Regulatory risk classification reference

Risk assessment methodologies, formulas, risk ratings, and records that determine the regulatory risk classification of an AI asset.

Risk assessment methodologies

The following table lists the predefined risk assessment methodology (RAM) that produces an automated classification. The RAM ships in the Draft state. Publish the RAM before you use it. For the RAMs that produce an assessed classification, see AI risk score calculation reference.

RAM	Applies to	Score formula	RAM selection
Automated risk classification for AI system	AI systems	Highest of six factor scores	Specified by the sn_grc_ai_gov.ai_system_automated_risk_classification_asmt_ram property

Risk ratings

The following table lists how the automated RAM converts a score on a scale of 0 to 10 to a rating.

Score	Rating
0	To be determined
0.1 to 5.00	Low
5.01 to 7.00	Medium
7.01 to 9.00	High
9.01 to 10	Unacceptable

An asset without an inherent rating is treated as To be determined. In the automated RAM, a score above 0 but below 0.1 also falls in the To be determined risk rating.

Automated classification formulas

The automated RAM uses the following formulas.

Shell

Factor score = (points total ÷ maximum possible points) × 8Inherent score = Maximum(factor 1, factor 2, factor 3, factor 4, factor 5, factor 6)

A factor whose points total is 9000 or more scores 10. For a field that accepts several selections, the points total uses the highest value among the selected options. The factor score has two decimal places.

Automated classification factors

The following table lists the six factors and the Use and purpose fields that each factor uses.

Factor	Fields and maximum points	Maximum total
Context of Use	Interaction type with end users (60), Area where the AI system is used (80), Intended outcome of the AI system (60)	200
Autonomy & Role of Human Oversight	System autonomy level (50), Type of output produced (50), Level of human involvement (50)	150
Data & Model Risks	Type of output produced (50), Data used by the system (40)	90
Impact on Individuals & Society	People affected by the AI system (50), Type of output produced (50), Intended outcome of the AI system (60)	160
Cybersecurity & Systemic Risks	Area where the AI system is used (80), Data used by the system (40), System autonomy level (50)	170
Governance & Compliance Maturity	Area where the AI system is used (80), People affected by the AI system (50), Level of human involvement (50)	180

Use and purpose answer point values

The following tables list the point value of each answer option for every Use and purpose field.

Answer option	Points
Not Applicable	0
Efficiency Boost	10
Quality Enhancement	20
Decision Guidance	30
Automation of Tasks	40
Customer Experience Upgrade	50
Insight Generation	60

Answer option	Points
Internal Operations	10
Customer Services	20
Sales & Marketing	30
Finance & Accounting	40
IT & Security	50
Supply Chain	60
HR & Workforce	70
External Partner Ecosystem	80

Answer option	Points
Simple Alerts	10
Insight & Summaries	20
Ranking & Scores	30
Recommendations	40
Generated Content	50
Automated Decisions	9000
System Actions	9010

Answer option	Points
Internal Team	10
Specific Customer Groups	20
General Customer Base	30
External Partners	40
Public or Large Audiences	50

Answer option	Points
Not Applicable	0
Full User Control	10
User-Guided with AI Support	20
Shared Control	30
AI-Initiated with User Approval	40
Fully Automated Workflow	50

Answer option	Points
Public or General Info	10
Business Operational Data	20
Customer Interaction Data	30
Behavioral or Usage Data	40
Profile or Account Data	9000
Sensitive Business Data	9010

Answer option	Points
Not Applicable	0
No Direct Interaction	10
Background Support	20
Notifications & Prompts	30
User-Facing Recommendations	40
Chat-Based Interaction	50
Interactive Experience	60

Answer option	Points
Not Applicable	0
Assistive (AI suggests)	10
Semi-Automated (acts with confirmation)	20
Condition-Based Automation	30
Event-Triggered Automation	40
Fully Automated Execution	50

Selecting Profile or Account Data, Sensitive Business Data, Automated Decisions, or System Actions triggers the 9000-point override described in the Automated classification formulas section, regardless of the other answers on the same asset: The factor score becomes 10 and the inherent score is Unacceptable.

Records and fields

The following table lists the records and fields that store the classification.

Record	Field	Purpose
Asset governance details [sn_ai_governance_asset_governance_details]	Inherent risk rating	Inherent rating that the classification assessment produces
AI system entity map [sn_grc_ai_gov_ai_system_entity_map]	Risk classification	Classification of the related entity, copied from the governance details record

Properties

The following table lists the property that controls automated classification.

Property	Purpose
sn_grc_ai_gov.ai_system_automated_risk_classification_asmt_ram	Published RAM that classifies AI systems automatically

title	Regulatory risk classification reference
description	Risk assessment methodologies, formulas, risk ratings, and records that determine the regulatory risk classification of an AI asset.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/intelligent-experiences/gov-airc-ref-regulatory-classification.html
release	australia
topic_type	reference
last_updated	2026-10-05
reading_time_minutes	4
keywords	regulatory risk classificationautomated risk classificationrisk ratingsAI Risk and Compliance
breadcrumb	ReferenceManaging risk and complianceGovern AI assetsAI Control TowerEstablishing AI governanceEnable AI Experiences