The Enthusiasm from Las Vegas Meets a Different Reality
Knowledge 2026 was an impressive event. The announcements around Otto, the vision pitch from Bill McDermott, the Rolls-Royce numbers — all of it was compelling. But those who make technology decisions in Germany, Austria, or Switzerland operate in a different regulatory environment than the American CIO on stage in Las Vegas. And that difference is not cosmetic.
Regulatory Pressure: GDPR Meets the EU AI Act
While ServiceNow Otto is discussed in the US as a productivity tool, in the EU it is simultaneously a compliance issue. Two regulatory frameworks apply here in parallel.
GDPR: Otto processes requests in natural language — and therefore potentially personal data belonging to employees and customers. Every interaction, every routing decision, every automated workflow can be relevant under data protection law. Anyone deploying AI with personal data practically always needs a solid GDPR framework: legal basis, purpose limitation, data minimization, data subject rights, and where applicable a data protection impact assessment.
EU AI Act: Starting in August 2026, Article 50 of the EU AI Act takes effect: companies must clearly label which content was artificially generated — regardless of whether it is text, images, videos, or audio. Anyone outputting Otto-generated responses to employees or customers without labeling them is entering legally risky territory.
A Bitkom study from May 2026 shows: 82 percent of companies see legal uncertainty as their biggest challenge in the AI environment. This is not an abstract feeling — it is a real brake on projects.usforderung im KI-Umfeld. Das ist kein abstraktes Gefühl — es ist eine reale Bremse für Projekte.
The Liability Issue Almost Nobody Talks About Openly
A landmark ruling by the OLG Dresden from 2021 continues to shape the risk landscape today: managing directors can be held personally liable alongside the company for data protection violations, as they qualify as the responsible party under GDPR.
In concrete terms: anyone who deploys Otto without completing the governance homework — a data processing agreement with ServiceNow, clear documentation of data flows, demonstrable human oversight of high-risk decisions — is not just running into a compliance problem, but into personal liability risks.
The Maturity Question: Otto Assumes What Many Don’t Yet Have
For the German Mittelstand, ServiceNow often remains a question of maturity. The tool is powerful when a digital process backbone already exists. Without that foundation, what emerges quickly is a platform that is too large for a governance operating model that is still too small.
This is the decisive point that marketing presentations routinely skip: Otto is not a plug-and-play product you can force onto an immature process environment. It is an amplification machine — it makes good processes better and makes the flaws in poor processes more expensively visible.
Concretely: Anyone without a well-maintained CMDB will not get reliable IT self-service even with Otto. Anyone whose HR processes are not structured will not be able to build a functioning employee self-service with Otto. AI does not override the quality of your data foundation.
What the New Commercial Model Means for DACH
Since April 9, 2026, AI at ServiceNow is no longer a separate add-on — every product ships with a full AI package enabled by default.
That sounds attractive. But a critical look is worthwhile: when AI functionality is switched on by default, the organization bears the burden of proof that this functionality is configured in compliance with GDPR and the AI Act. “It was enabled by default” is not an exculpating argument before a German data protection authority — it is an aggravating one.
The Questions DACH Decision-Makers Should Ask Right Now
Anyone who wants to deploy Otto or is currently evaluating it should clarify these questions openly — before implementation, not after:
On data processing: Where is my data processed — EU data center or US servers? What data flows into the Moveworks backend? Is there a current data processing agreement that meets GDPR requirements?
On governance: Which decisions does Otto make autonomously — and which require human approval? How do I document this for the supervisory authority?
On readiness: Are my workflows, CMDB, and HR data clean enough to run AI on top of them? Or am I buying myself, with Otto, an expensive mirror image of my process quality problems?
On the EU AI Act: How do I label AI-generated content that Otto outputs to employees or customers? Have I already documented AI literacy in compliance with Article 4?
What This Means for the DACH Market
ServiceNow Otto is one of the most compelling AI strategies in the enterprise space — that is not an exaggeration. But enterprise software in Germany is not rolled out through enthusiasm; it is rolled out through clean governance, realistic maturity assessments, and clear accountability.
Anyone who approaches Otto with that discipline has a genuinely powerful tool at hand. Anyone who believes the platform itself will resolve the complexity will be disappointed.
The good news: the foundations required for a successful Otto implementation — process clarity, data hygiene, a governance framework — are exactly the same foundations every future-ready organization needs anyway.
Your Next Step: AI Readiness Assessment with NowXperts
ServiceNow Otto offers real potential — but only for organizations that bring the right foundation.
With our AI Readiness Assessment, we analyze together with you:
- the current maturity level of your ServiceNow environment
- open GDPR and EU AI Act requirements in the AI context
- concrete quick wins and a realistic implementation path for Otto
The assessment takes half a day and gives you a clear decision-making basis — no sales pitch, just genuine insight.
NowXperts is a specialized ServiceNow consultancy with deep DACH market knowledge and years of implementation experience — not a generalist who just discovered Otto.
