Ai Risk Management

Activate or update the Colorado Artificial Intelligence Act (Senate Bill 24-205) to install its citations, control objectives, and risk statements on your instance so they can be used in assessments and mapped to your AI assets.

Activate or update the EU Artificial Intelligence Act framework and select the citations relevant to your organization. The citations are installed into your instance so they can be mapped to control objectives and used in assessments.

Activate or update NIST Risk Management Framework to install its citations, control objectives, and risk statements on your instance so they can be used in assessments and mapped to your AI assets.

Activate or update the Transparency in Frontier Artificial Intelligence Act (SB 53) to install its citations, control objectives, and risk statements on your instance so they can be used in assessments and mapped to your AI assets.

Add controls manually from published control objectives to an AI asset in AI Risk and Compliance. Use this task when controls were not automatically generated by a post-assessment action, or when you need to apply additional controls beyond those mapped through the impact assessment.

Enable Advanced Risk Assessments (ARA) to confirm that risk‑based assessments and risk score roll‑up function correctly in the AI Risk and Compliance application.

Reference for the Advanced Risk system properties available in the AI Risk and Compliance application, including the properties that control risk assessment methodology behavior, risk score roll-up, and risk appetite configuration.

An AI asset is a digital resource that leverages artificial intelligence technologies to perform specific functions or address defined business needs.

AI Risk and Compliance analysts reviewing assessments can review AI-assisted recommendations and assign relevant control objectives and risk statements from the compliance library. Accepted recommendations are scoped automatically to the AI Asset.

Track, monitor, and analyze your AI case workflows, identify your workflow bottlenecks, and monitor your accountability of your AI-related risks by using the AI risk and compliance dashboard. As an AI steward, you can also use the dashboard to track the status and trends of your AI-related inquiries.

Learn more about how organizations can govern AI from initial demand through deployment and ongoing governance monitoring by using the AI Control Tower and AI Risk and Compliance applications together.

An AI model goes through design, deployment, and monitoring in accordance with structured governance frameworks that support ethical use, regulatory compliance, and risk mitigation throughout its life cycle.

Reference topics provide additional information such as tables and roles that are installed with the AI Risk and Compliance application.

The AI Risk and Compliance workspace is the central hub for AI risk and compliance managers to monitor risk posture, track assessments, manage controls and issues, and oversee AI cases across the enterprise.

The ServiceNow AI Risk and Compliance application, along with the ServiceNow AI Control Tower, enables the risk and compliance managers to ensure that the organizations comply with the regulations and policies with respect to their AI systems.

Use the AI risk heatmap workbench to visualize assessed AI risks in a color-coded matrix. The heatmap helps you identify concentrations of higher-risk AI assets and compare current and intended risk posture.

An AI system is an AI-powered solution that is developed, deployed, and managed under a formal governance framework. This framework ensures that the system operates in a responsible, compliant, and risk-aware manner throughout its life cycle.

Email notifications are sent automatically when specific events occur across AI governance workflows, including AI Control Tower, AI Risk and Compliance, and inherited Risk Management processes.

Generate AI-assisted recommendations to quickly identify and associate relevant control objectives with an AI Assessment from the AI risk and compliance library.

Generate AI-assisted recommendations to quickly identify and associate relevant risk statements with an AI Assessment from the AI risk and compliance library.

Base metrics from AI evaluation framework providers for configuring compliance evaluations and monitoring AI system controls.

Reference table listing the assessment templates installed with AI Risk and Compliance. Templates are delivered in Draft state and must be published before use.

The AI Risk and Compliance application uses assessment templates to evaluate AI assets for risk, regulatory compliance, and ethical alignment.

AI cases and inquiries provide a structured way to report, track, and manage AI-related concerns and questions as part of AI governance in AI Control Tower and AI Risk and Compliance.

Define the AI systems, control objectives, metrics, and schedule that a compliance evaluation monitors on an ongoing basis.

The ServiceNow AI Risk and Compliance Content Pack provides foundational content to help organizations manage AI-related risk and compliance.

Indicators in AI Risk and Compliance Workspace continuously monitor control compliance for AI systems.

With ServiceNow Otto for AI Risk and Compliance, part of the ServiceNow Otto for Integrated Risk Management (IRM) application, provides agentic workflows and generative AI skills for issue summarization, control objective creation, and assessment responses.

Intake requests capture information about proposed AI systems, models, and datasets for early review, triage, and evaluation.

AI Risk and Compliance life cycle tasks track governance activities across the onboarding and offboarding of AI systems, AI models, and datasets. Each task is scoped to a life cycle phase.

Offboarding AI systems, models, and datasets addresses governance, risk, and compliance requirements throughout assessment, preparation, and retirement. Activities include impact evaluation, residual risk management, documentation preservation, data-handling decisions, and audit traceability.

Reference table listing the default risk assessment methodologies (RAMs) installed with AI Risk and Compliance. RAMs define the scoring frameworks, classification criteria, and contributing factors used to evaluate risks associated with AI assets.

The AI Risk and Compliance application uses risk assessment methodologies (RAMs) to define the scoring frameworks and classification criteria used during risk assessments.

Map a control objective to an AI system, run its compliance evaluation, and review evaluation results, supporting data, and automatically created issues.

Create control attestations for AI assets to document the existence, implementation, and effectiveness of controls that govern behavior, data usage, performance, and risk posture. Attestations serve as formal evidence that the AI asset meets regulatory, ethical, security, and operational standards.

The system automatically creates AI cases and inquiries from inbound emails using keywords in the subject line and body based on configured email intake settings.

Configure email-based intake so that incoming email messages create intake records in AI Risk and Compliance.

Configure AI Risk and Compliance properties to specify which authority documents and policies you want to display on the home page. You can also specify a default automated risk classification assessment RAM for AI systems and specify a default RAM to be used for risk assessments of AI systems.

Configure the AI Risk and Compliance Workspace using UI Builder.

To use the AI Risk and Compliance application, you download and activate the application and then you must publish the assessment templates and set up the assessments and their automation logic to ensure accurate risk assessment scores.

Create an AI case in the AI Risk and Compliance workspace by providing a detailed description, such as system behavior, affected users, and any relevant data. Ensure all necessary information, such as supporting attachments, is included for prompt resolution.

Identify and manage issues related to the impacted areas for the reported AI case in the AI Risk and Compliance workspace.

Create a bulk risk assessment project to perform assessments on multiple risks and controls simultaneously using the AI Risk and Compliance workspace. You can define the project context, including the assessable entity, Risk assessment methodology (RAM), project name, description, and identify and add stakeholders.

Use the Create New AI case form in the AI Risk and Compliance workspace to report an AI case with the necessary details.

Use the Create New Issue form to identify and manage issues related to the impacted areas for the reported AI case.

Datasets in AI Risk and Compliance capture and govern the data used by AI models, enabling organizations to evaluate risk, ensure compliance, and maintain transparency across the AI asset life cycle.

Delete controls from an AI asset to remove them permanently from the control table. This task confirms outdated or unnecessary controls are deleted.

The GRC: Entity Based Access application enables you to segregate data on the AI asset records to ensure that only authorized users can access sensitive AI Risk and Compliance data while maintaining visibility into core entities. Entity-based access administrators can use this application to set up secure, controlled access to various AI assets and its related objects.

Learn how you can use the AI Risk and Compliance application to manage your artificial intelligence (AI) capabilities ethically, mitigate AI risks, and ensure compliance.

After you submit an anonymous report, save the Report key and Report number. Use these reference numbers to follow up or address comments on your case anonymously.

Initiate an AI assessment on an AI asset to send an assessment questionnaire to the assigned user, enabling structured evaluation of the asset against published assessment templates.

Initiate risk assessment to enable the risk assessor to perform risk assessments on AI systems, evaluating the likelihood and impact of potential risks.

Install the AI Risk and Compliance application (sn_grc_ai_gov) if you have the admin role. The application includes demo data and related dependencies.

Install the AI Risk and Compliance content application (sn_grc_ai_gov_cont) to add predefined governance content such as frameworks, authority documents, control objectives, and risk statements.

You can add, remove, and delete controls for an AI asset using the AI Risk and Compliance.

The Operations tab on the AI Risk and Compliance workspace provides an overview of AI systems by state, along with metrics for assessments, control assurance, issues, policy exceptions, and AI cases.

Perform assessments on multiple risks and controls simultaneously in a risk assessment project in the grid view using AI Risk and Compliance Workspace. You can assess inherent risks, effectiveness of controls, residual risks, and target risks. You can define risk responses that enable you to manage and mitigate the risks identified during the risk assessment process.

Perform assessments on multiple risks and controls simultaneously in a risk assessment project using AI Risk and Compliance Workspace. You can assess inherent risks, effectiveness of controls, residual risks, and target risks. You can define risk responses that enable you to manage and mitigate the risks identified during the risk assessment process.

Perform an impact assessment of an AI use case to identify risks like copyright issues, bias, privacy breaches, misinformation, or surveillance, enabling improved oversight and risk management.

Perform risk assessments on AI systems to evaluate the likelihood and impact of potential risks using the AI Risk and Compliance application.

Use the Raise an AI inquiry form to submit your questions about AI systems, models, or datasets and their business applications.

Submit your questions about AI systems, models, or datasets and their business applications.

After an issue has been created, reported, identified, triaged, and investigated, you can remediate it.

Remove associated controls from an AI asset to keep the inventory accurate and up to date. This step is essential to retire outdated or irrelevant controls without deleting their records.

Report an AI case without revealing your identity using the Anonymous Reporting Center. Your name and contact details are not shared with investigators. Save the report key and report number provided after submission to track updates or provide additional information later.

Use the Report an AI case form in the Employee Center to report an AI case with the necessary details.

Report an AI case by describing the system behavior, affected users, and relevant data, and attach supporting files.

Use the Report an AI case form in the Anonymous Report Center to report an AI case with the necessary details. After you submit the AI case report, mandatory fields and input format are validated before submission.

The Request an AI model form is designed to streamline the request process for developing or procuring an AI model. This intake form confirms that all necessary details, supporting documents, and compliance considerations are captured before moving forward with the approval process.

Request the development or procurement of an AI model to support an AI system and initiate governance review, risk assessment, and life cycle tracking.

The Request an AI use case form captures details, supporting documents, and compliance considerations for developing or procuring an AI-based solution.

Request the development or procurement of an AI system to initiate and document the need for an AI-driven solution within an organization.

The Request a dataset form is designed to streamline the request process for procuring a dataset. This intake form confirms that all necessary details, supporting documents, and compliance considerations are captured before moving forward with the approval process.

Request a dataset to support AI model training, testing, validation, or analytical use cases. Datasets are reviewed for quality, privacy, and compliance.

Request risk assessments for risks identified during the AI system's impact assessment. These risks are generated based on the responses provided during the impact assessment of the AI system.

The Risk & compliance tab on the AI Risk and Compliance displays the risk classification of an AI asset inventory and the compliance posture for the selected authority documents and policies.

You can perform assessments on multiple risks and controls simultaneously by creating a risk assessment project for an AI asset. This feature enables assessors to review multiple risks to understand their potential impact, likelihood, and associated mitigation strategies.

The AI Risk and Compliance installs the essential roles to perform respective day-to-day operational tasks for managing AI assets across the enterprise.

Tables are added with the activation of the AI Risk and Compliance application.

The Tasks page in the AI Risk and Compliance Workspace provides a single-pane view of your pending tasks, your group's tasks, and the tasks that are on your watchlist. You can also update the tasks directly from the Tasks page.

The AI Risk and Compliance Content application is a centralized repository of frameworks, citations, risk statements, and control objectives. Using this application accelerates the adoption of AI Risk and Compliance frameworks.

Use the AI Risk and Compliance to request AI systems, AI models, AI datasets, and so on and perform assessments for them to determine their risk posture.

Use the 360° AI asset view to explore the relationship between your AI assets and all its associated records in a distinctive visualization. To use this feature, you must integrate AI Risk and Compliance with the 360° Relationship Visualization application.

The risk assessment project workflow is a structured process to assess multiple risks and controls of an AI asset simultaneously.