---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Create a policy exception

# Create a policy exception {#ariaid-title1}

Release version: Australia  
Updated July 16, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Request an approved, time-bound deviation from a policy or control objective that
applies to an AI asset, supported by a justification and a risk assessment.

## Before you begin

Role required: sn_ai_governance.ai_steward or sn_ai_asset_mgmt.ai_asset_owner

## About this task

A policy exception documents why an AI asset can't currently meet a control objective and requests approval to operate outside that control for a defined period. The exception routes to an approver, who reviews your
justification and risk assessment before approving or rejecting the request.

## Procedure

1. Navigate to AllAI Control TowerHomeActivity CenterWorkAssigned to you.
2. Select the Policy exceptions sub-tab.
3. Select New.
4. Fill in the fields that describe the exception.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-details__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the policy exception. |
   | Requester | User requesting the exception. Defaults to you. |
   | State | Current state of the exception. Defaults to New. |
   | Reason | Reason for requesting the exception. |
   | Priority | Priority of the exception request. |
   | Justification | Justification for requesting the exception. |
   [Table 1. Policy exception fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-details}  
   Note:  
   The Substate field populates automatically as the exception moves through review, such as Under review or Pending risk assessment, and isn't set when you create the exception.
5. In the Source section, identify the policy or control the exception applies to.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-source__entry__2}

   | Field | Description |
   |-|-|
   | Source type | Type of source the exception applies to. |
   | Policy | Policy that the exception applies to. |
   | Control objective | Control objective that the exception applies to. When Source type is set to Control objective, select the control objective first, then select the specific controls from the impacted controls list. |
   [Table 2. Source fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-source}
6. In the Schedule section, set how long the exception is valid for.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-schedule__entry__2}

   | Field | Description |
   |-|-|
   | Valid from | Date and time the exception takes effect. |
   | Valid to | Date and time the exception expires. |
   [Table 3. Schedule fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-schedule}  
   Note:  
   The Duration field is calculated automatically from the Valid from and Valid to dates and isn't set directly.
7. In the Assignment section, specify who should review the exception.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-assignment__entry__2}

   | Field | Description |
   |-|-|
   | Watch list | Users who want to stay informed about the exception. |
   | Approval group | Group responsible for approving the exception. |
   | Approver | User responsible for approving the exception. |
   [Table 4. Assignment fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-assignment}
8. In the Risk assessment section, document the risk that the exception introduces.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-risk__entry__2}

   | Field | Description |
   |-|-|
   | Method | Method used to determine the risk rating. |
   | Risk rating | Risk rating assigned to the exception. |
   | Risk description | Description of the risk associated with the exception. |
   | Analysis of risk and impact | Analysis of the risk and its potential impact. |
   | Risk mitigation plan | Plan for mitigating the risk while the exception is in effect. |
   [Table 5. Risk assessment fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-risk}
9. In the Confidentiality section, restrict visibility of the exception if needed.  
   {#ac-create-policy-exception__table_ac-create-policy-exception-confidentiality__entry__2}

   | Field | Description |
   |-|-|
   | Confidential | Restricts visibility of the exception to confidential users and members of confidential user groups. |
   | Allowed users | Users who can access the exception if it's marked confidential. |
   | Allowed groups | Groups who can access the exception if it's marked confidential. |
   [Table 6. Confidentiality fields]

   {#ac-create-policy-exception__table_ac-create-policy-exception-confidentiality}
10. In the Comments section, add any supporting notes.  
    {#ac-create-policy-exception__table_ac-create-policy-exception-comments__entry__2}

    | Field | Description |
    |-|-|
    | Work notes (Private) | Internal notes about the exception that aren't visible to the customer. |
    | Additional comments (Customer visible) | Comments about the exception that are visible to the customer. |
    [Table 7. Comments fields]

    {#ac-create-policy-exception__table_ac-create-policy-exception-comments}
11. In the Settings section, specify the functional domain that the exception belongs to.  
    {#ac-create-policy-exception__table_ac-create-policy-exception-settings__entry__2}

    | Field | Description |
    |-|-|
    | Functional domain | Functional domain that the exception belongs to, such as AI Risk and Compliance or IT risk and compliance. |
    [Table 8. Settings fields]

    {#ac-create-policy-exception__table_ac-create-policy-exception-settings}
12. Save the policy exception.
{#ac-create-policy-exception__steps_create}

## Result

The policy exception is created and routes to the assigned approver for review.
The exception appears in the Policy exceptions sub-tab,
where you can track its status.

*[\>]: and then