Now Assist in Higher Education: A Practical AI Governance Framework

TLDR: Now Assist in higher education AI governance is the conversation every CIO at a ServiceNow institution needs to be having right now, whether or not their campus has formally deployed AI. As of the April 9, 2026 ServiceNow commercial model announcement, AI is bundled into every tier of every ServiceNow solution. The AI already arrived with the existing investment. The question is no longer whether to procure Now Assist. It is whether the institution has the governance posture to manage the AI capabilities that are already on campus. This pillar names the three governance pillars (visibility, compliance, accountability), walks through the FERPA edge cases higher ed has not yet litigated, and shows how AI Control Tower fits.

Now Assist in higher education AI governance is the strategic conversation every CIO running ServiceNow needs to be having right now, whether or not the institution has formally announced an AI deployment. Most institutions still talk about Now Assist as a future procurement decision. That framing was correct two years ago. It is wrong now.

As of ServiceNow's April 9, 2026 announcement, the entire product portfolio is now AI-enabled. AI, data connectivity, workflow execution, security, and governance are built into every ServiceNow product. The official position: "AI, data, security, and governance are now in every ServiceNow offering, not a separate purchase." The AI capabilities have already arrived with the existing ServiceNow investment.

The institutions that pretend otherwise are in the worst position. They have AI deployed (whether or not they realize it), no governance posture in place, and no inventory of what is actually running. The institutions that face the situation honestly are in the strongest position. They treat the AI capabilities as a given and concentrate the strategic conversation on what they can still control: the governance posture.

Bettera is the only ServiceNow consulting partner exclusively focused on higher education. ServiceNow's announcements at Knowledge 2026 (May 4-7) significantly expanded the AI Control Tower product family and reinforced ServiceNow's positioning as the AI governance layer for the enterprise.

This pillar is the framework we walk higher ed CIOs through. Three governance pillars. The FERPA edge cases that have not yet been litigated. How AI Control Tower fits operationally. And the implementation sequence that lets governance catch up with what is already deployed.

Why Now Assist is the wrong question

The framing reset. Most institutions ask "should we deploy Now Assist?" That question presumes Now Assist is something the institution chooses to procure. Under the 2026 commercial model, that presumption is false.

What changed in April 2026, per ServiceNow's own announcement:

• ServiceNow replaced the previous Standard, Pro, Enterprise tier structure with a new three-tier model: Foundation, Advanced, and Prime

• AI is bundled across all three tiers. Foundation includes Now Assist Skills (AI assistance for human workers). Advanced adds Agentic Workflows (end-to-end automation). Prime adds the Autonomous Workforce (role-scoped AI specialists)

• AI Control Tower, Workflow Data Fabric, Moveworks AI, and Process Mining are bundled across all tiers with no add-on SKU

• Otto, the new unified AI experience layer combining Now Assist + Moveworks + AI Experience, was announced at Knowledge 2026 and is being rolled out across ServiceNow products

• The Autonomous Workforce of AI specialists (across IT, CRM, HR, security, finance, legal, procurement) became generally available

• Action Fabric and the Model Context Protocol (MCP) Server now enable any external AI agent (Claude, Microsoft Copilot, homegrown bots) to plug into the same governed workflow surface

• 
  

What this means for higher education is direct. Institutions running ServiceNow ITSM at any tier have generative AI capabilities enabled in their instance. The breadth and autonomy scale by tier (Foundation gets Now Assist Skills; Prime gets fully autonomous AI specialists), but AI is present everywhere. Whether the campus has "deployed AI" in the strategic-communications sense is a different question from whether the capabilities are present in the platform.

The right question is not "should we deploy Now Assist?" It is: what is the governance posture that lets us manage the AI capabilities that already arrived with our existing ServiceNow investment, and lets us evaluate the next ones intelligently?

The CIO who treats this as a governance question rather than a procurement question is in the strongest position. The CIO who waits for a future procurement moment to think about AI governance is governing AI that is already running, retroactively. Now Assist in higher education AI governance starts the moment the institution acknowledges what it already has.

The three governance pillars

Bettera's three governance pillars framework. Each pillar is observable and operational, not aspirational language.

Pillar 1: Visibility. What AI is actually running in the institution? Which models, which vendors, which datasets, which decisions. Visibility is the prerequisite for governance. You cannot govern what you cannot see.

Visibility at the institution level covers every AI agent in the ServiceNow instance, every connected external agent (via Action Fabric or MCP), every "shadow AI" workflow running through Microsoft Copilot or other agents the institution has not formally inventoried, and token spend and model usage trends over time. AI Control Tower is the platform-level instrument for this. The institutional layer (which institutions own and ServiceNow does not provide) is the cross-departmental inventory process and the reporting cadence to cabinet.

Pillar 2: Compliance. Which regulatory frames apply to which AI use cases? In higher ed: FERPA (always), HIPAA (where the institution has clinical operations), state privacy laws (varying), accreditation standards (varying), Title IX (for AI in adjudication contexts), and the institution's own AUP.

Compliance is not just about whether the AI is "allowed." It is about whether the institution can document, on demand, which AI made which decision affecting which student or employee, under which policy framework, with which audit trail. This is the section where FERPA gets complicated. We walk through specific edge cases in the next section.

Pillar 3: Accountability. Who decides which AI agents get deployed, who reviews them quarterly, who has the authority to shut one down. Accountability at the institution level requires a named AI governance owner (typically the CIO or a delegated Director of AI Governance), a cross-functional governance body (CIO, CISO, General Counsel, VP of Academic Affairs, and a faculty representative as minimum), a quarterly review rhythm, and an escalation path that ends at the President or Provost. Without named accountability, the governance posture is aspirational language.

These three pillars are what AI Control Tower instrumentally supports. The platform gives the institution the technical capability for visibility. The institution provides the compliance framework and the accountability structure. Both layers are required.

FERPA and AI agents: the compliance edge cases higher ed has not yet litigated

The legal section. Framed as questions to raise with General Counsel, not as legal conclusions. Bettera is not a legal advisor and this is not legal advice.

Four edge cases worth raising with counsel as part of any AI governance posture.

Edge case 1: The "school officials" exception. FERPA's school officials exception allows institutions to share educational records with parties acting on behalf of the institution under direct control. An AI agent built into ServiceNow is operating under institutional control. An external AI agent (Claude, Copilot, a third-party vendor's agent connected through Action Fabric or MCP) operating on the same data is in a less clear position.

The question for General Counsel: does the school officials exception apply to AI agents the institution has procured but does not directly operate, and what contractual provisions need to be in place for it to apply?

Edge case 2: The directory information question. AI agents may surface or generate content that combines directory information with information FERPA protects more strictly. A Now Assist summary that combines a student name and email (directory information) with academic record details or financial aid status (protected) creates a derived artifact whose FERPA classification is unsettled.

The question for General Counsel: when AI generates derived content combining classifications, which classification governs the output?

Edge case 3: The decision-making AI question. FERPA contemplates institutional decisions made by humans applying institutional policy. AI agents that triage, route, prioritize, or generate recommendations are participating in institutional decision-making.

The question for General Counsel: when an AI made or shaped a decision affecting a student, is the institution's FERPA disclosure posture different than when a human did?

Edge case 4: The right of access question. FERPA gives students the right to inspect their educational records. AI agents generate logs, embeddings, vector representations, and reasoning traces that did not exist before. The question for General Counsel: which AI-generated artifacts fall within FERPA's definition of educational records subject to the student right of access?

We do not know the answers to these questions because they have not been litigated yet. The institutions that raise them with counsel before they expand their AI footprint are in a defensible position. The institutions that wait for a complaint or audit to raise them are not.

Now Assist in higher education: what every campus already has running

The honest inventory. What is actually running in a typical ServiceNow institution as of mid-2026.

Now Assist for ITSM. Incident summarization, knowledge generation, virtual agent enhancements, code generation for platform developers. Live in most institutions at any tier (Foundation includes basic Now Assist Skills; Advanced and Prime add agentic and autonomous capabilities).

Now Assist for CSM. Case summarization, response drafting, intent classification. Live in institutions that have extended into CSM (the pattern we walked through in our blog on ITSM to CSM expansion in higher education).

Now Assist for HRSD. HR case summarization and routing. Active in institutions running Employee Center or HR Service Delivery.

Now Assist for ITOM. Event correlation, AIOps anomaly detection, predictive incident detection, SRE postmortem documentation. Active where institutions run ITOM.

AI Control Tower. ServiceNow's enterprise AI governance platform. Discovers, observes, governs, secures, and measures every AI system across the institution. Significantly expanded at Knowledge 2026 with 30 new integrations including AWS, Azure, GCP, SAP, Oracle, and Workday, plus deepened integrations with Microsoft Agent 365 and NVIDIA Enterprise AI Factory.

Otto, the unified AI experience layer. Announced at Knowledge 2026. Combines Now Assist, Moveworks, and the AI Experience layer into a single conversational AI surface across the enterprise. Otto is rolling out across ServiceNow products on a phased schedule.

The ServiceNow AI Platform broadly. Includes Workflow Data Fabric (data unification), Action Fabric (any external AI agent can call into governed workflows via MCP), Context Engine (live enterprise context grounding), and the Autonomous Workforce of AI specialists at the Prime tier.

The point is not to list features. The point is for the CIO to recognize that the question "do we have AI on campus?" has a definitive answer for any ServiceNow institution.

The answer is yes. The strategic question is whether the institution is governing what is already running, and Now Assist in higher education AI governance starts from that recognition.

AI Control Tower as the governance instrument

The practical layer. What AI Control Tower actually does and what higher ed must add to it.

What AI Control Tower provides out of the box:

• Inventory of every AI agent the institution operates (ServiceNow-native and external via integrations)

• Token spend and model usage tracking across vendors

• Policy enforcement (which agents can access which data, which can take which actions)

• Audit logging for every AI interaction

• Explainability layer (decision traces)

• Integration with identity governance (through the Veza acquisition ServiceNow completed in 2025)

• Compliance reporting against configurable standards

  
  

What ServiceNow does not provide and higher ed must configure:

• The FERPA-specific data classification overlay

• The accreditation-specific reporting requirements

• The faculty governance integration (most R1 institutions have faculty committees with formal authority over technology decisions; AI Control Tower does not natively understand institutional governance structures)

• The state-specific privacy law mapping (CCPA for California institutions, the New York SHIELD Act, Virginia CDPA, the Texas Data Privacy and Security Act, etc.)

• The institutional risk tolerance configuration

  
  

This is the layer where Bettera works with higher ed institutions. AI Control Tower as ServiceNow ships it is enterprise-generic. The higher-ed-specific configuration is what makes it actually usable in a university context. The technical capability is solved. The institutional adaptation is the work.

The CIOs we work with treat AI Control Tower deployment as a 6-to-9-month engagement, not a configuration weekend. The technical setup is a small fraction of the total work. The institutional adaptation (FERPA mapping, faculty governance integration, cross-functional accountability structure, quarterly review rhythm) is the rest.

This pattern mirrors what we describe in our orchestration pillar: the platform layer is the smaller problem; the institutional layer is the bigger one.

The implementation sequence for governance-first AI adoption

Bettera's five-step governance-first implementation sequence.

Step 1: Inventory what is already running (3 to 5 weeks). Document every AI capability currently enabled in the ServiceNow instance, every external AI agent integrated through Action Fabric or MCP, every "shadow AI" workflow the institution has not formally inventoried, and every AI procurement under active consideration. Most institutions discover their AI footprint is larger than they realized.

Step 2: Establish the three governance pillars before any new procurement (6 to 8 weeks). Stand up the cross-functional governance body. Name the AI governance owner. Define the visibility, compliance, and accountability standards the institution will hold itself to. Approve the policy framework. This step cannot be skipped. Every subsequent step depends on the framework being in place.

Step 3: Deploy AI Control Tower with higher-ed-specific configuration (8 to 12 weeks). The technical deployment plus the institutional adaptation work. FERPA mapping, faculty governance integration, state privacy law overlay, accreditation reporting structure. This is the operational core of governance-first AI adoption.

Step 4: Pilot one AI use case with full governance instrumentation (4 to 6 months). Pick a narrow, high-pain, willing-sponsor use case (the same selection criteria we describe for first CSM use cases). Run it with full Control Tower instrumentation from day one. Measure against the success metrics the governance body committed to publicly.

Step 5: Scale only when the governance posture has produced defensible outcomes. The mistake most institutions make is scaling AI deployment before the governance posture has matured. The mistake costs institutional credit that takes years to rebuild. The sequence above is what protects against it.

Total timeline from kickoff to a defensible institutional AI governance posture: 9 to 14 months.

Frequently asked questions

What is Now Assist and is it included with ServiceNow?

Now Assist is ServiceNow's generative AI feature family, covering summarization, knowledge generation, virtual agent enhancements, content drafting, and code generation across ITSM, CSM, HRSD, ITOM, and the rest of the ServiceNow platform.

Per ServiceNow's April 9, 2026 announcement, AI is bundled into every tier (Foundation, Advanced, Prime) of every ServiceNow solution, alongside AI Control Tower, Workflow Data Fabric, and Moveworks AI. Capability depth scales by tier — Foundation includes Now Assist Skills, Advanced adds Agentic Workflows, Prime adds Autonomous AI Specialists.

What is the ServiceNow AI Control Tower?

AI Control Tower is ServiceNow's enterprise AI governance platform. It discovers, observes, governs, secures, and measures every AI system, agent, and workflow across the enterprise, regardless of where the AI runs. Significantly expanded at Knowledge 2026 with 30 new integrations including AWS, Azure, GCP, SAP, Oracle, and Workday, plus deepened integrations with Microsoft Agent 365 and NVIDIA Enterprise AI Factory.

For higher education, AI Control Tower is the technical instrument for the visibility pillar of AI governance, but requires higher-ed-specific configuration to be usable in a university context.

Does FERPA apply to AI agents in higher education?

FERPA was written for a paper-records world and has not been comprehensively updated for AI agents that access educational records. Four edge cases worth raising with General Counsel: whether the school officials exception applies to procured-but-not-operated AI agents, whether AI-derived content combining classifications is governed by the strictest classification, whether AI-shaped decisions change the institution's FERPA disclosure posture, and which AI-generated artifacts (logs, embeddings, reasoning traces) fall within the FERPA definition of educational records.

These questions have not been litigated. Higher ed institutions should raise them with counsel before expanding their AI footprint.

How do higher ed institutions govern Now Assist deployments?

Through the three governance pillars: visibility (an inventory of what is running through Now Assist and the broader AI Platform), compliance (the regulatory framework that maps Now Assist outputs to FERPA, HIPAA, state privacy laws, accreditation standards), and accountability (a named AI governance owner, a cross-functional governance body, and a quarterly review rhythm).

AI Control Tower provides the technical capability for visibility. The compliance framework and accountability structure are institutional responsibilities that ServiceNow does not provide out of the box.

Do we need additional ServiceNow licensing for AI capabilities?

No. Per ServiceNow's April 9, 2026 commercial model change, no separate licensing is required for Now Assist, AI Control Tower, Workflow Data Fabric, or Moveworks AI. These are bundled into Foundation, Advanced, and Prime tiers of every ServiceNow solution. Institutions running ServiceNow at any tier have Now Assist capabilities available. The depth and autonomy of those capabilities scale across tiers, with Prime including the full Autonomous Workforce. Specific AI specialist consumption is metered through Assist currency.

What changed at ServiceNow Knowledge 2026 for higher ed AI governance?

Knowledge 2026 (May 4-7, 2026) included three announcements particularly relevant to higher education AI governance.

First, AI Control Tower expanded with 30 new integrations across AWS, Azure, GCP, SAP, Oracle, Workday, and Microsoft Agent 365, plus deeper integration with NVIDIA Enterprise AI Factory.

Second, Otto launched as the unified AI experience layer combining Now Assist, Moveworks, and AI Experience.

Third, Action Fabric and the MCP Server enable any external AI agent (Claude, Copilot, homegrown bots) to plug into ServiceNow's governed workflow surface. The K26 announcements reinforce that AI governance is now the central strategic conversation, not AI procurement.

How long does AI Control Tower deployment take in higher education?

Six to nine months for a typical R1 institution. The technical deployment is a small fraction of the work. The institutional adaptation (FERPA mapping, faculty governance integration, state privacy law overlay, accreditation reporting, accountability structure) is the bulk of the engagement.

Total timeline from kickoff to a defensible institutional AI governance posture, including the inventory step and the first pilot use case, is 9 to 14 months.

Where this leaves the institution

Now Assist in higher education AI governance is the most underestimated strategic conversation at most R1 institutions right now. The AI capabilities have already arrived. The governance posture has not. The institutions that close that gap in 2026 will define what AI in higher education looks like in 2027 and beyond. The institutions that do not will be governing retroactively, which is a position no CIO wants to be in when the first FERPA complaint involving an AI-shaped decision lands on the Provost's desk.

If your institution runs ServiceNow and the AI governance conversation is starting at the cabinet level (or should be), that is the working session we do at Bettera.

Contact us and we will walk through your institution's posture together using the three governance pillars framework.

Bettera is the only ServiceNow consulting partner exclusively focused on higher education, and Now Assist in higher education AI governance is one of the most active conversations we are having right now with CIOs and their cabinet partners.

For the surrounding context: our piece on the ITSM modernization path is where Now Assist appears in the broader modernization journey.

Our piece on orchestration is where the platform-layer / institutional-layer distinction we apply here was originally framed.