--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Continuous controls monitoring # Continuous controls monitoring in the AI Risk and Compliance Workspace {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Continuous controls monitoring in the AI Risk and Compliance Workspace Continuous controls monitoring (CCM) in the AI Risk and Compliance Workspace automates the real-time evaluation of control compliance for AI systems. It addresses challenges in manual control testing by providing ongoing visibility into control effectiveness, helping risk and compliance managers promptly identify and remediate control failures. When an indicator signals non-compliance, a GRC issue is created, and the AI system's compliance score is adjusted accordingly. Show full answer Show less ## Key Features * **Integration with AI Evaluation Frameworks:** Connects external AI evaluation frameworks---such as Traceloop---into the indicators framework, enabling use of diverse metrics like toxicity, personally identifiable information (PII) detection, prompt injection, and agent goal accuracy. * **Automated Compliance Scoring:** Continuously evaluates controls on schedules (daily, weekly, monthly) to update compliance scores and generate issues for non-compliant controls. * **Single System of Record for AI Governance:** Consolidates governance evidence for AI systems to support audit trails and compliance scoring against AI-specific control objectives, internal policies, and external regulations. * **Monitoring Lifecycle Management:** Supports continuous monitoring of AI use cases from deployment through their operational lifetime, ensuring ongoing control effectiveness. ## Key Outcomes * Reduced manual testing burden through automation, allowing teams to focus on remediation rather than detection. * Enhanced operational resilience by enabling prompt identification and resolution of control failures. * Improved compliance posture with real-time visibility and audit-ready documentation for AI governance. * Flexibility to incorporate various evaluation frameworks and metrics to suit organizational needs. Indicators in AI Risk and Compliance Workspace continuously monitor control compliance for AI systems. Risk and compliance managers can continuously monitor the controls attached to AI systems. Connect an external AI evaluation framework to the existing indicators framework in AI Risk and Compliance Workspace. ## Indicators for AI systems {#airc-continuous-controls-monitoring__section_indicators-framework} In organizations managing Governance, Risk, and Compliance (GRC) workflows for AI systems, teams can be challenged when monitoring control effectiveness in real time. Manual control testing can leave gaps in visibility and increase the risk of undetected control failures. Without continuous insight into control performance, organizations can face delayed issue resolution, costly compliance violations, and reduced operational resilience. Continuous Controls Monitoring (CCM) automates control verification, reducing manual testing burden and providing real-time visibility into control health. AI Risk and Compliance Workspace evaluates whether a control is compliant or non-compliant using indicators that run on a schedule. When an indicator fails, a GRC issue is created so that the product owner of the affected asset can remediate it. The compliance score of the associated record decreases. This same indicator concept is extended to AI systems by using evaluation scores produced by an AI evaluation framework. ## Value for AI governance {#airc-continuous-controls-monitoring__section_value} Applying indicators to AI system entities gives an organization a single system of record for AI governance evidence. This approach enables continuous monitoring of model risk instead of relying on periodic manual reviews. It also provides an audit trail that supports Compliance Scoring for AI-specific control objectives and authorities, such as internal AI policies or external AI regulation. ## AI evaluation framework providers {#airc-continuous-controls-monitoring__section_evaluation-providers} A compliance evaluation configuration can evaluate an AI system using metrics from ServiceNow or from other evaluation framework providers, such as Traceloop. Each provider exposes a different set of base metrics, such as toxicity, PII detection, prompt injection, and agent goal accuracy. The provider selected in a configuration determines which metrics are available. For more information, see [Create a compliance evaluation configuration](https://www.servicenow.com/docs/EfiBlhLr0KLXfVaahpa4YA "Define the AI systems, control objectives, metrics, and schedule that a compliance evaluation monitors on an ongoing basis."), [Use a compliance evaluation on an AI system record](https://www.servicenow.com/docs/rmCX9_V8TMpLa~BIWomc1g "Map a control objective to an AI system, run its compliance evaluation, and review evaluation results, supporting data, and automatically created issues."), and [AI evaluation base metrics](https://www.servicenow.com/docs/Dri2VXTgnmSFz15C_~ro~A "Base metrics from AI evaluation framework providers for configuring compliance evaluations and monitoring AI system controls."). ## Monitoring lifecycle {#airc-continuous-controls-monitoring__section_monitoring-lifecycle} After an AI use case is deployed, it moves into a monitor state. Its controls are evaluated continuously over the lifetime of the AI system, on a daily, weekly, or monthly frequency. Each evaluation checks the trace, session, or span records produced by the evaluation framework against the configured metric thresholds. If a control fails, an issue is raised against the AI system and its compliance score decreases; when the control becomes compliant again, the score increases. **Related tasks** * [Create a compliance evaluation configuration](https://www.servicenow.com/docs/EfiBlhLr0KLXfVaahpa4YA "Define the AI systems, control objectives, metrics, and schedule that a compliance evaluation monitors on an ongoing basis.")