ServiceNow, governed

The standard for how ServiceNow is run.

Big firms build ServiceNow. We make sure it's built right — and stays under your control when AI starts building it for you. Kritavi is a senior, Reykjavík-based consultancy for organisations that run on the platform: advisory for the instance you have, and fixed-scope implementation for the one you need.

Platform Standardillustrative — how a Standard
looks in month three
CSDM conformance above agreed baselineheld
Config governance: no unreviewed changes in prodheld
AI agents operating within approved scopeheld
Upgrade readiness: current release −1 or betterin progress
Reviewed with the platform owner, monthly3 of 4 · held
What we do

Two ways in. One standard.

Whether you already run ServiceNow or are about to, the work is the same discipline applied at different points: structure the platform properly, govern how it changes, and measure what it returns.

Lane 1 · Enterprise control layer

Advisory for the platform you already run

For complex and regulated organisations where ServiceNow is a control system, not a ticketing tool. We take the platform owner's side of the table.

  • Platform strategy, governance and operating model
  • Architecture and CSDM / data-model discipline
  • Value realisation — more from the licences you already hold
  • SPM, IRM and risk-aligned portfolio control
  • Oversight of AI agents and AI-generated configuration
  • Partner QA — keeping implementation vendors inside your architecture
Banks, insurers, public bodies, critical infrastructure, telecoms and large enterprises. Sprints, design-authority retainers, programme QA and rescue work.
Lane 2 · Fixed-scope implementation

Fixed-scope builds for the platform you need

Full implementation from data model to go-live, on a fixed scope and a fixed date. Governance and the data model are designed in from the first workshop — not bolted on at the end.

  • Certified seniors only — the people who scope it are the people who build it
  • Phase one live inside a quarter; an ESM Foundation front door live in weeks
  • Two-week increments demoed to your own users — no big-bang go-live
  • ITSM, CSM, Field Service, SecOps, IRM/GRC and integrations — scoped to what you need, nothing you don't
  • You hold the keys at handover; a retainer only if you want one
Organisations of 150–2,000 employees with fragmented services and no appetite for a multi-year programme. Fixed-scope launches and a light optimisation retainer once you're live.

One standard, whichever way in. When another partner builds, we hold them to it. When we build, the same standard holds us — and we never QA our own work and call it independent.

Advisory · The instance you have

Most platforms don't need more licences. They need more discipline.

Before we recommend anything new, we run a fixed-scope review of the platform you already have — what your entitlements can already do, what it actually costs to change, whether it survives the next upgrade, and where governance is missing. You leave with the Standard — a written baseline you own — that you can hold your team, your partners, and the AI now changing your platform to. Three weeks. Fixed scope. Fixed price.

Licence and value realisation

A structured read of what you're entitled to versus what's switched on — capability by capability — and the shortest path to using what you already pay for.

Process design that survives contact

Incident, request, case and change processes rebuilt around how your organisation actually works, with the exceptions designed in rather than discovered in production.

Platform health and upgrade readiness

Technical-debt and customisation review, CSDM conformance, and a standing upgrade posture — so releases are routine events, not projects.

Governance you can point to — human and AI

Written guardrails, per process and per role: who may change what, how configuration is reviewed, what gets measured monthly — and how change made by AI agents is approved before it reaches production. When the platform starts configuring itself, this is the control that keeps it yours.

What you leave with

One document — the Standard. Per process and per role: what "good" looks like on your platform, who may change it, how it's measured, and how change, human or AI, gets approved. The baseline your team builds to, the yardstick you hold your implementation partners to, the control record you can show a regulator. Owned by you — not locked inside a consultant's methodology.

Every hour delivered by a certified senior architect. Fixed scope, fixed price, fixed date.

Implementation · Built to a standard

Built to the standard we hold other partners to.

Other partners build, then offer governance as a service line. We run the practice that holds implementation partners to a standard — so we build to that same standard, and hand it over ready to be audited against it. Fixed scope, fixed price, senior-delivered. Phase one live inside a quarter — an ESM Foundation front door in weeks.

How we build

No delivery pyramid — the people who scope it are the people who build it.
Two-week increments demoed to your own users — no big-bang go-live.
Every build ships against the Standard — a written baseline you own; the same one our advisory practice holds your other partners to.
You hold the keys at handover; a retainer only if you want one.

Control-critical builds WHERE THE STANDARD BITES HARDEST

IT Service Management

Incident, problem, change and request, built for deflection and resolution time, not ceremony.

Risk Management (IRM / GRC)

Controls, policies and risk registers that regulators and auditors recognise.

Security Operations

Security Incident and Vulnerability Response wired to your SOC reality.

Performance Analytics

Indicators tied to the standard we agreed — measured, not decorated.

Workflow Data Fabric

Connected enterprise data feeding workflows and AI without another migration.

The rest of the platform, built the same way

Customer Service Management

Cases, workspaces and portals that hold up at your real volumes.

Field Service Management

Work orders, scheduling and mobile field work on the same data model.

Strategic Portfolio Management

Demand, projects and portfolio decisions leadership will actually use.

IN EVERY BUILD: AI · DATA · WORKFLOW · SECURITY · GOVERNANCE
Not modules we bolt on, but the discipline we scope, build and hand over inside. ServiceNow bundled these into the platform in April 2026; we make sure they stay governed once they're yours.
AI, governed

AI is included now. Control isn't.

ServiceNow ships AI governance out-of-box: AI Control Tower discovers, approves and logs the agents changing your platform. That's genuinely useful — and it's still a tool. A tool doesn't carry your accountability. Someone has to decide which policies it enforces, prove they match your obligations, own it once it's live, and sign to the auditor that it holds. That accountability is yours. It doesn't move to the platform, and it doesn't move to us. What we do is make the tool answerable to you.

When an autonomous change breaks a control, you are still liable. You can't tell a regulator the AI did it — or that the tool approved it. Accountability doesn't transfer to the machine, or to the machine that governs it.
  • Guardrails tuned to your obligations, not left on defaults. The scope, escalation paths and named owners your regulators actually require — set before the first workflow goes autonomous, and configured into AI Control Tower rather than assumed from it.
  • AI-generated configuration, reviewed like code. When AI starts building on your platform, every change still goes through your change control, not around it. A content pack is a starting point, not a sign-off.
  • Readiness before rollout. Data model, knowledge quality and process hygiene assessed first — AI amplifies whatever it finds, good or bad.
  • The control record, owned by you. The AI control layer of the Standard: who may let AI change what, how it's approved, and how you prove it to an auditor. Evidence you can show a regulator — not a dashboard you hope holds up.

We use AI in our own delivery too — to assess, document and test faster. It's a tool in how we work, never the thing that decides. A senior architect decides, and signs.

48% → 14%

of Icelandic companies use AI software, but only 14% have an AI strategy. The gap between adoption and governance is the problem we're built for, and it looks the same across the Nordics.

Statistics Iceland · ICT 2024, published March 2026
About

Small, senior, independent.

Founder-led

[Name][specific senior scope, e.g. "N years leading ServiceNow architecture at <named regulated enterprise>"]; [named certification, e.g. CTA / CMA].
[Name][specific senior scope]; [named certification].
[Name][specific senior scope]; [named certification].

No pyramid, no bench — capacity is added only when a mandate needs it.

Independent by design

We don't resell licences and we don't take delivery volume targets. Our advice on scope, architecture and vendors has exactly one client: you.

Based in Reykjavík

Headquartered in Reykjavík, working across Iceland, the Nordics and Europe — in English, Icelandic and plain words.

Start here

Tell us what your platform should be doing.

A 30-minute conversation with a founder — about your instance or the one you're planning, your licences, and the number you're accountable for. If it's a fit, you'll get a scoped, fixed-price proposal with the success criteria written in.