ServiceNow positions AI Control Tower as a system that discovers any agent, works across models and clouds, tracks cost and value, and blocks policy violations. More than 500 customers went live with the product in its first six months, while AI annual contract value exceeded one billion dollars in Q2 against a full-year target of 1.5 billion. A field study of 15 large-enterprise customers totaling 575 minutes of interviews challenges the breadth of that claim. The distinction matters because buyers may purchase workflow governance while expecting runtime enforcement.
How Control Tower performs in customer environments
All 15 respondents recognized ServiceNow workflow, operational integration or incumbency strength, and 11 of the 15 had installed, piloted or were evaluating Control Tower. Twelve tied governance value or switching cost to the wider Now Platform, mainly ITSM, CMDB, change management and SecOps. The company cites roughly 100 billion workflows and nearly 8 trillion transactions supported by its platform, plus years of operating context. Chief executive Bill McDermott summarized that advantage in one word cited in the report: context. The installed base therefore gives ServiceNow a right to compete, though it does not confirm full technical coverage.
Control Tower sits inside a five-pillar agentic strategy described by the company: model-agnostic operation across models, agents, clouds and systems of record, a shift from chat assistants to autonomous workers, centralized governance, cost and value management, and tiered pricing. The tiers named Foundation, Advanced and Prime are designed to seed AI broadly and add consumption on top of subscriptions. Token economics, model selection, budget control and return on investment form the fourth pillar. More agents create more governance demand, and more usage drives further consumption, reinforcing the cycle.
The research separates AI governance into three technical jobs with different buyers and budgets. The first is governance workflow and accountability, where ServiceNow is strongest through inventory, ownership, approvals, remediation and audit history. The second is lifecycle evidence such as model versions, lineage, validation, bias, explainability and drift, which customers often generate elsewhere. The third is runtime enforcement and AI security, including intercepting actions, blocking deployments and revoking access in real time. Approving a model and assigning a ticket are useful, yet they differ from validating the model or blocking its action.
What Control Tower means for enterprise AI buyers
For companies already running ServiceNow, Control Tower shortens the path from risk discovery to accountable action without building a new governance process. The CMDB supplies assets, services, owners and dependencies, while ITSM and change management provide routing and approval paths that agents can reuse. Integrated risk management contributes controls, issues and evidence structures. That combination helps operations, risk and service teams coordinate AI inventory and remediation in one system. Smaller estates with a mature CMDB will feel the benefit fastest.
Large or heterogeneous estates face clear limits that procurement teams should verify before committing. Fourteen of 15 respondents described runtime enforcement as external, custom, human-mediated, limited to selected paths or unproven at scale, with only one limited financial-services pilot confirming blocking for one model and one agent. Twelve identified a model-specific evidence gap covering validation, lineage, bias, explainability or regulatory artifacts. A senior engineering manager at a North American financial firm stressed that the CMDB dependency requires frequent cleanup, surveys and audits. Where the CMDB is immature or agents run outside ServiceNow paths, the value story weakens.
The marker to watch is whether ServiceNow converts pilots into proven blocking and evidence coverage across more than isolated models and agents. The study was conducted September 15-21, 2026, with 11 respondents in North America and four in Europe across financial services, healthcare, technology and other sectors. If later customer evidence shows repeated runtime stops and regulator-ready lineage produced inside Control Tower paths, the control-plane claim gains weight. If enforcement remains external, the product stays a powerful system of action rather than a complete enforcement layer.
