---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Terminology

# Risk and Compliance terminology {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Key terms used across Risk and Compliance views in AI Control Tower, including compliance score and regulatory risk classification.

## Regulatory risk classification

Regulatory risk classification groups AI assets by acceptability or risk category, such as unacceptable, high, medium, and low. At the asset level, classification can remain undetermined until the relevant governance data is available. For more information, see [Classifying AI assets by regulatory risk](https://www.servicenow.com/docs/sClljCVF67CPXRFXGJUFxg "Regulatory risk classification places an AI asset in a risk rating, such as Low or High, based on the score from a risk assessment.").

## Compliance score and compliance posture

Compliance score represents visible compliance posture for the selected scope. Framework-specific posture views show how governance information is presented for priority authority documents or policies and can surface issue indicators relevant to those frameworks. For more information, see [Compliance score calculation](https://www.servicenow.com/docs/eKknGglQ_7OqGhO52vPSHA "The compliance score of an AI system measures how well its controls are met, based on the scores of its active related entities.").

## Inherent risk, residual risk, and control effectiveness

Inherent risk describes the level of risk before control effectiveness is considered. Control effectiveness describes how well controls address the identified risk. Residual risk represents the level of risk that remains after control effectiveness is considered. For how these scores are calculated, see [Risk rating calculation](https://www.servicenow.com/docs/lJlD8HrrCxUDFyxd0TNUFA "The inherent, control effectiveness, and residual ratings of an AI system come from risk assessment scores that a risk rollup aggregates.").

## Risk heat map

Risk heat maps show how risk information is distributed across combinations of risk level and control effectiveness. These views help you understand where higher-risk conditions are associated with less effective controls. For more information, see [Reviewing AI risk posture](https://www.servicenow.com/docs/gDb48fnpUrgY6ZFNsRyjwA "Aggregated risk posture displays inherent risk, residual risk, and control effectiveness for AI assets.").

## Governance records

Asset-level Risk and Compliance views can surface related governance records for an AI system, including assessments, risks, controls, issues, policy exceptions, attestations, and similar governance artifacts that contribute to the
system's current posture. For the full list of record types, see [Governance record types](https://www.servicenow.com/docs/P~Xfa6go0UymL53BPe9~nA "Record types under the Governance section of an AI asset's Risk & Compliance tab in AI Control Tower, used to support governance review.").

## Incomplete states

Some Risk and Compliance views can display incomplete states such as To be determined, No data available, or zero-valued indicators. These states indicate that the relevant governance
information is not yet available for display in the selected context.