Short answer
Banks and insurers running global capability centers (GCCs) on ServiceNow should start with controls and platform governance, in sub-production on masked data, with the vendor-risk pack up front. We don't have a named bank reference yet. Our closest evidence is a leading insurance provider that put AI disclosure controls live in 4 weeks.
Last reviewed Nov 2, 2026
What we can and can't show
As of Nov 2, 2026:
- A leading insurance provider: IRM and AI disclosure controls, 4 weeks.
- A global asset manager and retirement provider: CMDB, HAM and SAM, with 632K CIs, 208 classes, CSDM 5.0 and a 60-day plan.
- A named bank: we don't have one yet.
We won't promise a 2-week POC at a bank before third-party review. Your risk team sets that clock.
Where to start
| First tower | Why | Lead offer |
|---|---|---|
| Controls and audit evidence | Control testing and audit prep often sit in spreadsheets | Controls CoE |
| Platform ownership | Thin teams and skipped upgrades raise audit risk | Platform Owner's Office |
| AI inventory | Regulators and auditors will ask what's running | Agent Value Office |
| Global desk and change board | Comes later, once controls are in place | Deflection Sprint |
Regulated realities
Ask ServiceNow for AI inference location in writing, per instance. India inference is unconfirmed as of Nov 2, 2026. iForge™ runs on your model in your boundary, with SOC 2 and ISO/IEC 27001 reports for inMorphis available under NDA.
India's DPDP consent, notice and rights duties apply from May 2027, so plan your privacy workflow alongside this and have Indian counsel confirm the date. ServiceNow's India index (Sep 8, 2026) says only 22% of Indian enterprises have AI testing, auditing and risk-assessment processes in place.
GCC Now™ is the ServiceNow Accelerator by ANSR × inMorphis, a joint venture for global capability centers (GCCs) and GBS organizations.