---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Create control attestations for an AI asset

# Create control attestations for an AI asset {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Create control attestations for AI assets to document the existence, implementation, and effectiveness of controls that govern behavior, data usage, performance, and risk posture. Attestations serve as formal evidence that
the AI asset meets regulatory, ethical, security, and operational standards.

## Before you begin

Role required: sn_grc_ai_gov.ai_risk_and_compliance_analyst (AI Risk and Compliance Workspace), sn_ai_asset_mgmt.ai_asset_owner (AI Control Tower workspace)

## About this task

Creating a control attestation is the first step in a two-role process. The AI Risk and Compliance Analyst creates the attestation record
and assigns it to the AI asset owner. The AI asset owner then performs the
attestation to confirm that the control is implemented and operating as
intended.

Controls available for attestation are mapped to the AI asset during the
assessment phase. Each control represents a governance requirement that must be
verified before the AI system can advance to pre-deployment review. If a control
is not yet implemented or only partially implemented, the AI asset owner
documents the gap during attestation, which may generate an issue requiring
remediation.

## Procedure

1. Navigate to one of the following locations:  
   In the AI Risk and Compliance Workspace:
   AllAI Risk and ComplianceAI Risk and Compliance Workspace

   In the AI Control Tower workspace:
   AllAI Control TowerAI Control Tower Workspace
2. Select the AI asset for which you need to create control attestations using one of the following options.

   | Option | Description |
   | Create a control attestation using AI Risk and Compliance Workspace | Select the list icon ![]() and select the AI asset for which you need to create control attestations. |
   | Create a control attestation using AI Control Tower | 1. Navigate to the AI asset inventory - Managed list. 2. Select the Risk \& Compliance tab. {#attest-controls-for-ai-systems__ol_fly_khl_hjc} |
   |-|-|

   {#attest-controls-for-ai-systems__choicetable_ftl_1bl_hjc}
3. Navigate to Applies toControls.
4. Select a control from the list.
5. Select Attest.  
   When you select one or more controls, the button label updates to show the number of selected controls, for example, Attest (2).  
   Note:  
   Attestations can only be created for controls in the Draft or Monitor state.
6. Select Create.  
   The control attestation record is created and assigned to the AI asset owner. The AI asset owner receives a notification with the attestation details and due date.
{#attest-controls-for-ai-systems__steps_ely_khl_hjc}

## Result

The control attestation record is created and assigned to the AI asset
owner. The attestation appears in the AI asset owner's task queue.
You can monitor attestation status from the
Controls list on the AI asset record.

## What to do next

After creating the control attestation, next steps vary depending on your
role.

AI Risk and Compliance Analyst
\[sn_grc_ai_gov.ai_risk_and_compliance_analyst\]: Your task is complete. The AI
asset owner receives the attestation in their task queue. Monitor attestation
status from the Controls list on the AI asset record. If an attestation is not
completed by the due date, follow up with the AI asset owner or reassign the
attestation.

AI asset owner \[sn_ai_asset_mgmt.ai_asset_owner\]: You receive the control
attestation in your task queue. Complete each attestation to confirm that the
assigned controls are implemented and operating as intended. If a control is not
yet implemented, document the gap in your response.
**Related concepts**   

* [Manage controls using AI Risk and Compliance](https://www.servicenow.com/docs/z5BfYO773DFIc6MDEEVEZA "You can add, remove, and delete controls for an AI asset using the AI Risk and Compliance.")  
**Related tasks**   

* [Add controls from control objective](https://www.servicenow.com/docs/p3ixMFPcserFB6hy3OPn4A "Add controls manually from published control objectives to an AI asset in AI Risk and Compliance. Use this task when controls were not automatically generated by a post-assessment action, or when you need to apply additional controls beyond those mapped through the impact assessment.")

*[\>]: and then