Governance and compliance
If there is one chart in this report you should screenshot and pin above your desk, it is the maturity distribution. It explains nearly every other pattern in the data: who clones less, who catches drift faster, who lands a family release in weeks instead of months, and who is confident enough to put AI on top of their platform without flinching.
Established: defined policies, manual enforcement
Almost half of customers (46%) describe their governance as Established, the safe middle of the curve. Only 11% rate themselves Advanced, and 13% are still ad-hoc. We read the bulge in the middle as the part nobody at your company says out loud: most ServiceNow programs have policy on paper and manual heroics underneath it, and the platform team is the reason that gap does not show up in the audit.
Ad-hoc: reactive, personality-driven
Emerging: pockets of process, inconsistent
Advanced: continuous automated enforcement
Self-reported governance maturity
How teams detect drift across ServiceNow instances, overall and by governance maturity level
• 45% rely on developers or testers to flag inconsistencies.• 38% use some form of automation; only 14% have a dedicated system.• 20% do not systematically check for drift at all.• In Ad-hoc organizations, 60% run no systematic drift check.
Manual drift detection is the default. That is compatible with a platform of two instances and eight workflows. It is not compatible with 11+ instances and a GenAI roadmap.
TAKEAWAY
Under half of organizations (47%) run a fully automated, immutable audit trail across every environment, and coverage climbs sharply with governance maturity. Monitoring is the weaker leg of the stool. The average self-rated ability to see the estate as a single system is 3.1 out of 5, which is a polite way of saying most teams cannot answer "what happened on my ServiceNow platform today?" without a fire drill.
Unified audit trail across environments
Ability to monitor instances as a unified estate
Most organizations maintain some form of audit trail, but few meet the gold standard. Only 47% have fully automated, immutable tracking across all environments. Monitoring is even harder: the average self-rated capability is just 3.1 out of 5.
Unified audit trail across environments, overall, and by governance maturity level
Self-rated ability to monitor as a unified estate (1-5)
More than half of organizations experience delivery delays from cross-instance inconsistencies, and in the past twelve months, 90% took at least one deployment or governance hit (a delay, a rollback, or a compliance scare). Even in the Advanced cohort, 13% still report frequent occurrences. The market has normalized something that ought to be the exception.
Inconsistency-caused delivery delays
Deployment or governance issues, last 12 months
How often do inconsistencies across instances (prod and non-prod) cause delivery delays or production issues?
How often have deployment or governance issues caused delays, rollbacks, or compliance-related concerns in the last 12 months?
WHY THIS MATTERS
90% is not a rounding error. If nearly every ServiceNow shop takes a delay-rollback-or-compliance hit each year, then delivery risk is a recurring operating cost, not a corner case.
Change approvals, developer access, and the compliance frameworks customers cite as most influential all follow the same pattern. As governance matures, control tightens, and delivery gets faster (not slower, which is the part most people miss).
42% use a centralized approval workflow; 75% of Advanced orgs do, and 13% of Advanced orgs still have no formal approval for non-production changes. On access, 35% of developers retain admin across all instances including production, 24% use a PAM solution, and 14% use dev-only admin. 50% of Ad-hoc orgs grant all-environment admin, and 13% of Advanced orgs do the same; it never reaches zero. Internal corporate policies top the "most influential framework" list at 39%, ahead of SOX/SOC 2 at 35%; when respondents say "compliance," most of them mean "we have to prove to ourselves that production is controlled."
Change approval management across environments
Admin privilege management for developers
Change approval management across environments, overall and by governance maturity level
How teams manage admin privileges, overall and by governance maturity level
19% of respondents have already implemented ServiceNow's AI innovations, up from 14% a year ago. Most of the rest have near-term plans. Only 22% are "very confident" their governance model can scale with AI-driven development, and that is the shape of the 2026 problem in one sentence. The platform is moving faster than the controls behind it, and the auto-magic governance assumption (that ServiceNow is producing the audit trail and the policy enforcement on its own) is the gap AI will widen.
Half of Ad-hoc organizations have no AI adoption plans inside 12 months. Half of Advanced organizations have already implemented AI. Among Emerging and Established teams, near term adoption (3-12 months) is the dominant posture.
60% of Ad-hoc customers are "not confident" their governance can scale with AI. 63% of Advanced customers say they are "very confident." The middle, where most of the market lives, is dominated by "somewhat confident," which is a polite way of saying "we will figure it out." That is the part nobody at your company says out loud in the AI roadmap meeting.
Where the cohorts split
AI adoption readiness, overall and by governance maturity level
Confidence that governance can scale with AI
2026 TAKEAWAY
AI on ungoverned ServiceNow is a governance debt accelerator.
Customers sitting at "Established, somewhat confident" are adopting AI at roughly the same rate as customers at "Advanced, very confident." The difference is what happens the quarter after the launch. One cohort absorbs the pace and keeps its environment qualified and authoritative for the next decision. The other compounds the drift. Every organization adopting AI on top of manual drift detection in 2026 is writing a governance bill that will come due in 2027, and the bill is paid in audit findings and rollbacks, not invoices
Three challenges dominate every cohort: customization versus standardization (75%), limited resources or skills gaps (54%), and testing and quality assurance (41%). The top line is the same across the board. Where the cohorts split is below the top line, and the split is the part we find most interesting in this section. Different maturity levels carry different problems, and a one-size-fits-all roadmap will not catch any of them.
Top three delivery challenges
Top three delivery challenges, overall and by governance maturity level
• 75% name customization-versus-standardization a top-three challenge, the most universal friction point in the dataset.• 54% cite limited resources or skills gaps, dominant in early-stage and smaller-team cohorts.• 41% cite testing and quality assurance, up in prominence from 2025.
FAULT LINE
Update-set complexity is a platform problem, not a maturity problem. In the Ad-hoc cohort, 40% name complexity of update sets a top challenge. In Advanced, 38% do. It is the one challenge that survives the whole governance spectrum.
When we asked what is getting in the way of faster and safer delivery, three barriers led: skills gaps and resourcing (29%), conflicting priorities (25%), and lack of automation (21%). Skills and conflicting priorities are both up year over year. Visibility and legacy-tool transitions are down. The pattern is consistent. People and prioritization problems are getting worse, while some of the technology friction is starting to lift.
Biggest barrier to faster and safer delivery, overall and by governance maturity level. Arrows next to percentages indicate year-over-year movement (↑ up vs. 2025, ↓ down vs. 2025); green-highlighted cells in the cohort table indicate statistically significant differences vs. other cohorts.
• Skills gap and resourcing (29%, up YoY) is the single largest barrier overall, and it hits Ad-hoc (40%) and Advanced (43%) cohorts hardest. The two ends of the maturity spectrum share the same blocker for different reasons.• Conflicting priorities (25%, up YoY) is the mid-maturity story. Emerging and Established teams carry most of this weight.
• Lack of automation (21%) has the most interesting cohort signal of all. In large teams (16+ members), the share jumps to 45%. The teams with the most automation are the most vocal about wanting more.• Limited visibility across environments (3%, down YoY) and transition from legacy tools (1%, down YoY) have moved off the radar.
SIGNAL
Skills gaps are now the universal barrier.
Every cohort, every team size, every industry surfaces this one. The 2025 story was "we need more automation." The 2026 story is "we have automation; we need the people to wield it."
Asked to name the single top operational priority for ServiceNow in 2026, respondents landed on three: expand AI and automation (32%), accelerate delivery (25%), and strengthen governance and compliance (21%). Expanding AI is up year over year. Improving visibility across instances and reducing technical debt are down. The priority list is reorganizing itself around AI as the lead story.
Top operational priority for ServiceNow, 2026, overall and by governance maturity level. Arrows next to percentages indicate year-over-year movement (↑ up vs. 2025, ↓ down vs. 2025); green-highlighted cells indicate statistically significant differences vs. other cohorts.
• Expand AI and automation (32%, up YoY) leads overall, with the most concentrated commitment in the Established cohort, where 49% rate it #1 (statistically significant).• Accelerate delivery (25%) is highest in the Advanced cohort (38%), where governance is already mature and the next focus is speed.
• Strengthen governance and compliance (21%) is #1 in the Ad-hoc cohort at 40%. The cohort that most needs to catch up knows it.• Improve visibility across instances (5%, down YoY) is the most telling drop. The audit-trail and monitoring data from earlier in the report say visibility is still weak. The priority list says "we will come back to it after AI."
Priorities rotate with maturity
Ad-hoc teams are installing governance, Established teams are shipping AI, and Advanced teams are accelerating on top of governance they already trust. Three different problems, one operating system.
Ten percent of respondents are in their first two years on ServiceNow. 34% have been on the platform for more than a decade. Operational behavior shifts after the 0-2 year mark, peaks in the 6-10 year cohort, then loses some of that efficiency as complexity compounds in the 10+ year group. Tenure does not buy you maturity; it buys you a bigger footprint to govern.
What the curve shows
• Instance count rises with tenure; only 10+ year customers operate 11+ instances at scale (27%).• Clone frequency peaks in the 6-10 year cohort.• Release-schedule alignment with ServiceNow's twice-a-year cadence is strongest in 6-10 years.• 10+ year customers polarize: some push to daily releases (33%), others drop to quarterly (17%).
Tenure composition and environments managed
• 60% run 1-3 instances; none at 11+.• 57% deploy weekly or more, the fastest cohort.• 43% split evenly between cloning frequently and rarely.• 80%+ name limited resources or skills as the top challenge.
Small teams, frequent releases, skills gap everywhere.
Mid-size fleets, manual release pain.
Largest fleets, polarizing practices.
EARLY STAGE · 0-2 YEARS · 10%
• 63% run 4-10 instances.• 42% deploy bi-weekly; 44% call manual deployment a top challenge (a peak here).• 30% rely on manual comparisons to check for drift.• Skills gap and resourcing still dominate barriers
• 27% operate 11+ instances, the highest share in the dataset.• 38% have a large (16+) development team.• 54% operate in highly regulated industries.• Cloning is polarized: 28% frequent, 34% rare.
Peak efficiency, first real complexity signal.
LOYAL STAGE · 6-10 YEARS · 35%
• 62% manage 4-10 instances.• 42% deploy bi-weekly; 66% clone occasionally or rarely.• Customization vs. standardization now leads challenges (80%+).• 38% cite conflicting priorities as the top barrier.
GROWTH STAGE · 3-5 YEARS · 21%
LONG-TERM · 10+ YEARS · 34%
Smaller teams hold onto broad access and lighter process because they have to. Larger teams install automation, enforce separation of duties, and enable citizen developers because they have to. The shift is visible in almost every question we asked, and it is one of the few places in the dataset where the trend line is genuinely monotonic.
What scales with team size
• Instance count rises sharply: large teams are far more likely to run 11+ instances.• Clone cadence accelerates: nearly half of 16+ teams clone quarterly.• Citizen developer enablement: 50%+ in large teams, 35% in small, 21% in medium.• Admin control tightens: large teams restrict, small teams grant broad prod admin.• AI adoption: 35% of large teams already have AI; 35% of small have no plan
Team size composition
Broad access, light automation.
SMALL · 1-5 MEMBERS · 41%
The catch-up cohort.
• 46% run 1-3 instances; 42% run 4-10.• Only 5% have a dedicated drift detection system.• 50%+ grant developers admin on all instances.• Top priorities: reduce cost and technical debt, then accelerate delivery.
• 45% run 4-10, 40% run 11+ instances.• 27% have a dedicated drift detection system (highest).• 35% already have AI; remaining 65% plan in next 12 months.• 45% cite lack of automation as top barrier. Already automated, still want more
MEDIUM · 6-15 MEMBERS · 35%
• 68% run 4-10 instances.• 36% grant all-instance admin; 29% use a PAM solution.• 21% enable citizen developers (lowest in sample).• 1 in 2 says AI/automation is the top 2026 priority.
LARGE · 16+ MEMBERS · 24%
Highest automation, highest scrutiny.
Admin privilege management, by team size
Small teams run hot on access. More than half grant developers admin on production. Even in organizations with 16+ members, a meaningful share still give developers broad access, but the shape of the curve moves decisively toward scoped admin, PAM, and dev-only privileges.
The sample is nearly evenly split between commercial or less-regulated industries (49%) and highly regulated ones (51%). Approval practices, AI timing, and privilege management all diverge along that line, sometimes in intuitive ways and sometimes not. The "intuitive" guess (that regulated industries move slower and adopt AI later) is dead wrong, and the data here makes that obvious.
Industry composition of respondents
What changes across the line
• Centralized approval is more common in commercial (nearly half) than in highly regulated (35%).• Automated approval is materially higher in regulated (19% vs 3%).• 19% of highly regulated respondents still report no formal approval for non production changes.• Near-term AI adoption (next 3 months) is 3x higher in regulated industries (19% vs 6%).• "No AI plans" is more common in commercial (24%) than in regulated (16%).
Change approval management by industry
AI adoption readiness by industry
OBSERVATION
Regulation is an accelerant, not a brake. The shops with the tightest audit obligations are also the shops most aggressively standing up automated approval workflows and moving fastest on AI adoption. They have the most to lose from manual governance and the most to gain from replacing it.
Year-over-year against the 2025 baseline, four durable shifts show up. Delivery cadence is compressing. Cloning is reorganizing itself around ServiceNow's release schedule. Testing and QA have climbed the challenge list. AI readiness is broadening across the whole sample. None of these is a one-quarter wobble, and none of them surprises us. They are what an industry looks like when speed gets faster than the controls behind it.
• Daily deployments doubled, 5% → 11%. • Bi-weekly became the most common cadence, 24% → 34%. • Quarterly releases collapsed, 24% → 9%.
• Twice-a-year cloning jumped, 5% → 23%.• Frequent cloning rose, 3% → 9%.• Quarterly and annual cloning both declined.
Delivery cadence is compressing; cloning is reorganizing
New feature deployment frequency, 2025 vs 2026
Clone-down frequency, 2025 vs 2026
Challenges shift; AI readiness broadens
Top delivery challenges, 2025 vs 2026
AI adoption readiness, 2025 vs 2026
• Customization-vs-standardization remains #1.• Limited resources or skills gaps holds at #2.• Testing and QA moves up into #3.
• "Already in place" rose, 14% → 19%.• "No plans" fell, 24% → 18%.• 6 and 12 month windows compressed, a signal of real near term motion.
