ServiceNow has added agentic capabilities for continuous control monitoring to ServiceNow Integrated Risk Management (IRM), so that AI agents can configure compliance checks, interpret results and act on failed controls. The company announced the change on 10 November 2026.
Monitoring now reaches beyond the ServiceNow platform through more than 100 prebuilt integrations to cloud, container, identity, SaaS and on-premises tools, as well as connected OT, IoT and medical devices. When a control fails, the system flags it, opens a ticket and can remediate automatically within policies the organisation defines. Evidence from each source flows into a central layer, which ServiceNow says keeps audit-ready proof current instead of assembled after the fact.
Control orchestration maps each control to the tools that enforce it, and unified control mapping lets one control count across several regulations and standards. Access Graph, part of ServiceNow's Context Engine, brings human, machine and AI agent access into monitoring so that access can be verified as revoked when an employee or agent leaves.
Vasant Balasubramanian, group vice president and general manager of Risk at ServiceNow, said: "ServiceNow is closing the gap between what an organization's last audit showed and what's true today by making assurance a live signal across the enterprise". IDC's Philip D. Harris, research director for governance, risk and compliance solutions, called it a closed loop that separates the approach from the dashboards most GRC tools have offered so far.
General availability is expected in Q1 2027.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
