--- sourceDocument: Brazil Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Govern AI assets # Governing AI assets {#ariaid-title1} Release version: Brazil Updated October 28, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Governing AI assets ServiceNow's AI Control Tower enables comprehensive governance of AI assets across their life cycle, integrating risk, compliance, security, and privacy oversight. This governance is crucial for enterprises deploying AI at scale to address regulatory, operational, security, privacy, and reputational risks. The platform consolidates governance functions---Risk and Compliance, Security and Privacy, and Policies---providing a unified view while allowing specialized teams to manage their domains using dedicated tools. Show full answer Show less ## Managing AI Risk and Compliance AI Control Tower, in conjunction with AI Risk and Compliance, helps organizations monitor and manage AI asset compliance with regulations and internal policies. It offers: * Visibility into regulatory classifications, compliance posture, and aggregated risk scores for AI systems, models, and datasets. * Portfolio-level and individual asset views tailored to different roles, such as AI asset owners and risk teams. * Risk heat maps and compliance scores to quickly assess inherent and residual risks alongside control effectiveness. * Support for priority regulatory frameworks and custom organizational requirements. * Structured workflows via cases and inquiries to investigate and remediate governance concerns. Integration requires installing specific ServiceNow Store applications and plugins, with additional plugins supporting governance of ServiceNow AI assets like Now Assist. ## Securing AI Assets and Managing Privacy The Security and Privacy area of AI Control Tower focuses on: * Monitoring access issues that can disrupt AI workflows. * Identifying privileged AI agents to enforce least-privilege principles. * Detecting dormant AI agents retaining permissions to prompt reviews. * Visualizing agent access relationships to evaluate security impact. * Assessing AI asset security posture with composite security scores. * Integrating with Data Privacy functionality to track sensitive data detection and anonymization in AI interactions. For organizations using Now Assist, AI Insights summarizes security posture and highlights areas needing remediation, leveraging a dedicated security summarizer skill. ## Controlling AI Asset Usage with Policies AI Control Tower enables AI stewards to create automated policies that enforce governance rules consistently, reducing manual response efforts. Supported policy types include: * **Threat Response:** Automatically containing AI agents upon detecting defined threat conditions. * **Explicit Block:** Prohibiting specific users, departments, or all users from accessing certain AI agents, models, or domains. * **Arc policies:** Regulating ServiceNow Arc actions on user devices, including requiring user approvals for selected actions. These policies empower organizations to proactively manage AI asset risks and ensure compliance with governance standards. Govern AI assets across the life cycle with integrated risk, compliance, security, and privacy oversight in AI Control Tower. ## Governance overview {#aict-governing-ai-assets__overview} Deploying AI at enterprise scale introduces regulatory, operational, security, privacy, and reputational risks. Regulations and frameworks in this space require organizations to demonstrate that AI systems are assessed, monitored, and controlled. Governance also addresses operational and security risks such as biased outputs, unauthorized data access, privileged agents operating without oversight, and inactive systems that retain active permissions. The Govern area in AI Control Tower brings together Risk and Compliance, Security and Privacy, and Policies to support end-to-end AI governance. These areas work alongside life-cycle management and approval workflows to support end-to-end AI governance. Different teams manage each governance area by using their respective tools, while AI Control Tower provides a unified view of governance information for AI assets. Risk and Compliance provides visibility into regulatory classification, compliance posture, risk, assessments, and related governance records. Security and Privacy provides visibility into access concerns, privileged and dormant AI agents, AI asset security posture, and sensitive data protection. Policies provide automated enforcement, such as containing an AI agent when a threat is detected or blocking an AI agent, model, or domain from being used. For more information about how AI Control Tower and AI Risk and Compliance work together across the AI life cycle, see [AI governance life cycle](https://www.servicenow.com/docs/access?context=ai-gov-lifecycle&version=brazil&pubname=brazil-governance-risk-compliance&ft:locale=en-US). ## Managing AI risk and compliance {#aict-governing-ai-assets__risk-compliance} Depending on your role, you can engage with AI Control Tower and AI Risk and Compliance in different ways. AI asset owners typically use individual AI asset records to review risk posture, compliance posture, and related governance records. AI stewards and risk and compliance teams use portfolio-level views, assessments, and cases to monitor governance posture, identify gaps, and initiate remediation. The Risk and Compliance area in AI Control Tower provides visibility into how AI assets align with organizational policies and regulatory requirements. Summarized views of regulatory risk classification, compliance posture, compliance score, and aggregated risk score help governance teams evaluate AI risk without manually consolidating information from multiple systems. Regulatory risk classification applies to AI systems, AI models, and datasets. Assessments determine whether an asset has a high, medium, low, or unacceptable regulatory risk classification by evaluating its potential impact across multiple dimensions. Compliance is tracked against authority documents and organizational policies. AI Risk and Compliance includes built-in support for priority regulatory frameworks and supports organization-specific requirements. The Risk posture section in AI Control Tower groups AI assets by aggregated risk score and displays a risk heat map. The heat map plots AI assets by inherent or residual risk level against control effectiveness. You can switch between inherent and residual risk views. The Risk and Compliance page in the Govern area provides the following information: * Compliance score: Percentage of controls in a compliant state across mapped frameworks. * Regulatory risk classification: Distribution of AI assets by regulatory risk level. * Compliance posture for priority frameworks: Compliant and noncompliant control counts for the two highest-priority frameworks. * Top recommendations: High-priority governance work, such as overdue life-cycle tasks and AI asset issues that require review. {#aict-governing-ai-assets__ul_nnc_jlh_zjc} For supported AI assets in the AI asset inventory, the Risk \& Compliance tab provides governance information scoped to the selected asset. This information includes regulatory risk classification, compliance score, aggregated risk score, compliance posture for priority frameworks, and a risk heat map. The Governance section on the same tab provides access to assessments, risks, controls, attestations, issues, and policy exceptions associated with the asset. AI cases and inquiries provide structured workflows for investigating and resolving governance concerns. Teams can use cases to track violations, risks, or compliance gaps through investigation and remediation. Inquiries support compliance-related requests for clarification. For more information about risk assessment workflows, compliance framework configuration, and governance case management, see [AI Risk and Compliance](https://www.servicenow.com/docs/access?context=ai-risk-and-compliance&version=brazil&pubname=brazil-governance-risk-compliance&ft:locale=en-US). Note: To use AI Risk and Compliance with AI Control Tower, install the required applications from the ServiceNow Store and activate the required plugins. AI Risk and Compliance can be installed as a standalone application from the ServiceNow Store, but life-cycle-driven governance requires integration with AI Control Tower. AI Control Tower is used to register AI systems, models, and datasets and to manage life-cycle progression that triggers risk and compliance assessments, governance tasks, and case workflows. Some AI risk and governance capabilities depend on additional plugins. Governance of ServiceNow AI assets with Now Assist requires the AI Risk and Asset Management for Now Assist plugin, which depends on integration between AI Risk and Compliance and AI Control Tower, and AI Asset Management. In new IRM deployments, the IRM Standard plugin is required to make AI intake request forms available for submitting AI systems, models, and datasets for governance and risk evaluation. ## Securing AI assets and managing privacy {#aict-governing-ai-assets__security-privacy} The security area covers user access, data protection, and autonomous systems and agents that hold permissions, execute workflows, and interact with external tools without direct human involvement. AI Control Tower provides visibility into the following dimensions of AI security: * Access issues: Identifies AI agents that experience access-related errors that can prevent workflows from completing. * Privileged AI agents: Identifies agents with elevated permissions, such as admin or security admin, to support least-privilege reviews. * Dormant AI systems: Identifies agents that have been inactive for more than 90 days and retain permissions, and generates review tasks for asset owners. * Access map: Visualizes relationships between ServiceNow agents, agentic workflows, and the tools that they use to support access analysis and impact assessment. * AI asset security score: Provides a composite view of AI asset security posture based on access issues, privileged agents, guardrails, and dormant systems, with details for individual assets. {#aict-governing-ai-assets__ul_kwy_dyv_bjc} For privacy oversight, AI Control Tower integrates with the Data Privacy plugin to display sensitive data detection and anonymization activity. The Security and Privacy area shows the enabled data patterns used to detect and anonymize sensitive information in AI prompts. For organizations using Now Assist, ServiceNow AI Insights summarizes observations across the AI security posture, including areas that require attention and remediation actions. This capability requires the Now Assist AICT Security Posture Summarizer skill. ## Controlling AI asset usage with policies {#aict-governing-ai-assets__policies} AI asset usage policies let you define a governance rule once and have AI Control Tower enforce it automatically, instead of responding to each AI agent, model, or domain case by case. AI stewards create and manage policies in the Govern area. AI Control Tower supports the following types of policies: * Threat Response: Contains an AI agent automatically when a detected threat matches the conditions that you define. * Explicit Block: Stops a person, a department, or everyone from using a specific AI agent, model, or domain. * Arc policies: Control what ServiceNow Arc can do on your users' devices, including which actions wait for a person's approval. {#aict-governing-ai-assets__ul_gov_policy_types} For more information about managing policies and reviewing enforcement activity, see [Controlling AI asset usage in AI Control Tower](https://www.servicenow.com/docs/nwz0uWCGkPLBpaunLo1RTQ "Create AI asset usage policies that automatically respond to detected AI threats or block an AI agent, domain, or model outright.").