--- sourceDocument: Australia Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences Release : - australia ft:locale : - en-US ft:publication_title : - Australia Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Regulatory risk classification # Classifying AI assets by regulatory risk {#ariaid-title1} Release version: Australia Updated October 5, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Classifying AI assets by regulatory risk Regulatory risk classification assigns AI assets a risk rating such as Low or High, based on scores from risk assessments. This classification reflects the inherent risk level an AI asset poses and helps group AI systems, models, and datasets into rating bands displayed on the Regulatory risk classification donut chart within the AI Risk and Compliance application. Understanding this classification is essential for managing AI assets according to their regulatory risk. Show full answer Show less ## How Automated Classification Works The automated classification uses the Automated risk classification for AI system RAM methodology, which scores six factors derived from the Use and purpose responses. Each factor's points are summed, and the highest factor score becomes the inherent risk score for the asset. If any factor scores 9000 points or more, it receives the highest rating band: Unacceptable. Without Use and purpose data, classification defaults to To be determined. Because automation occurs without human assessment, it is important to review the classification and input data regularly to ensure accuracy. ## Practical Example For instance, a customer service chatbot uses generated content (50 points) and profile/account data (9000 points). The Data \& Model Risks factor sums these points to 9050, assigning a score of 10, which places the chatbot in the Unacceptable risk band. ## When and How Classification Is Applied * The system calculates classification upon AI asset creation and updates it after the asset reaches the Managed state when Use and purpose data or regulatory classification changes. * Automated classification only runs when a valid, published RAM is specified, and the Use and purpose record links to the AI asset's governance details record. * If conditions are unmet, classification remains To be determined. * The system runs an automated risk assessment in the background, stores the inherent rating on the asset's governance record, and updates the related entity's Risk Classification field only if the rating changes. * Open classification assessments can be canceled automatically if the AI asset is deactivated (Active field set to false), preventing outdated or irrelevant classifications. ## Distinction from Aggregated Inherent Risk The regulatory risk classification is distinct from the aggregated inherent risk rating that risk rollups calculate. The classification results from the classification RAM, while the aggregated inherent rating comes from risk assessments of individual risks associated with the AI system. This distinction helps customers understand different layers of risk evaluation within ServiceNow's AI Risk and Compliance framework. Regulatory risk classification places an AI asset in a risk rating, such as Low or High, based on the score from a risk assessment. A regulatory risk classification is the inherent rating that a risk assessment produces for an AI asset. The AI Risk and Compliance application uses the classification to group AI assets, such as AI systems, AI models, and datasets, into rating bands on the Regulatory risk classification donut chart. For more information about how to read the chart, see [Reviewing regulatory classification and compliance status](https://www.servicenow.com/docs/1ElNg83gUDoHaweD6Swwmg "Review regulatory risk classification and compliance posture to understand how AI assets align with configured governance expectations."). For the risk assessment methodologies (RAMs), formulas, risk ratings, and factors, see [Regulatory risk classification reference](https://www.servicenow.com/docs/x8WlcW7P0abn8zU_BvFM3A "Risk assessment methodologies, formulas, risk ratings, and records that determine the regulatory risk classification of an AI asset."). ## How automated classification works {#gov-airc-regulatory-classification__section_automated_process} The Automated risk classification for AI system RAM produces the classification without an assessor. For the classification that an assessor produces, see [Risk rating calculation](https://www.servicenow.com/docs/78FrL2BTwvbDH0UcwCa7Dw "The inherent, control effectiveness, and residual ratings of an AI system come from risk assessment scores that a risk rollup aggregates."). The automated classification scores six factors from the Use and purpose responses. Each response option carries a point value, and each factor adds up the points of the fields that it uses. The inherent score is the highest of the six factor scores. The system converts the score to a rating. A factor whose points total is 9000 or more scores 10. That score places the asset in the top rating band, Unacceptable. If an asset has no Use and purpose record, every factor scores 0 and the classification is To be determined. Warning: The system generates the automated classification without an assessor. The classification can be inaccurate or incomplete, for example, when the Use and purpose responses are out of date. Review the classification and the responses that produced it before you rely on it. ## Example: Customer service chatbot {#gov-airc-regulatory-classification__example_automated} A support team registers a customer service chatbot as an AI system. The chatbot drafts replies to customer emails, and it uses past support tickets that contain customer names and account details. In the Use and purpose section, the team answers the questions about the chatbot: * For Type of output produced, they select Generated Content, which carries 50 points. * For Data used by the system, they select Profile or Account Data, which carries 9000 points. {#gov-airc-regulatory-classification__ul_n2k_ft5_tkc} The Data \& Model Risks factor adds these points: `50 + 9000 = 9050`. Because the total is 9000 or more, the factor score is 10, regardless of the other five factors. The highest factor score becomes the inherent score, so the chatbot's inherent score is 10 and its classification is Unacceptable. ## When and how the classification is applied {#gov-airc-regulatory-classification__section_lifecycle} The system calculates the classification when the asset is created. After the asset moves to the Managed state, the system revises the classification when the Use and purpose fields or the regulatory risk classification are updated. Automated classification runs only when all of the following are true: * The sn_grc_ai_gov.ai_system_automated_risk_classification_asmt_ram property specifies a RAM. * The specified RAM is published. * The Use and purpose record is linked to the governance details record of an AI asset. {#gov-airc-regulatory-classification__ul_conditions} If a condition isn't met, the system doesn't create a classification assessment and the classification remains To be determined. When the conditions are met, the system completes these actions: 1. Runs the automated risk assessment subflow in the background. 2. Stores the resulting inherent rating on the governance details record of the asset. 3. Copies the inherent rating to the Risk Classification field of the related entity of the AI system. The system updates the related entity only when the rating changes. {#gov-airc-regulatory-classification__ol_assignment} For unmanaged AI assets, the classification is based on the Use and purpose data on the governance details record of the asset. The system can cancel a classification assessment that is still open for the related entities of an AI asset. An assessment is open when its status isn't Completed, Archived, or Cancelled. A canceled assessment doesn't produce a classification. The system doesn't change assessments that are completed, archived, or canceled. The system cancels open classification assessments when the AI asset's Active field changes to false, such as when you retire or cancel the asset. ## Classification and aggregated inherent risk {#gov-airc-regulatory-classification__section_distinct} The regulatory risk classification of an AI asset is separate from the aggregated inherent risk rating that the risk rollup calculates for an AI system. The classification comes from the classification RAM. The aggregated inherent rating comes from the risk assessments of the risks that belong to the AI system. For the aggregated rating, see Risk rating calculation.