---
title: "ServiceNow Otto for Legal Service Delivery (ServiceNow, Inc.)"
url: "https://ailawframework.com/software/servicenow-otto-legal-service-delivery"
type: "software_profile"
site: "AI Law Framework"
id: "servicenow-otto-legal-service-delivery"
vendor: "ServiceNow, Inc."
category: "Legal-specific"
segment: "Intake and client service"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# ServiceNow Otto for Legal Service Delivery (ServiceNow, Inc.)

> Separately licensed generative-AI add-on to ServiceNow Legal Service Delivery: summarises a legal request or matter, generates answers from the organisation's knowledge articles, and takes conflict-of-interest requests…

Canonical page: https://ailawframework.com/software/servicenow-otto-legal-service-delivery  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Covers the paid ServiceNow Store application, scope sn_lg_gen_ai, version 1.9.7, formerly named Now Assist for Legal Service Delivery. The Legal Service Delivery licence and the platform subscription need separate review.

Separately licensed generative-AI add-on to ServiceNow Legal Service Delivery: summarises a legal request or matter, generates answers from the organisation's knowledge articles, and takes conflict-of-interest requests by conversation.

## Capabilities

- Document summarisation
- Knowledge search
- Intake and triage
- Agentic workflows
- Conflict checking

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, Multiple specified locations |
| Australian region | Unknown |
| Model providers | Now LLM Service, Azure OpenAI, Google Gemini, Anthropic Claude on AWS |
| Assurance | ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, ISO/IEC 42001 Artificial Intelligence Management System, SSAE 18 SOC 1 Type 2, SSAE 18 SOC 2 Type 2 (annual since 2013; issued via ServiceNow CORE), BSI C5 attestation, CSA STAR Level 2 certification, APEC Privacy Recognition for Processors, MTCS Level 3 (Singapore), ASD IRAP assessed for OFFICIAL and PROTECTED, stated for ServiceNow's Australian Platforms; the application's own documentation states some AI features are unavailable in Australia IRAP-Protected data centres, FedRAMP High provisional authority to operate and DoD Impact Level 4, for the Government Community Cloud, HITRUST certification, UK Cyber Essentials Plus, Data Privacy Framework programme participant (EU-U.S., UK extension, Swiss-U.S.) |
| Training on customer content | Opt-out |
| Retention | No retention period is published for prompts, generated summaries, collected record content or search prompts and results. The application's documentation says the transferred data 'is handled per ServiceNow's internal policies and procedures, including our policies available through our CORE Compliance Portal', which requires a customer login and was not opened. The Data Processing Addendum's Data Security Guide, clause 3.1, states only that ServiceNow backs up all Customer Data in accordance with its standard operating procedure. A summary posted to work notes becomes part of the instance record and follows the instance's own retention. |
| Integrations | Legal Request Management (com.sn_lg_ops) - required, Legal Counsel Center (sn_lg_cf_workspace) - required, ServiceNow Otto for Platform (sn_genai_platform) - required, Now Assist AI Agents (sn_aia) - required, Legal Matter Management (com.sn_lg_matter) - optional, AI Search (required for Q&A Genius Results), AI Control Tower (Configuration Controls for model providers), AI Admin Hub / Now Assist Admin console (skill activation and preferences), Virtual Agent and Employee Center |
| Legal content coverage | No primary law, case law or legislative content. The inputs are the organisation's own legal request and matter records, their fields, variables, comments and work notes, and the organisation's own knowledge articles in Legal Counsel Center and Employee Center. |
| Pricing | The ServiceNow Store listing (read 2026-09-27) shows price only as 'Paid', 'Sold by ServiceNow', with 'Application type Generative AI'. No amount, unit or metric is published. The listing states 'Store downloads may require a separate ServiceNow subscription product to use the Store Application', and its licensing text describes AI features consuming 'Assists' deducted against an account-level total; a version 1.9.7 release note refers to fixing 'the assist count consumption issue for the Legal risk evaluator skill', so this application does consume Assists, but no Assist count per skill is published. Legal Service Delivery and the platform subscription are licensed separately. |
| Australian presence | Yes. An Australian ServiceNow entity is named in a binding document: the Data Processing Addendum lists 'ServiceNow Australia Pty Ltd (Australia)' among the affiliate subprocessors at clause 8.1.1, and its Standard Contractual Clauses name the data importing organisation as 'ServiceNow Australia PTY LTD.' at 'Suite 9, Waverley Masonic Centre, 318-322 Stephensons Road, Mount Waverley VIC 3149 Australia'. NO ACN or ABN is published on any page read, and which entity signs an Australian order was NOT established: the only ordering agreement reachable is the ServiceNow Japan G.K. version governed by Japanese law. Australian availability of this application is UNRESOLVED and the vendor's own documentation points against it: 'Some AI products/features are currently unavailable for customers in the FedRAMP, NSC DOD IL5, or Australia IRAP-Protected data centers, self-hosted customers, or in other restricted environments' (KB0743854, not opened), and 'Not all model providers are available for customers with in-country SKUs' (KB1584492, not opened). The application also states it transfers data to a centralised ServiceNow environment that 'may be located in a different data center region from the one where your instance is, and potentially to a third-party cloud provider, such as Microsoft Azure', so Australian residency cannot be taken from the instance region. The 'Australia' entries in the Store listing's compatibility list are ServiceNow platform release names, alongside Brazil, Zurich and Yokohama, and are not a hosting region. |
| Website | https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8 |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product boundary and what it sits on | Public claim only | This is a separately licensed ServiceNow Store application, not a feature of the base suite. The Store listing (read 2026-09-27) shows 'App scope sn_lg_gen_ai', 'Pricing Paid', 'Sold by ServiceNow', 'Application type Generative AI', latest version 1.9.7 with release date 10 September 2026, and 'Custom table count: This application will not consume custom tables once installed - 0'. Its requirements section states the installing role is 'System admin (admin)' and names the applications it depends on: Legal Request Management (com.sn_lg_ops), Legal Counsel Center (sn_lg_cf_workspace), ServiceNow Otto for Platform (sn_genai_platform) and Now Assist AI Agents (sn_aia), with Legal Matter Management (com.sn_lg_matter) listed as optional. The parent suite's documentation lists this application among the suite's applications, which is how the base-suite page comes to mention generative AI. | What must our order include for this application to run - the Store application, Legal Request Management, Legal Counsel Center, ServiceNow Otto for Platform and Now Assist AI Agents - and which of those do we already hold? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Legal Service Delivery, the parent suite this application installs on top of (Zurich release, 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| The named AI skills and agents | Public claim only | Five named pieces of AI are published. The documentation names Legal Request summarization and Legal Matter summarization skills, Q&A Genius Results, and a conversational intake experience for Conflict of Interest requests. The Store listing for version 1.9.7 adds AI agents that 'analyze general legal requests, predict the appropriate legal category, and initiate a transfer after confirmation from the legal fulfiller or group manager', and its release notes name a 'Legal risk evaluator skill'. The Store listing also describes a 'Now Assist Admin console' through which administrators 'review the Legal Request and Matter summarization skills and activate it' and may 'create a copy of the skills and make modifications'. So what is live in one tenant need not be live in another. The agentic triage capability appears only in the Store listing for version 1.9.7 and in a documentation navigation entry headed 'Agentic workflow'; it is absent from the body of the Zurich documentation page dated 12 March 2026, whose URL was the one read. | Which skills and agents are active in the version we would install, and can each be activated and deactivated independently in the AI Admin Hub? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Deployment and where the processing happens | Public claim only | The application installs into the customer's own ServiceNow instance, so the instance follows Data Processing Addendum clause 4.5, which hosts instances 'in data centers located in the geographic regions specified on the Order Form'. The processing does not stay there: the application's documentation states that 'This application requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment, which may be located in a different data center region from the one where your instance is, and potentially to a third-party cloud provider, such as Microsoft Azure.' The same page states that 'Some AI products/features are currently unavailable for customers in the FedRAMP, NSC DOD IL5, or Australia IRAP-Protected data centers, self-hosted customers, or in other restricted environments' and points to knowledge base article KB0743854, which was not opened. | If our instance sits in the Australian data centre, does this application work at all, and where exactly is the centralised environment that our legal request text is sent to? | [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| What the application does | Public claim only | The documentation (Zurich, 'Updated March 12, 2026') states three capabilities. Summarisation: the application 'generates an AI-powered summary of a legal request or matter', the summary 'is displayed above the activity stream and includes the information from the fields and variables configured as inputs', and fulfillers 'can review the summary to quickly understand context, refresh it as needed, and post it to work notes'. Q&A Genius Results 'uses AI to generate search results from knowledge article results in Employee Center, Legal Counsel Center, and global search', showing 'a topic snippet and an answer snippet that was extracted from a knowledge article, with direct access to the full article'; it 'is enabled when both AI Search and ServiceNow Otto for Legal Service Delivery (LSD) are activated'. Conversational intake for Conflict of Interest requests populates the intake form from natural language, 'asks relevant follow-up questions based on the request type, and validates responses'. | For summarisation, which fields and variables are sent as inputs by default, and can we exclude fields on matters marked privileged and confidential? | [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Version, release and product rename | Public claim only | The Store listing shows version 1.9.7 released 10 September 2026, compatible with the Brazil, Australia, Zurich and Yokohama release families and their patches; those are ServiceNow release names and not countries. The documentation page read is labelled 'Release version: Zurich' and 'Updated March 12, 2026'. The product has been renamed and the rename is incomplete in the vendor's own material: the documentation states 'ServiceNow Otto is the new AI experience brand. This change is reflected in the name of ServiceNow products, including ServiceNow Otto for Legal Service Delivery (LSD)', while the Store listing's description body still reads 'ServiceNow Now Assist for Legal Service Delivery (LSD)', its links entry is labelled 'Now Assist for Legal Service Delivery', the documentation URL path is still /now-assist-for-legal-service-delivery/, and a version 1.9.7 release note records 'Fixed plugin names and icons for ServiceNow Otto for Legal Service Delivery in AI Admin Hub.' | Which version would we install, and which of the features named on the Store listing are present in the release family our instance runs? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Jurisdiction and legal content | Not confirmed | No legal content library is supplied and no jurisdiction is addressed. Summarisation runs over the organisation's own request and matter records; Q&A Genius Results runs over the organisation's own knowledge articles; the conflict-of-interest intake collects the employee's own disclosure. Nothing on the pages read states which country's law, if any, the conflict-of-interest risk evaluation is calibrated to, or whether any output is intended to reflect any jurisdiction's requirements. | What determines the risk rating in the conflict-of-interest evaluation, and is any of it referenced to a jurisdiction's law or only to policy we configure? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Licence, metering and Assists | Public claim only | The Store listing shows pricing only as 'Paid', 'Sold by ServiceNow', and states that 'Store downloads may require a separate ServiceNow subscription product to use the Store Application.' Its licensing text describes a consumption unit: 'Apps distributed by ServiceNow partners on the Store with generative AI or agentic AI features ("AI Features") may consume Assists ... Assists consumed by AI Features are deducted against the total number of Assists available to Customer (at the account level) at the time of execution of a given AI Feature', and that ServiceNow 'does not determine the number of Assists consumed by AI Features so Customers should carefully review and understand the number of Assists consumed'. That passage is addressed to partner-built applications while this one is sold by ServiceNow; a version 1.9.7 release note nonetheless records 'Fixed the assist count consumption issue for the Legal risk evaluator skill', so the application does consume Assists. The listing's 'Licensing requirements' and 'Terms and conditions' headings carried no further content on the page as read. | How many Assists does each skill consume per invocation, what is our account-level Assist entitlement, and what happens to the feature when the entitlement is exhausted? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8) |
| What it plugs into | Public claim only | The Store listing publishes 191 dependencies, of which 130 are applications, and names four required applications - Legal Request Management, Legal Counsel Center, ServiceNow Otto for Platform and Now Assist AI Agents - with Legal Matter Management optional. Among the dependency rows are platform components including 'ServiceNow Otto AI Agents (sn_aia)', 'ServiceNow Otto for Virtual Agent', 'Platform AI Agents and Skills' and 'Chat Summarization for Virtual Agent'. The documentation places the user experience in Legal Counsel Center, the ServiceNow Otto panel, Employee Center, global search and ServiceNow Otto in Virtual Agent, and states that Q&A Genius Results requires AI Search to be activated as well. | Which of the 191 dependencies become active on install, and does installing this application switch on any platform AI capability that was previously off in our instance? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Support and service levels | Public claim only | The Store listing offers a 'Contact seller' form requiring Now Support credentials or a guest submission and shows no reviews: 'Be the first one to review this!'. The documentation directs users to 'ServiceNow Community on AI and Intelligence for peer support', the 'Known Error Portal for documented issues' and 'Customer Service and Support for direct assistance'. No service level, availability target or latency commitment for the AI capabilities was found on any page read, and the Ordering Agreement read places support, availability, upgrades and updates in a separate Customer Support Addendum that was not read. | What service level applies to these AI skills specifically, and what happens to the feature when the selected model provider is unavailable? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) |
| Published evidence of output quality | Public claim only | No accuracy measurement, benchmark, evaluation method or error rate is published on any page read, checked 2026-09-27. The Store listing states the application 'leverages generative AI to streamline legal work, enhancing the productivity of legal teams and providing faster resolutions for employees' and refers to 'saving valuable time and enhancing efficiency', with no measure, method or data attached. The vendor's own limitation text runs the other way: 'The application uses AI and machine learning, which might not always produce fully accurate or complete results' and customers are 'advised to thoroughly test and evaluate the outputs for suitability and accuracy'. The documentation also discloses that part of the page itself is machine generated. | What evaluation has ServiceNow run on legal request and matter summarisation, on what records, and will you let us measure it on our own request data before go-live? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Task the vendor offers it for | Public claim only | The published tasks are narrow and internal. The Store listing addresses 'in-house counsel and legal teams' generating 'a quick and concise summary of legal requests and matters', answers from knowledge articles, and triage of 'general legal requests'. The documentation assigns the capabilities to a Request Fulfiller and a Matter Fulfiller. No drafting, no research over external law, no contract review and no document analysis is described: the inputs are the organisation's own request and matter records and its own knowledge articles. | Is this application intended to help a lawyer decide anything, or only to summarise a record and surface an existing knowledge article? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Who the vendor addresses | Public claim only | The documentation publishes three roles: Administrator [sn_lg_gen_ai.admin], who 'Installs ServiceNow Otto for Legal Service Delivery (LSD) plugin, and activates the required skills'; Request Fulfiller [sn_lg_gen_ai.request_fulfiller]; and Matter Fulfiller [sn_lg_gen_ai.matter_fulfiller]. The Store listing addresses 'in-house counsel and legal teams' and 'employees'. The addressees are therefore an organisation's own legal department and its employees, not external clients. | Which of our people would hold each of the three roles, and does a request fulfiller without the matter fulfiller role see matter summaries? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Check for vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. No page or block addressed to AI models, AI assistants, language models or crawlers, and no instruction about how the product should be described, was found on any of the ten ServiceNow pages read for this profile. Two firecrawl site maps of www.servicenow.com returned no /llms.txt, /ai-info, /for-ai or robots path; no such path was guess-fetched, so its existence is unverified rather than disproved. A separate and different thing was found and is recorded so the two are not conflated: the application's documentation landing page opens with an 'AI sparkle' icon labelled 'Summarized using AI' above a 'Summary of ServiceNow Otto for Legal Service Delivery (LSD)' block and states 'This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.' That is the vendor disclosing that part of its own documentation is machine generated, and it means any fact taken from such a block needs checking against the human-written body text, which is where every fact in this profile was taken from. | Do you publish any file or page addressed to AI models, assistants or crawlers that describes your products or how they should be described, and which parts of each documentation page are machine generated? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html); [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) |
| Authority to put legal and privileged material into the tool | Public claim only | Responsibility is placed on the customer in both a contractual and a product document. The Data Processing Addendum, clause 3.2, requires the customer to perform a risk assessment 'before submitting any Personal Data to the Subscription Service' and states that 'Data Controller is solely responsible for determining the adequacy of the security measures within the Subscription Service in relation to the Personal Data Processed'. The application's documentation states that 'None of the Advanced AI and Data Products provide legal or professional advice', that 'Customer assumes all responsibility and obligations with respect to any decisions, advice, conclusions, legal opinions, recommendations made or given as a result of the use of the services' and that they 'do not and are not intended to constitute legal advice and do not create an attorney-client relationship'. The parent suite marks records privileged and confidential; nothing read states whether a record marked privileged is excluded from, or included in, the data this application sends out of the instance. | Are legal requests and matters marked privileged and confidential excluded from summarisation and from the transfer to the centralised environment, and if not, how do we exclude them? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow product documentation - Legal Service Delivery, the parent suite this application installs on top of (Zurich release, 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Model provider and model | Public claim only | The documentation states: 'You can use Now LLM Service, Azure OpenAI, Google Gemini or Anthropic Claude on AWS as the AI model provider for all generative AI skills and AI agents. Use the Configuration Controls in AI Control Tower to define which options are available, then set the skill-level preferences in the AI Admin Hub console.' So the provider is a customer configuration choice from a published menu. No model version is named, no default is stated, and no inference location is given for any of the four. The same documentation adds two limits: 'Availability of AI model providers and features may vary based on geographic region, data center environment, and regulatory requirements' and 'Not all model providers are available for customers with in-country SKUs', pointing to knowledge base articles KB1584492, KB0743854 and KB2593939, none of which was opened. | Which of the four providers is available to an Australian instance, which is the default if we set nothing, in which country does each run inference, and can we restrict the instance to Now LLM Service alone? | [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Subprocessors and the model path | Public claim only | The Data Processing Addendum names the affiliate subprocessors at clause 8.1.1: 'ServiceNow, Inc. (USA), ServiceNow Nederland B.V. (the Netherlands), ServiceNow Australia Pty Ltd (Australia), ServiceNow Software Development India Private Limited (India), ServiceNow UK Ltd. (United Kingdom), ServiceNow Ireland Limited (Ireland), and ServiceNow Japan K.K. (Japan)', requires notice before a new subprocessor is engaged (clause 8.1.2), gives the customer ten days to object and a right to terminate the affected Order Form within forty-five days with a refund of unused prepaid fees (clause 8.2), and keeps ServiceNow liable for its subprocessors (clause 8.3). The application's documentation puts third parties in the path for this product specifically: data may go 'potentially to a third-party cloud provider, such as Microsoft Azure', and the four selectable providers place Microsoft, Google or Amazon Web Services in the path when chosen. No standing subprocessor list was reached; the trust privacy page names a 'ServiceNow Sub-Processors' document under 'Other Documents' but the page as read carried no link target for it. | Please provide the dated ServiceNow Sub-Processors list covering this application, naming each model and hosting provider, the country each processes in, and the notice period before one is changed. | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) |
| Use of our content to develop models | Not confirmed | Two vendor documents state different positions and only one is about this application. The application's own documentation states, under 'Data collection': 'ServiceNow collects and uses the inputs, outputs, and edits to outputs of this application to develop and improve ServiceNow technologies including ServiceNow models and AI products. In addition, this application will collect information about the Legal Request and/or Legal Matter (including related field information, comments and work notes), and information about search requests (including search prompts and results) from Knowledge articles in Legal Counsel Center and Employee Center. Customers can opt out of future data collection at any time, as described in the Now Assist Opt-Out page.' That is collection by default with an opt-out, and the opt-out page's address was not found on any page read. The Services Privacy Statement instead records the purpose 'With your or your Employer's consent: To train and improve ServiceNow's artificial intelligence ("AI") and machine learning ("ML") models', which is a consent gate. The Data Security Guide clause 5.2 permits only aggregate quantitative usage data that 'will not contain Customer Data'. | Where is the Now Assist Opt-Out recorded for our instance, can it be set before go-live, will it be written into our order, and which of the two published positions - collection by default or consent first - governs our legal request content? | [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Use of corrections, ratings and edits | Public claim only | The application's documentation states that ServiceNow collects 'the inputs, outputs, and edits to outputs of this application', so a fulfiller's edit to a generated summary is expressly within the collected set, subject to the opt-out described in the same notice. The product design generates such edits: the fulfiller can 'review the summary ... refresh it as needed, and post it to work notes'. The Ordering Agreement read states at clause 4.2 that where the customer provides feedback such as suggestions or ideas, 'ServiceNow has the irrevocable right to exercise all rights in such Feedback without restriction'; that clause is in the ServiceNow Japan G.K. version, the only ordering agreement reached. | If we take the opt-out, does it stop collection of edits as well as of inputs and outputs, and can we keep the feature while stopping collection? | [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) |
| Retention of prompts, outputs and records | Not confirmed | No retention period is published for the record content sent out of the instance, the prompts, the generated summaries or the search prompts and results this application collects. The application's documentation says only that the data 'is handled per ServiceNow's internal policies and procedures, including our policies available through our CORE Compliance Portal', which requires a customer login and was not opened. The Data Processing Addendum's Data Security Guide, clause 3.1, states that 'ServiceNow backs up all Customer Data in accordance with ServiceNow's standard operating procedure', again without a period. Once a summary is posted to work notes it becomes part of the record in the instance and follows the instance's own retention. | State the retention period for prompts, generated summaries, search prompts and search results held in the centralised environment and at any model provider, and confirm it in our agreement rather than in a portal policy. | [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Deletion on request and on exit | Not confirmed | Nothing read states how the data this application sends to the centralised ServiceNow environment or to a model provider is deleted. The Data Processing Addendum covers Customer Data in the instance: clause 4.4 states that on termination or expiry ServiceNow 'shall return and delete Customer Data ... as described in the Agreement', and clause 9.1.4 states that 'the certification of deletion or destruction of Customer Data shall be provided by ServiceNow to Customer only upon Customer's written request, provided that such request is made through the customer support portal prior to the termination or expiration of the Agreement'. Neither the Store listing nor the application's documentation says what an opt-out does to data already collected, or what happens to collected data if the application is uninstalled. | If we delete a legal matter, or uninstall this application, what is deleted from the centralised environment and from the model provider, within what period, and will you certify it? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8) |
| Who at the vendor can see our content | Public claim only | The Data Processing Addendum, clause 4.2, limits access to 'personnel who require such access to perform Data Processor's obligations under the Agreement and who are bound by obligations to maintain the confidentiality of such Personal Data'. Its Data Security Guide, clause 2.2.1, requires authentication and authorisation for employee and contractor access, privileges 'based on job requirements' revoked on termination, and VPN, complex passwords and 'a two-factored authenticated connection' for production infrastructure; clause 2.3.2 requires background screening of those with access to Customer Data. Nothing read says who can see data in the centralised AI environment, whether a model provider's personnel can see prompts, whether that access is logged, or whether any log is visible to the customer. | Can ServiceNow or a model provider's personnel read prompts and generated summaries in the centralised environment, is that access logged, and can we see the log? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Access control available to us | Public claim only | Control is published at three levels. Application roles: Administrator [sn_lg_gen_ai.admin], who installs the plugin and activates the skills; Request Fulfiller [sn_lg_gen_ai.request_fulfiller]; Matter Fulfiller [sn_lg_gen_ai.matter_fulfiller]. Platform configuration: the documentation directs administrators to 'use the Configuration Controls in AI Control Tower to define which options are available' and to set 'skill-level preferences in the AI Admin Hub console', and the Store listing describes reviewing and activating the summarisation skills and optionally copying and modifying them. Contractually, Data Security Guide clause 2.2.2 states the service 'provides user and role based access controls. Customer is responsible for configuring such access controls within its instance.' Nothing read states whether Q&A Genius Results and summarisation honour the parent suite's record-level security and Attorney-Client Privilege restrictions. | Does Q&A Genius Results respect knowledge article and record access controls, and can a fulfiller obtain a summary of a matter they are not authorised to open? | [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - Legal Service Delivery, the parent suite this application installs on top of (Zurich release, 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) |
| Encryption | Public claim only | Encryption of Customer Data is published as a customer responsibility exercised through product functionality. The Data Processing Addendum, clause 3.2, states the service 'includes, without limitation, column level encryption functionality and role-based access control, which Data Controller may use in its sole discretion'. Its Data Security Guide, clause 7.1, makes the customer 'responsible for implementing encryption and access control functionalities available within the Subscription Service for protecting all Customer Data containing sensitive data' and states that 'Customer is solely responsible for its decision not to encrypt such data'. The Data Security Guide as read states no commitment on encryption of Customer Data in transit and names no algorithm or key management option, and nothing read addresses encryption of the transfer from the instance to the centralised AI environment or to a model provider. | How is the transfer from our instance to the centralised environment and on to the model provider encrypted, and does column-level encryption of a field stop that field being sent as a summarisation input? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Independent assurance | Public claim only | The trust and compliance page, read 2026-09-27, publishes ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, ISO/IEC 42001 for an artificial intelligence management system, SSAE 18 SOC 1 Type 2 and SOC 2 Type 2 (annual since 2013, report period 1 October to 30 September, issued via ServiceNow CORE with a bridge letter the following first quarter), BSI C5, CSA STAR Level 2, APEC Privacy Recognition for Processors, MTCS Level 3, FedRAMP High provisional authority and DoD Impact Level 4 for the Government Community Cloud, HITRUST, UK Cyber Essentials Plus and Data Privacy Framework participation, and states that "ServiceNow's Australian Platforms has been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data". Data Processing Addendum clause 7.2 gives one audit a year of documentation including a summary report of an independent assessment against ISO 27001, ISO 27018, SSAE 18/SOC1 and SOC2 Type 2. No certificate or report was opened, and nothing read states whether this application or the centralised AI environment is inside any of those scopes; the application's own documentation states some AI features are unavailable in the Australia IRAP-Protected data centres. | Is this application and the centralised AI environment inside the ISO/IEC 42001, ISO/IEC 27001:2022 and SOC 2 scopes, and does the IRAP assessment cover it or exclude it? | [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Contract documents read, and the gap | Not confirmed | Three published documents bear on the contract and none is certainly the one an Australian customer signs. The Store listing gates installation behind 'Store Terms and Conditions' that must be accepted, and its 'Licensing requirements' and 'Terms and conditions' headings carried no content on the page as read. The application's documentation states 'You agree to abide by ServiceNow's AI Acceptable Use Policy, which may be updated by ServiceNow', and that policy was read. The Data Processing Addendum is pre-signed with ServiceNow signing dates of July and August 2019, incorporates the Standard Contractual Clauses made under Directive 95/46/EC, and states at clause 9.3 that 'ServiceNow, Inc. shall comply with the EU-U.S. and Swiss-U.S. Privacy Shield Framework', while the trust and compliance page instead publishes Data Privacy Framework participation. The only ordering agreement reachable is the ServiceNow Japan G.K. version, whose clause 10.8 states 'The Agreement will be governed by the laws of Japan' with disputes heard only in Tokyo. No Australian ordering agreement or Australian entity signature block was found. | Which ServiceNow entity signs an Australian order and what is its ACN, which ordering agreement and schedules apply to us, and is the published data processing addendum with 2019 signing dates and Privacy Shield wording the current one you would execute? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) |
| Cross-border transfer and where inference runs | Public claim only | Two published statements sit at different levels. Contractually, Data Processing Addendum clause 4.5 hosts instances 'in data centers located in the geographic regions specified on the Order Form', clause 4.3.4 requires near-real-time replication to a mirrored data centre 'in a different geographic region' that is not named, and the Standard Contractual Clauses at Attachment 1 name the data importing organisation as 'ServiceNow Australia PTY LTD.' at 'Suite 9, Waverley Masonic Centre, 318-322 Stephensons Road, Mount Waverley VIC 3149 Australia'. For this application specifically the documentation states that it 'requires data to be transferred from ServiceNow customers' individual instances to a centralized ServiceNow environment, which may be located in a different data center region from the one where your instance is, and potentially to a third-party cloud provider, such as Microsoft Azure'. No safeguard is named for transfers of data out of Australia, and no inference location is published for any of the four model providers. | For an Australian instance, does legal request and matter text leave Australia when a summary is generated, to which countries, and what contractual safeguard applies to that transfer? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) |
| Breach and incident notification | Public claim only | The Data Processing Addendum, clause 6.1, requires ServiceNow to report any 'accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data ("Breach") that it becomes aware of without undue delay following determination by ServiceNow that a Breach has occurred'; the Data Security Guide clause 5.1.2 is in the same terms. There is no fixed hour or day deadline and the clock starts on ServiceNow's own determination. Clause 6.2 sends the initial report to the security or privacy contacts designated in the support portal, and clause 6.3 states the customer 'is solely responsible for determining whether to notify the relevant supervisory or regulatory authorities and impacted Data Subjects'. Nothing read states how an incident at a model provider or in the centralised AI environment is notified. | Will you accept a fixed notification period in hours from awareness, and does that commitment cover an incident in the centralised AI environment or at Azure OpenAI, Google Gemini or Anthropic Claude on AWS? | [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Notice of change | Public claim only | Change is published by version and by pointer to knowledge base articles rather than by advance notice. The Ordering Agreement read states at clause 2.3 that the addenda 'in effect as of the date of the Order Form apply to the Subscription Service specified on such Order Form' and that ServiceNow may update them but 'in no event will any update automatically apply to such Subscription Service' except where expressly provided. Against that, the application's documentation states that model provider and feature availability 'may vary based on geographic region, data center environment, and regulatory requirements' and directs customers to KB1584492, KB0743854 and KB2593939 'for the latest information on feature availability', and that the AI Acceptable Use Policy 'may be updated by ServiceNow'. The Store listing carries version release notes, and the product name itself changed from Now Assist to Otto. | What advance written notice do we get before a model provider, a skill or feature availability in our data centre, or the AI Acceptable Use Policy changes, and can our configuration be pinned across a platform release? | [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html); [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8) |
| Getting out and taking our data | Not confirmed | Nothing read addresses exit for this application. The Ordering Agreement read states at clause 9.2 that the customer 'may export Customer Data using the functionality of the Subscription Service' during the term and that 'After termination of an Order Form or expiration of a Subscription Term, ServiceNow may delete all Customer Data unless legally prohibited'; that is the ServiceNow Japan G.K. version. Because a generated summary can be posted into work notes, some output becomes part of the instance record and would leave with an instance export, while the documentation does not say what happens to summaries, prompts or collected data if the application alone is uninstalled or its licence lapses. | If we stop licensing this application but keep Legal Service Delivery, what happens to summaries already posted to work notes, and what happens to the data already collected from us? | [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) |
| Connectors and what they can reach | Public claim only | The application's reach is defined by its dependencies and its documented surfaces. The Store listing names Legal Request Management, Legal Counsel Center, ServiceNow Otto for Platform and Now Assist AI Agents as required, Legal Matter Management as optional, and lists 191 dependencies. The documentation places it in Legal Counsel Center, the ServiceNow Otto panel, Employee Center, global search and ServiceNow Otto in Virtual Agent, and states the content it reads: the fields and variables configured as summarisation inputs, and knowledge articles in Legal Counsel Center and Employee Center. The one route out of the instance is the transfer to the centralised ServiceNow environment and to a model provider described in the same documentation. No permission scopes or payload descriptions were read. | Which tables, fields, attachments and knowledge bases can the skills and agents read, and can that scope be narrowed to nominated practice areas? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| Whether the tool reaches the internet | Not confirmed | Nothing on the pages read states that this application retrieves anything from the open internet. Every described input is internal: request and matter fields and variables, work notes and comments, and the organisation's own knowledge articles. The outbound path described is to the centralised ServiceNow environment and a model provider, not to the web. Absence of a description is not confirmation that no platform AI agent reachable from the application can perform an external retrieval. | Can any skill or agent in this application retrieve content from outside our instance other than the model call itself, and can that be blocked at instance level? | [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) |
| What the tool can do without being asked | Not confirmed | Two different postures are published side by side. For triage the Store listing describes a confirmation step: the AI agents 'analyze general legal requests, predict the appropriate legal category, and initiate a transfer after confirmation from the legal fulfiller or group manager'. For conflict-of-interest intake the documentation describes an outcome with no human step stated: 'After submission, the system evaluates the COI request to determine risk. Low-risk requests are auto-approved, while medium- and high-risk requests are routed for approval.' A version 1.9.7 release note names a 'Legal risk evaluator skill'. The AI Acceptable Use Policy bears directly on this: the customer agrees not to use ServiceNow AI offerings 'As part of an automated decision-making process, that has a consequential impact on any individual's legal position, financial position, access to services, or employment opportunities unless there is meaningful human oversight of the system or the final decision is made by a human being'. Summaries are generated on the record but the documentation says the fulfiller posts one to work notes. | Can the automatic approval of low-risk conflict-of-interest requests be switched off or routed to a person, what rating drives it, and is every automated approval logged with the model and inputs used? | [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8); [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html) |
| Human review of output | Public claim only | Review is advised rather than enforced. The documentation states fulfillers 'can review the summary to quickly understand context, refresh it as needed, and post it to work notes', and that the Q&A answer card gives 'direct access to the full article for additional context', so the source is one click away. The same documentation states that the application 'might not always produce fully accurate or complete results', that customers are 'advised to thoroughly test and evaluate the outputs for suitability and accuracy, maintaining human oversight especially in sensitive areas such as legal matters', and that the AI capabilities 'do not provide legal or professional advice' and 'do not create an attorney-client relationship'. The AI Acceptable Use Policy places the decision on the customer: 'you are responsible for determining whether the following are required: Implementation of human oversight of any output; Meaningful human control over decisions informed by AI; and Evaluating output for accuracy, harm, and appropriateness for your use case.' | Is any step mandatory before a generated summary reaches a work note or a Q&A answer reaches an employee, and can we export a record of which model produced each output and who accepted it? | [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA); [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html); [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html) |

## Notes

What the application does, which model providers can be selected, which roles exist and where a confirmation step sits are established from the vendor's own Store listing and documentation. Data handling is established from binding documents read on 2026-09-27 - the Data Processing Addendum with its Standard Contractual Clauses and Data Security Guide, the AI Acceptable Use Policy and an Ordering Agreement - with two caveats recorded in the considerations: the addendum is pre-signed with 2019 signing dates, uses the Standard Contractual Clauses made under Directive 95/46/EC and refers to the Privacy Shield framework, and the only ordering agreement reachable is the ServiceNow Japan G.K. version governed by Japanese law. Training use is recorded as conflicting evidence because the application's own documentation describes collection of inputs, outputs and edits by default with an opt-out while the Services Privacy Statement describes a consent gate. Not established: whether this application is available at all on an Australian IRAP-Protected instance; which model provider an Australian instance may use and where each runs inference; the Australian contracting entity and its ACN or ABN; the location of the centralised AI environment; retention and deletion for prompts and outputs; the address of the Now Assist Opt-Out page named in the vendor's own data-collection notice; the standing subprocessor list; and the Assist count each skill consumes. Not reached within the operation cap, and login-protected: the CORE Compliance Portal (KB0564067) and knowledge base articles KB0743854, KB1584492 and KB2593939, which the vendor names as the source of truth for AI feature and model provider availability by data centre. The agentic triage capability rests on the Store listing alone: the 'Agentic workflow' documentation page's address was not found. Capability vocabulary gaps reported to the Maestro: summarisation here is generated from record fields, variables, comments and work notes rather than from a document, and 'conflict-checking' is used for employee conflict-of-interest disclosure rather than law firm client and matter conflict searching.

## Sources

- [ServiceNow Store listing - ServiceNow Otto for Legal Service Delivery (app scope sn_lg_gen_ai, version 1.9.7, release date 10 September 2026)](https://store.servicenow.com/store/app/47fa6be61b246a50a85b16db234bcbc8) (checked 2026-09-27)
- [ServiceNow product documentation - Legal Service Delivery, the parent suite this application installs on top of (Zurich release, 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/zurich/employee-service-management/legal-service-delivery/legal-management-overview.html) (checked 2026-09-27)
- [ServiceNow product documentation - Explore ServiceNow Otto for Legal Service Delivery (LSD) (Zurich release, page states 'Updated March 12, 2026')](https://www.servicenow.com/docs/r/SogDT~k7ktsbe1ZYegnaLg/gVYKjR9tyTZoNJW0z2PXgA) (checked 2026-09-27)
- [ServiceNow product documentation - ServiceNow Otto for Legal Service Delivery (LSD) landing page, carrying the AI limitations, data processing, data collection and feature availability notices (Zurich release)](https://www.servicenow.com/docs/r/zurich/employee-service-management/now-assist-for-legal-service-delivery/now-assist-lsd-landing.html) (checked 2026-09-27)
- [ServiceNow Data Processing Addendum, with Standard Contractual Clauses (Attachment 1) and Data Security Guide (Attachment 2); pre-signed, ServiceNow signing dates July and August 2019](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/data-sheet/servicenow-dpa-with-sccs.pdf) (checked 2026-09-27)
- [ServiceNow trust and compliance - certifications and attestations](https://www.servicenow.com/company/trust/compliance.html) (checked 2026-09-27)
- [ServiceNow AI Acceptable Use Policy](https://www.servicenow.com/ai-acceptable-use-policy.html) (checked 2026-09-27)
- [ServiceNow Ordering Agreement - general terms and conditions (ServiceNow Japan G.K. entity version, page footer 'Version: 01OCT2023', English and Japanese, English prevails)](https://www.servicenow.com/content/dam/servicenow/ja/other-documents/schedules/Ordering-Agreement.pdf) (checked 2026-09-27)
- [ServiceNow Services Privacy Statement](https://www.servicenow.com/service-privacy.html) (checked 2026-09-27)
- [ServiceNow trust - Privacy](https://www.servicenow.com/company/trust/privacy.html) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.