states more generally that customers are 'advised to thoroughly test and evaluate the outputs for suitability and accuracy, maintaining human oversight especially in sensitive areas such as legal matters', that it is the customer's responsibility to 'employ human oversight of output, and refrain from relying solely on AI-generated outputs for decision-making purposes', and that 'the AI capabilities do not provide legal or professional advice'. The Contract Management Pro AI documentation carries no equivalent disclaimer.
Ask: Is the playbook approval step mandatory and auditable per contract, and does the clause-compliance analysis produce a record of who checked which flagged clause?
