ServiceNow and OpenAI move the service desk into ChatGPT

What happened

On 28 October 2026, ServiceNow and OpenAI announced a wider partnership. It puts more OpenAI models into ServiceNow products and connects ServiceNow workflows to ChatGPT and Codex. For service desk teams, the main piece is a ServiceNow plugin for ChatGPT. According to OpenAI's announcement, an IT team member will be able to find similar incidents, assess the risk of a change and update a ServiceNow record from inside ChatGPT.

The control model matters as much as the feature. Each customer connects ChatGPT to its own ServiceNow instance and decides which capabilities to make available. ServiceNow's Action Fabric then applies the organisation's existing business rules and permissions, so the AI can only do what a user's configuration and access allow.

Most of the announcement is a roadmap, not something you can buy today:

• The ServiceNow MCP plugin is available in the OpenAI marketplace now. Enhanced capabilities are expected by the end of 2026.
• Voice features in ServiceNow's Super Intelligence Control Tower are expected in the first quarter of 2027.
• A joint security product is due in early access in January 2027, with general availability planned for the second quarter of 2027.
• Codex in ServiceNow's AI Workflow Factory is expected in 2027.

The release's own forward-looking statements warn that results could differ, for example because of execution delays or changes in AI regulation.

Two other announcements give useful context. On 15 October, ServiceNow introduced AI Passport. It is a cryptographically signed credential that AI agents check at runtime to confirm what they are allowed to do. Alongside it came shadow AI detection and AI cost management, all expected in Q4 2026. Then on 29 October, AI-native challenger Serval raised US$150m at a US$3bn valuation, pitching itself as a replacement for platforms like ServiceNow rather than an add-on.

Why it matters

Taken together, these announcements show three changes in how IT service management works.

The front door is moving. For years the self-service portal has been where staff log requests and where service desk analysts do their work. Now the work is moving into the chat tools people already have open. If an analyst can triage an incident and update the record from ChatGPT, the portal matters less. The ITSM platform becomes the system of record and the enforcement layer, not the place where work happens.

Your permissions model becomes your AI safety model. Action Fabric applies the permissions you already have. That is sensible design, but it relies on those permissions being right. Many organisations have built up years of broad roles, inherited group memberships and admin rights that nobody removed. Today a person with too much access is limited by how fast they can click. An AI assistant acting with that same access can move much faster. Untidy role design used to be an audit finding. With AI in the loop, it becomes an operational risk.

Governing agents is becoming a service management job. ServiceNow's AI Passport release cites its own 2026 Banking AI Maturity Index: every bank surveyed reported using AI, but only 24% said their governance matched that use. The release gives little detail on methodology, so treat this as a vendor figure, but the gap it points to is familiar. Finding unapproved AI tools, tracking what they cost and controlling what they can touch are now being packaged as ITSM features.

There is also a competitive angle. Serval says one carmaker, which its CEO named to Reuters as Lucid Motors, moved a 10,000-person organisation off ServiceNow in 45 days. That is the company's own claim and has not been independently checked. ServiceNow, for its part, told Forbes it has a 98% renewal rate. Either way, buyers now have more choice than they did a year ago.

What this means for NZ businesses

Most New Zealand and Australian organisations will not be early adopters of a US product roadmap, and that is fine. These announcements still matter whether you use ServiceNow, another service management tool or a shared inbox.

First, the pattern will reach you through other tools. Staff are already pasting incident details into general-purpose AI assistants. Vendor-supported connectors are a more controlled option, but only if you decide which actions are exposed and who can use them.

Second, privacy and data handling need a deliberate decision. Incident and request records often contain staff names, contact details, device information and sometimes customer data. Before connecting an AI assistant to them, work out what data will flow where. Check it against your Privacy Act obligations and any contracts with your own customers. Neither announcement sets out pricing or data processing locations, so ask the vendor directly.

Third, human approval still matters to buyers. Serval's CEO said customers generally still want a person to approve sensitive actions such as password resets and application access. That fits existing good practice. Change enablement, access management and service request management in ITIL 4 already describe where authorisation belongs. AI does not remove those controls. It makes it more important to define them clearly.

Finally, more competition gives you leverage. With well-funded challengers openly targeting incumbent platforms, renewal talks are a good time to ask for clear AI roadmaps, data handling commitments and pricing for agent features.

Practical next steps

1. Clean up roles before connecting anything. Review who holds admin, ITIL and approver roles in your service management platform. Remove inherited and unused access. Anything an AI assistant can do on a user's behalf will follow these settings.
2. Start with read-only use cases. Finding similar incidents or summarising a ticket history carries far less risk than approving changes or granting access. Let write actions wait until you have watched the read-only phase in practice.
3. Write down where humans must approve. Map AI-assisted actions to your change, access and request processes. Decide which ones always need a named person to sign off, and record that in your policies, not only in tool settings.
4. Find out what AI is already touching your service data. Before choosing a vendor connector, list the browser extensions, chat tools and integrations staff already use with ticket data. Shadow AI is easier to replace once you can see it.
5. Plan around what is available now. Treat 2027 dates as vendor guidance. Base decisions on features that exist today, and get data residency and pricing answers in writing before you commit.

If you are reviewing how your service desk should work with AI assistants, DataForge's IT service management practice can help you design the process and access controls first, so the tooling choice follows from them.