---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Roles and responsibilities

# Roles and responsibilities {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Roles and Responsibilities in AI Risk and Compliance (Australia Release)

The AI Risk and Compliance application in ServiceNow provides essential roles designed to manage AI assets and related processes effectively across the enterprise.
These roles enable users to perform operational tasks such as risk and impact assessments, AI system lifecycle management, case handling, and automation within the AI governance framework.
Show full answer Show less  

## Key Roles and Their Functions

* **AI Risk and Compliance Admin**: Responsible for setting up risk and impact assessment frameworks, configuring methodologies and automation rules, profiling AI case types, deleting AI systems, and managing Entity-Based Access settings (requires GRC: Entity Based Access application).
* **AI Risk and Compliance Manager**: Has full access to AI systems with capabilities to initiate impact and risk assessments, manage AI system lifecycle, perform control attestations, and configure bulk access updates (requires GRC: Entity Based Access application).
* **AI Risk and Compliance Analyst**: Accesses assigned AI systems to initiate assessments and manage AI system lifecycle and control attestations, limited to records assigned to them.
* **AI Risk and Compliance Business User**: Creates AI cases via the Employee Center, works on assigned tasks, and performs control attestations.
* **AI Risk and Compliance Reader**: Provides read-only access to AI systems and impact assessments.
* **AI System Reader**: Grants read access specifically within AI Control Tower and AI Risk and Compliance workspaces.
* **AI Case Business User**: Enables creation of AI cases and inquiries through the Employee Center.
* **AI Case Analyst**: Reviews assigned AI cases and inquiries, manages impacted areas such as policies and compliance risks, and addresses root causes.
* **AI Case Manager**: Reviews all AI cases and inquiries, with broader access than analysts.
* **AI Case Admin**: Manages AI case type profiles, sets assignment rules, and can delete AI cases.
* **AI Risk and Compliance AI Agent User** (AICT Foundation only): Reports GRC issues, orchestrates AI agents, performs issue and risk assessment summarizations, responds to smart assessments, and acts on control objective recommendations. This role requires manual assignment.
* **AI Risk and Compliance AI User** (AICT Foundation only): Executes GenAI skills for issue and risk assessment summarization, smart assessment responses, and control objective creation. Also requires manual assignment.

## Why This Matters

Assigning these roles correctly ensures appropriate access and capabilities for managing AI risks and compliance effectively in your organization. Roles range from administrative setup and configuration to operational case management and AI-powered automation, supporting a comprehensive governance framework.

## What to Expect

* Clear delineation of responsibilities for AI risk and compliance activities.
* Role-based access control tailored to operational needs and governance requirements.
* Integration with GRC Entity-Based Access for enhanced security and access management.
* Support for AI lifecycle management, risk assessments, control attestations, and case handling within ServiceNow.
* Availability of AI agent and GenAI user roles for advanced automation and AI-driven insights (specific to AICT Foundation).  
The AI Risk and Compliance installs the essential roles to perform respective day-to-day operational tasks for managing AI assets across the enterprise.
{#roles-installed-with-ai-risk-and-compliance__table_m2t_czq_mqb__entry__3}

| Role title \[name\] | Description | Contains roles |
|-|-|-|
| AI Risk and Compliance Admin \[sn_grc_ai_gov.ai_risk_and_compliance_admin\] | ​The AI Risk and Compliance Admin can perform the following tasks: * Set up risk and impact assessment frameworks. Configure risk assessment methodologies, risk contribution factors, and impact assessment templates. * Define automation rules for impact assessments to determine applicable risks and controls based on the assessment responses. * Set up and profile AI case types. * Delete AI systems. * Enable or disable Entity-Based Access for record types associated with entity properties, and configure the Entity-Based Access settings as needed. Note: GRC: Entity Based Access application must be installed to use this feature. {#roles-installed-with-ai-risk-and-compliance__ul_wnp_4km_s2c} | * sn_smart_asmt.template_manager * sn_grc_ai_gov.ai_risk_and_compliance_manager * sn_smart_asmt.assessment_admin * sn_grc_workspace.state_model_admin * sn_smart_asmt.template_contributor * sn_ai_case_mgmt.ai_case_admin * sn_reg_body_mgmt.writer * sn_risk_advanced.ara_admin * sn_rec_pg_vertical.admin * sn_grc_ent_access.admin Note: GRC: Entity Based Access application must be installed for this role to be available. {#roles-installed-with-ai-risk-and-compliance__ul_lvh_tjm_s2c} |
| AI Risk and Compliance Manager \[sn_grc_ai_gov.ai_risk_and_compliance_manager\] | ​The AI Risk and Compliance Manager can access all AI systems on the system and perform the following tasks:​ * Initiate impact assessments. * Manage the life cycle of an AI system. * Initiate risk assessments. * Initiate control attestations. * Write and update access to the bulk access update configuration. Note: GRC: Entity Based Access application must be installed to use this feature. {#roles-installed-with-ai-risk-and-compliance__ul_g1s_4lm_s2c} | * sn_grc_ai_gov.ai_risk_and_compliance_analyst * sn_smart_asmt.template_contributor * sn_smart_asmt.template_manager * sn_risk_advanced.risk_asmt_project_manager * sn_ai_case_mgmt.ai_case_manager * sn_grc_ent_access.bulk_access_config_admin Note: GRC: Entity Based Access application must be installed for this role to be available. {#roles-installed-with-ai-risk-and-compliance__ul_tpb_klm_s2c}​ |
| AI Risk and Compliance Analyst \[sn_grc_ai_gov.ai_risk_and_compliance_analyst\] | The AI Risk and Compliance Analyst can access all AI systems assigned to them in the system and perform the following tasks only on the assigned records: * Initiate impact assessments. * Manage the life cycle of an AI system. * Initiate risk assessments. * Initiate control attestations. {#roles-installed-with-ai-risk-and-compliance__ul_h12_1nm_s2c} | * sn_ai_case_mgmt.ai_case_analyst * sn_smart_asmt.assessment_reader * sn_smart_asmt.template_reader * sn_grc_ai_gov.ai_risk_and_compliance_business_user * sn_grc_ai_gov.ai_risk_and_compliance_reader * sn_grc_workspace.user * sn_grc_workspace.state_model_reader * sn_risk_advanced.ara_creator * sn_risk_advanced.ara_assessor * sn_risk_advanced.ara_approver * sn_risk_advanced.risk_asmt_project_user {#roles-installed-with-ai-risk-and-compliance__ul_dxg_xlm_s2c} |
| AI Risk and Compliance Business User \[sn_grc_ai_gov.ai_risk_and_compliance_business_user\] | The ​AI Risk and Compliance User can perform the following tasks: * Create AI case on the Employee Center. * Work on the assigned tasks. * Perform control attestations. {#roles-installed-with-ai-risk-and-compliance__ul_fj4_hnm_s2c} | ​ * sn_grc_workspace.assessment_template_configuration_reader * sn_smart_asmt.actor * sn_grc_workspace.user * sn_smart_asmt.assessment_reader * sn_risk_advanced.risk_asmt_project_reader {#roles-installed-with-ai-risk-and-compliance__ul_bxx_21n_s2c} Note: For more information on AI Control Tower roles, see [AI Control Tower roles](https://www.servicenow.com/docs/access?context=roles-installed-with-ai-control-tower&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). |
| AI Risk and Compliance Reader \[sn_grc_ai_gov.ai_risk_and_compliance_reader\] | ​The AI Risk and Compliance Reader can have read access to the AI systems and AI impact assessments. | * sn_grc_workspace.user * sn_grc_workspace.state_model_reader {#roles-installed-with-ai-risk-and-compliance__ul_rff_m1n_s2c} |
| AI System Reader \[sn_grc_ai_gov.ai_risk_and_compliance_ai_system_reader\] | ​The AI System Reader can have read access to the AI systems on AI Control Tower workspace and AI Risk and Compliance workspace.​ | NA​ |
| AI Case Business User \[sn_ai_case_mgmt.ai_case_business_user\] | The AI Case Business User can create ​AI case and AI inquiry on the Employee Center. | sn_grc_case_mgmt.grc_case_business_user​ |
| AI Case Analyst \[sn_ai_case_mgmt.ai_case_analyst\] | The AI Case Analyst can review the AI cases and AI inquiries assigned to them in the system and perform the following tasks only on the assigned records: * Identify and manage impacted and related areas such as policies, regulations, and enterprise-wide compliance risks. * Identify and manage issues related to impacted areas to eliminate the root causes. {#roles-installed-with-ai-risk-and-compliance__ul_yqd_fds_4gc} | * sn_grc_case_mgmt.grc_case_analyst * sn_ai_case_mgmt.ai_case_business_user {#roles-installed-with-ai-risk-and-compliance__ul_ibq_mds_4gc} |
| AI Case Manager \[sn_ai_case_mgmt.ai_case_manager\] | The AI Case Manager can review all the AI cases, AI inquiries, and its associated information. | * sn_ai_case_mgmt.ai_case_analyst * sn_grc_case_mgmt.grc_case_manager {#roles-installed-with-ai-risk-and-compliance__ul_lwn_4ds_4gc} |
| AI Case Admin \[sn_ai_case_mgmt.ai_case_admin\] | The AI Case Admin can manage type profiles to segregate AI cases. They can set up assignment rules and delete AI cases. | * sn_grc_case_mgmt.grc_case_admin * sn_ai_case_mgmt.ai_case_manager {#roles-installed-with-ai-risk-and-compliance__ul_d33_qds_4gc} |
| AI Risk and Compliance AI Agent User \[sn_airc_gen_ai.airc_ai_agent_user\] | The AI Risk and Compliance Agent User can report issues and execute and orchestrate the AI agents as part of the lifecycle. The user can perform the following tasks: * Report a GRC issue. * Perform issue summarization. * Perform risk assessment summarization * Respond to smart assessments with Now Assist * Perform common control objective creation * Act on recommendation for similar control objectives {#roles-installed-with-ai-risk-and-compliance__ul_wmy_tzs_rjc} Note: This role must be manually assigned to an user. | * sn_airc_gen_ai.airc_ai_user * now_assist_panel_user * sn_grc_genai.issue_ai_agent_user {#roles-installed-with-ai-risk-and-compliance__ul_icd_rys_rjc} Note: This role is applicable only for AICT Foundation. |
| AI Risk and Compliance AI User \[sn_airc_gen_ai.airc_ai_user\] | The AI Risk and Compliance User can execute GenAI skills for the following tasks: * Perform issue summarization. * Perform risk assessment summarization * Respond to smart assessments with Now Assist * Perform common control objective creation * Act on recommendation for similar control objectives {#roles-installed-with-ai-risk-and-compliance__ul_xdh_cys_rjc} Note: This role must be manually assigned to an user. | * sn_grc_sharegenai.compliance_library_gen_ai_user. * sn_grc_genai.issue_user * sn_grc_sharegenai.risk_asmt_user {#roles-installed-with-ai-risk-and-compliance__ul_wvy_sys_rjc} Note: This role is applicable only for AICT Foundation. |
[Table 1. Roles and their descriptions]

{#roles-installed-with-ai-risk-and-compliance__table_m2t_czq_mqb}