ServiceNow AI features and the EU AI Act: a reference table

No ServiceNow feature has a risk class

This is the part that gets missed, and it is the reason a table like this can be misleading if you read only the rows.

The AI Act classifies systems by intended purpose, not by technology. Article 6(2) makes a system high-risk when it is intended to be used for one of the specific purposes listed in Annex III. Nothing in the regulation attaches a risk class to a product name. So Now Assist is not high-risk and not minimal-risk. The same summarisation capability is minimal-risk pointed at an incident record and high-risk pointed at an employee performance review, because Annex III point 4 covers systems used to monitor and evaluate the performance and behaviour of workers.

The rows below therefore describe the typical ITSM deployment of each capability, and name the specific configuration that moves it. The move is almost always the same one: the moment the output touches a decision about a person rather than a ticket.

The single question that decides most rows: does the output inform a decision about a person, or about a record? Incident, change, problem and knowledge are records. Performance, allocation based on individual traits, promotion, termination and access are people.

The table

Risk class assumes a standard internal ITSM deployment. The trigger column names what would change it.

Five columns — scroll the table sideways on a narrow screen.

ServiceNow AI capabilities against EU AI Act obligations, typical ITSM deployment
Capability	What it does	Likely class in ITSM use	Article 50 disclosure	What moves it to high-risk
Virtual Agent	Conversational chatbot handling requests and deflection	Transparency	Yes. Interacts directly with people. Article 50(1) applies unless it is obvious to a reasonably well-informed person that they are talking to an AI.	Pointing it at HR case intake where it screens or triages requests affecting employment terms
Now Assist — summarisation	Condenses incidents, cases, chat transcripts	Minimal	Generally no. Assistive editing of existing text that does not substantially alter the input is carved out of the Article 50(2) marking duty.	Summarising employee conduct, grievance or performance records for a manager acting on them
Now Assist — content generation	Drafts resolution notes, knowledge articles, emails	Transparency	Sometimes. Synthetic text published to inform the public on matters of public interest must be disclosed unless a human reviewed it and someone holds editorial responsibility. Internal knowledge articles normally fall outside.	Rarely. Content generation is an authoring aid, not a decision
Now Assist — AI Search / RAG	Retrieval-augmented answers over knowledge bases	Minimal	No, where it surfaces existing content. Yes for the conversational surface it answers through.	Retrieval that gates access to a benefit or service rather than to an article
Predictive Intelligence — classification	Predicts category, priority, assignment group	Minimal	No. Produces a field value, not content or an interaction.	Task allocation based on individual behaviour or personal traits — Annex III 4(b) names this explicitly
Predictive Intelligence — similarity	Matches a record to comparable historical records	Minimal	No	Similarity scoring over people rather than tickets
AI Agents	Multi-step autonomous execution across workflows	Depends entirely on the task	Yes where the agent converses with a person. Marking duties attach to any synthetic content it emits.	Any agent whose action grants, reduces or revokes access, or acts on a work relationship. Autonomy raises the oversight bar rather than the class itself
Now Assist for HRSD	Generative AI inside HR service delivery	Often high-risk	Yes for the conversational surface	Already there in most configurations. Annex III 4 covers recruitment, selection, promotion, termination, task allocation and performance monitoring
Talent / recruitment AI on the platform	Screens, ranks or filters candidates	High-risk	Yes where a candidate interacts with it directly	Nothing. It starts there — Annex III 4(a) names filtering job applications and evaluating candidates
AIOps — anomaly detection, event correlation	Predicts and groups infrastructure events	Minimal	No	Use as a safety component in the management or operation of critical digital infrastructure — Annex III 2
Voice AI Agents	Natural voice interaction	Transparency	Yes. Direct interaction, plus synthetic audio marking under Article 50(2).	Same triggers as AI Agents
Any emotion or sentiment inference on employees	Infers emotional state from text, voice or video	Prohibited in the workplace	N/A	Article 5 bans emotion inference in the workplace and in education, with narrow medical and safety exceptions. Enforceable since 2 February 2025. This is not a compliance question, it is a stop

Sentiment analysis on ticket text about a service is not emotion inference about a worker. The prohibition attaches to inferring the emotions of natural persons in the workplace. If your CSAT tooling scores the mood of the employee rather than the tone of the ticket, get advice before it ships.

The dates that actually apply

The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and deferred the high-risk regime. It deliberately left Article 50 alone. A lot of programmes stood down on the word “delayed” and stood down the wrong half.

2 February 2025: Prohibitions apply, including emotion inference in the workplace.
2 August 2026: Article 50 transparency obligations apply and are enforceable by national market surveillance authorities. Fines up to €15m or 3% of worldwide annual turnover. Not deferred.
2 December 2026: Article 50(2) machine-readable marking applies to generative systems that were already on the market before 2 August 2026. Systems placed on the market after that date comply from the outset.
2 December 2027: High-risk obligations for stand-alone Annex III systems. Deferred from 2 August 2026.
2 August 2028: High-risk obligations for AI embedded in products regulated under Annex I.

The practical consequence for a ServiceNow programme: your Virtual Agent disclosure is a live obligation today, and your HR use cases have until December 2027 to be ready — which is not the same as until December 2027 to start.

What human oversight has to mean

Article 14 requires that high-risk systems be designed so they can be effectively overseen by a person. In ServiceNow terms that is a configuration question, not a policy one, and four conditions have to hold at once.

Time

The reviewer has to have enough of it. A reviewer with a queue and a throughput target approves. Check the actual seconds-per-item in the workflow, not the intent.

Information

They need enough to disagree. A suggestion without its confidence, its inputs or its alternatives cannot be assessed — a strong suggestion and a guess look identical.

Authority

Override has to be available and has to stick. If the override is re-suggested on the next screen, it is not authority.

Incentive

Nothing in the reviewer’s targets should punish them for overriding. This is the one that is never in the design document and always in the outcome.

Deployers of high-risk systems in the workplace also have to inform workers and their representatives before deployment. In practice, in a European enterprise, that means the works council is on the critical path and should be engaged at design, not at launch.

Method, sources and what this is not

Capability descriptions come from ServiceNow’s own product documentation. Classifications are read from the text of Regulation (EU) 2024/1689 and the Commission’s Article 50 guidelines, adopted 20 July 2026, together with the Digital Omnibus, Regulation (EU) 2026/1744.

This is not legal advice and I am not a lawyer. I am a product manager who has taken AI use cases through governance in a regulated European enterprise. The table is a starting point for a conversation with the people who do sign off, and it will be wrong for any deployment whose intended purpose differs from the typical one assumed here. Classification is fact-specific, and Article 6(3) provides a narrow exception that never applies where a system profiles natural persons.

Corrections are welcome and will be credited. If a row is wrong, email me and I will fix it and say who caught it.

Last reviewed 18/08/2026. The Commission can amend Annex III by delegated act, so check the date before relying on this.

ServiceNow AI features and the EU AI Act