--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Explore # Exploring AI Risk and Compliance {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring AI Risk and Compliance The AI Risk and Compliance application in ServiceNow helps organizations ethically manage their artificial intelligence (AI) capabilities by identifying, assessing, and mitigating risks. It ensures AI implementations comply with legal, regulatory, and ethical standards, promoting responsible AI use throughout the AI asset lifecycle. The application supports governance by establishing guidelines and frameworks that align AI initiatives with industry standards and corporate goals. Show full answer Show less ## Key Users and Their Responsibilities * **AI Product Owner, Business User, IT Asset Owner, AI Practitioner:** Initiate AI use cases, monitor AI system performance, and engage in responsible AI practices. * **AI Steward:** Oversee ethical AI principles (fairness, transparency, accountability), conduct risk assessments, manage AI lifecycle, and ensure compliance with data privacy and security. * **AI Risk and Compliance Analyst:** Build and maintain regulatory libraries, perform risk assessments, manage issues and policy exceptions, and monitor continuous compliance. * **AI Risk and Compliance Admin:** Configure risk assessment frameworks, automate impact assessments, define AI case types, and tailor reporting to meet business needs. ## AI Risk and Compliance Workflow The workflow begins when a new AI system or enhancement is introduced: * Business users submit AI use cases via the Employee Center or AI Control Tower. * The AI Center of Excellence reviews and adds AI assets (models, datasets, prompts) to an inventory. * An AI impact assessment is initiated and completed to identify risks and controls. * Upon approval, development proceeds with ongoing risk control attestations and issue management. * The AI system undergoes a formal review, including conformity assessment and risk reassessment before deployment. * Post-deployment, continuous monitoring ensures ongoing compliance and performance. ## Benefits for ServiceNow Customers * **Centralized AI Governance:** Manage AI systems and assets lifecycle-wide with better visibility and compliance. * **Risk and Impact Assessments:** Identify and mitigate high-risk AI use cases with structured assessments. * **Compliance Management:** Build an inventory aligned with regulatory demands and automate control attestations. * **Issue and Case Management:** Track and resolve AI-related issues efficiently through structured workflows. * **Scalability and Monitoring:** Enable continuous oversight of AI deployments to address emerging risks like privacy concerns. ## Practical Implications By adopting the AI Risk and Compliance application, organizations can embed ethical AI principles, maintain regulatory compliance, and reduce operational risks associated with AI. It facilitates collaboration across roles, streamlines governance processes, and supports ongoing AI system improvements, ensuring responsible AI delivery and trustworthiness. Learn how you can use the AI Risk and Compliance application to manage your artificial intelligence (AI) capabilities ethically, mitigate AI risks, and ensure compliance. ## AI Risk and Compliance overview {#exploring-ai-risk-and-compliance__cf-exploring-parent-overview} The AI risk and compliance team is responsible for identifying and assessing risks associated with AI. This includes evaluating legal, regulatory, and ethical considerations to ensure that the AI capabilities are implemented responsibly. Their role is to establish guidelines and frameworks that enable the organization to adopt AI solutions while maintaining compliance with industry standards and ethical principles. The AI Risk and Compliance application enables the risk and compliance team of an organization to manage their AI capabilities and assets. ## AI Risk and Compliance users {#exploring-ai-risk-and-compliance__cf-exploring-parent-users} {#exploring-ai-risk-and-compliance__table_pyh_bxl_p2c__entry__2} | User | Responsibilities | |-|-| | AI product owner, Business user, IT asset owner, AI practitioner | * Initiates requests to create AI use cases, models, and datasets through the workspace or the Employee Center. * Monitors AI system performance drives continuous improvements, and assesses business impact. * Actively engages in responsible AI practices at key development and administration points, and accesses approved AI Assets for discovery and reuse. {#exploring-ai-risk-and-compliance__ul_ggm_zcm_p2c} | | AI steward | * Ensures that the AI systems adhere to ethical principles like fairness, transparency, accountability, and non-discrimination, and regularly reviews models and outputs to help prevent harm and bias. * Promotes fairness in AI decision-making by identifying and addressing biases in training data, algorithms, and outcomes, and conducts periodic impact and risk assessments. * Oversees the entire life cycle of AI models, from ideation to retirement, and acts as a liaison between teams to integrate governance across departments, ensuring compliance with data privacy, security, and intellectual property protection. * Identifies and mitigates potential risks, such as privacy concerns and technological malfunctions, through regular testing, monitoring, and updates, and quickly adapts to changes in policies and regulations through workflow updates and issue management. * Monitors AI system performance drives continuous improvements, and assesses business impact. {#exploring-ai-risk-and-compliance__ul_rqf_xgp_y2c} | | AI risk and compliance analyst | * Build AI Risk and Compliance library of regulations, requirements, control measures, entities, policies, risk statements. * Reviews impact assessment response to validate applicability of AI risks and controls. * Performs risk assessment. * Initiates request for control attestation. * Manage Issues, Policy Exceptions, AI Cases. * Manage continuous controls monitoring of AI systems. * Views and manages compliance and risk inventories, for example, authority documents, risk statements, policies, and controls, as well as accesses the Advanced Risk dashboards. {#exploring-ai-risk-and-compliance__ul_svx_52l_mjc} | | AI risk and compliance admin | * Sets up risk and impact assessment frameworks by configuring risk assessment methodologies, contribution factors, and impact templates, for example, conformity assessments. * Sets up automation rules for impact assessments to identify applicable AI risks and controls. * Defines AI case types, applies business rules for form fields and assignments, and designs reporting templates to meet business needs. {#exploring-ai-risk-and-compliance__ul_psy_hvp_y2c} | [Table 1. Users] {#exploring-ai-risk-and-compliance__table_pyh_bxl_p2c} For specific roles within the AI Risk and Compliance application, refer to [Roles and responsibilities](https://www.servicenow.com/docs/N~TRseDRy4NDiLKrO5Zn9g "The AI Risk and Compliance installs the essential roles to perform respective day-to-day operational tasks for managing AI assets across the enterprise."). ## AI Risk and Compliance workflow {#exploring-ai-risk-and-compliance__cf-exploring-parent-workflow} The following section describes the steps involved when an AI asset is created in the AI Control Tower application and the risks for the assets are assessed in the AI Risk and Compliance application until the asset is deployed and moves to being monitored. When a new AI system is introduced or enhanced, it undergoes a risk assessment and an AI impact assessment. These assessments yield scores that denote the risk levels for the AI systems. After the approval is obtained from the relevant stakeholders, the development or build phase begins. During development, controls are attested, issues are tracked and managed, and policy exceptions are raised as needed from a risk and compliance perspective. Following development, the AI system is reviewed to ensure: * Completion of conformity assessment * Review and resolution of open issues and policy exceptions * Reassessment of risks {#exploring-ai-risk-and-compliance__ul_ufp_xhh_s2c}Based on these evaluations, the AI system is either approved or rejected for deployment. The workflow for an AI asset creation and deployment is the following: 1. Business users use the Employee Center or the AI Control Tower workspace and submit a new AI use case. 2. A new inventory record is automatically created in the AI Control Tower workspace. 3. The AI Center of Excellence (COE) team reviews the submitted use case. 4. AI assets such as AI models (Claude, OpenAI, LLMs, etc.), Datasets (Public, Private, Transactions, etc.), Prompts (Decisions) are added to the inventory to help determine if the use case should proceed to the next stage. 5. In the AI Risk and Compliance workspace, either an AI impact assessment is initiated. 6. The assigned business user completes the assessment in the workspace. 7. Based on the assessment results, potential risks and necessary controls are identified and mapped. 8. After the assessment is approved, the AI use case is built by the appropriate teams. 9. The completed solution undergoes a formal review process. 10. Ongoing monitoring is performed to ensure compliance and performance. 11. After successful review, the solution is deployed to production. {#exploring-ai-risk-and-compliance__ol_a1n_mw3_y2c} ## AI Risk and Compliance benefits {#exploring-ai-risk-and-compliance__cf-exploring-parent-benefits} The AI Risk and Compliance application addresses the following challenges faced by any organization that uses AI: * Lack of AI strategy: No commonly agreed-upon AI strategy or alignment with corporate goals. * No centralized management: No single platform for all stakeholders and for the Chief AI officer to collaborate and manage AI use. * No responsible AI guidelines: Absence of guidelines for ethical and responsible AI use. * No risk assessment process: No process to evaluate risks for in-house and third-party AI. * Scalability and monitoring issues: Challenges in scaling AI deployment, tracking performance, and continuously monitoring for emerging risks like privacy. {#exploring-ai-risk-and-compliance__ul_bsx_kwp_y2c}The following table lists the benefits of using the AI Risk and Compliance application. {#exploring-ai-risk-and-compliance__table_ejf_j3j_fcc__entry__3} | Feature | Benefits | Role | |-|-|-| | [AI asset lifecycle](https://www.servicenow.com/docs/access?context=ai-asset-lifecycle&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) | Manage AI systems, models, and datasets across their entire life-cycle with consistent governance for better visibility, control, and compliance. | AI steward | | [Perform impact assessment on an AI use case](https://www.servicenow.com/docs/EXhJaJXhdCUM_FIqPpFrOw "Perform an impact assessment of an AI use case to identify risks like copyright issues, bias, privacy breaches, misinformation, or surveillance, enabling improved oversight and risk management.") | Perform impact assessments for AI systems, models, and datasets to identify high-risk AI assets. | The roles required are as follows: * AI Control Tower: AI Asset Owner * AI Risk and Compliance: AI Risk and Compliance User {#exploring-ai-risk-and-compliance__ul_azz_t4x_1fc} | | [Perform risk assessments on AI systems](https://www.servicenow.com/docs/K0tsT4exWDorFxIz_fiXaQ "Perform risk assessments on AI systems to evaluate the likelihood and impact of potential risks using the AI Risk and Compliance application.")[Initiate risk assessment on AI asset's risks](https://www.servicenow.com/docs/AEOzaC~P0VSMeYD6nL3FlQ "Request risk assessments for risks identified during the AI system's impact assessment. These risks are generated based on the responses provided during the impact assessment of the AI system.") | Perform risk assessments on AI system and individual risks associated with an AI asset based on additional information and testing. | AI Risk and Compliance Analyst | | [Create an AI case in the AI Risk and Compliance workspace](https://www.servicenow.com/docs/hd95bZ20n8l5hP5_3GeFow "Create an AI case in the AI Risk and Compliance workspace by providing a detailed description, such as system behavior, affected users, and any relevant data. Ensure all necessary information, such as supporting attachments, is included for prompt resolution.") [Create an AI issue in the AI Risk and Compliance workspace](https://www.servicenow.com/docs/Oro4rrchu1qYfTW~LpeFag "Identify and manage issues related to the impacted areas for the reported AI case in the AI Risk and Compliance workspace.") | Manage and oversee AI-related cases and issues through a structured case management process. | The roles required are as follows: * AI case: AI Case Analyst and AI Case Manager * AI issue: AI Risk and Compliance Manager and AI Risk and Compliance Analyst {#exploring-ai-risk-and-compliance__ul_qng_44x_1fc} | | [AI assets](https://www.servicenow.com/docs/access?context=ai-assets&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) [Create control attestations for an AI asset](https://www.servicenow.com/docs/UOa9JTo3GOvSgif6eDgtYA "Create control attestations for AI assets to document the existence, implementation, and effectiveness of controls that govern behavior, data usage, performance, and risk posture. Attestations serve as formal evidence that the AI asset meets regulatory, ethical, security, and operational standards.") | Build a compliance-ready AI asset inventory aligned with regulatory requirements using the AI framework content pack. | AI Risk and Compliance Analyst | [ ] {#exploring-ai-risk-and-compliance__table_ejf_j3j_fcc} ## What to explore next {#exploring-ai-risk-and-compliance__cf-exploring-parent-links} To learn more about configuring and using AI Risk and Compliance, see: * [AI governance life cycle](https://www.servicenow.com/docs/NGgy5rh6vyahb~eJihuSOw "Learn more about how organizations can govern AI from initial demand through deployment and ongoing governance monitoring by using the AI Control Tower and AI Risk and Compliance applications together.") * [Configuring AI Risk and Compliance](https://www.servicenow.com/docs/QbvinDipKoz5XrMlYLxG4A "To use the AI Risk and Compliance application, you download and activate the application and then you must publish the assessment templates and set up the assessments and their automation logic to ensure accurate risk assessment scores.") * [Using AI Risk and Compliance](https://www.servicenow.com/docs/n9HXZc8obKwS1kV1yM4a1g "Use the AI Risk and Compliance to request AI systems, AI models, AI datasets, and so on and perform assessments for them to determine their risk posture.") * [AI Risk and Compliance reference](https://www.servicenow.com/docs/sCotAWVVyQbqvsyJwncl5A "Reference topics provide additional information such as tables and roles that are installed with the AI Risk and Compliance application.") {#exploring-ai-risk-and-compliance__ul_tyh_bxl_p2c} **Related concepts** * [AI governance life cycle](https://www.servicenow.com/docs/NGgy5rh6vyahb~eJihuSOw "Learn more about how organizations can govern AI from initial demand through deployment and ongoing governance monitoring by using the AI Control Tower and AI Risk and Compliance applications together.") * [Configuring AI Risk and Compliance](https://www.servicenow.com/docs/QbvinDipKoz5XrMlYLxG4A "To use the AI Risk and Compliance application, you download and activate the application and then you must publish the assessment templates and set up the assessments and their automation logic to ensure accurate risk assessment scores.") * [Intake requests](https://www.servicenow.com/docs/CJRJMLq71K1PdHQT4sPpAA "Intake requests capture information about proposed AI systems, models, and datasets for early review, triage, and evaluation.") **Related reference** * [Roles and responsibilities](https://www.servicenow.com/docs/N~TRseDRy4NDiLKrO5Zn9g "The AI Risk and Compliance installs the essential roles to perform respective day-to-day operational tasks for managing AI assets across the enterprise.")