On ServiceNow - Control Tower
Know exactly where you stand on AI governance.
A three-to-four-week, evidence-based diagnostic for UK regulated financial services. You get a classified inventory of the AI already running in your business, a gap analysis against the frameworks that matter, and the board pack to act on it.
3-4 weeks
From kick-off to board pack
30-80
AI initiatives inventoried and classified
4 phases
Discover, Analyse, Synthesise, Present
What lands on your desk
Four things, and each of them stands alone
Every engagement produces these, whether or not you ever commission anything else.
AI inventory
Typically 30 to 80 named initiatives, classified against EU AI Act tiers and your own taxonomy, built in a schema aligned to ServiceNow AI Control Tower so it imports straight into implementation.
Gap analysis
Your current posture mapped against the EU AI Act, NIST AI RMF and applicable FCA, PRA and ICO expectations. Every finding traces back to a named interview, document or benchmark.
Readiness score
Our multi-dimension readiness rubric: the radar chart that headlines the board pack and anchors the conversation with your committee.
Board-ready roadmap and business case
Not just findings: the actual slide set and indicative business case that drives the next committee decision.
All four are yours to keep and to reuse, including if you take the next step with somebody other than us.
The question you can't answer
Regulated firms know they must act. Few can say where to start.
The EU AI Act is in force, FCA guidance is live, and PRA SS1/23 expectations are expanding to cover AI. The pressure is real, but most firms can't yet articulate the scope of the problem, let alone the business case for fixing it.
The trigger is usually a difficult question from the audit committee, from internal audit, or from the regulator, and the firm cannot answer it with evidence.
- Most firms cannot answer "what AI is running in our business today?": shadow AI is invisible to the risk function.
- Regulatory urgency without clarity: the obligations are known, the starting point is not.
- Audit committees and regulators are asking for assurance the firm cannot yet give.
How it runs
Four weeks, four phases
Fixed scope, senior-led, and pre-shared with your sponsor before it ever reaches the committee.
- Week 1
Discover
Stakeholder interviews, document review, AI inventory built.
- Week 2
Analyse
Gap analysis, risk classification, readiness scoring.
- Week 3
Synthesise
Report, roadmap, business case and board pack drafted.
- Week 4
Present
Pre-share with the sponsor, finalise, present to committee.
Findings are always pre-shared before committee, so the sponsor is never surprised in the room.
Who it's for
Built for the buyer who has been asked a difficult question
- UK regulated financial services
- CRO, CIO, Head of Internal Audit, Head of Operational Risk
- Building societies, asset managers, payments, insurers
Evidence, not opinion
Every finding traceable to a named interview, document or benchmark, and defensible in front of any committee.
Platform-aware, not platform-pushed
We recommend ServiceNow AI Control Tower only where the evidence supports it, and we'll say so if you shouldn't deploy it.
A no-regrets first step
The inventory, gap analysis and roadmap stand alone, whatever you decide to do next.
Where it leads
From "where are we?" to a governed AI estate
The readiness check is the first step. What it finds usually raises a platform question and a resilience question, and the inventory imports straight into whatever you build next.
Platform Health and Value
150+ read-only checks against your live ServiceNow estate: whether the platform underneath can carry what you're about to govern.
Explore the assessment Regulated estatesDORA Compliance
Operational resilience controls implemented on ServiceNow IRM, mapped to your actual ICT service landscape.
Explore DORAQuestions we get asked
Before you commit to anything
- What if we do not know what AI we already have?
- That is the usual starting position, and it is what the inventory phase exists to solve. Nobody arrives with a complete list.
- Do we have to deploy ServiceNow AI Control Tower afterwards?
- No. The inventory, gap analysis and roadmap stand alone, and we will tell you if the evidence does not support deploying it.
- Will this satisfy our auditors?
- It gives you the evidence base and the traceability an auditor asks for. Whether a specific regulator is satisfied is their judgement, not something any consultancy can promise.
Ready to fix your foundation? Let's talk.
We start with discovery to understand your challenges and goals. Let's discuss what's possible.