Buy me a coffee
Eve McGivern

← Tools

Platform guide: AI system intake and risk tiering

Download Word (.docx)

Where an AI inventory and AI risk assessments live in ServiceNow, and how Flexera One can surface AI software and SaaS usage. Where no source names a module, table, or field, that is stated as a gap rather than guessed.

ServiceNow: AI governance and Integrated Risk Management (IRM)

ServiceNow's risk and compliance work sits in Integrated Risk Management (IRM), its platform for unifying governance, risk, and compliance processes. On top of that, ServiceNow has named a specific governance layer for AI: AI Control Tower (also called the "AI Inventory and Control Tower," AICT, in a ServiceNow-employee community post), which ServiceNow's own community documentation describes as a single system of record for AI governance, holding the policies, roles, and approvals that AI use cases pass through as they get registered, classified, assessed, approved, and then monitored. That registration-to-monitoring flow is the closest confirmed analog to this method's intake-to-inventory steps: a use case is registered (this method's restatement and inventory record), classified and assessed (this method's tiering), approved (this method's approval decision), and then monitored (this method's re-review date).

ServiceNow's own community writeup maps AI Control Tower's stages directly onto the NIST AI RMF's four functions this method also cites: intake and stakeholder mapping across domains such as IT, HR, Finance, and Security correspond to Map; assessment workflows and evidence collection correspond to Measure; centralizing policy, roles, and approvals corresponds to Govern; and linking identified risks to owners and remediation workflows in a closed loop corresponds to Manage.

AI Control Tower has a documented three-layer data model, confirmed by downloading raw page HTML from ServiceNow Community content and checking it for literal table-name strings — a stronger form of confirmation than a rendered-page read, though these table names come from Community content rather than an official field-level reference page:

Separately, ServiceNow's own official documentation names UI-level objects in AI Control Tower's home page: an "AI asset inventory" tab, and a "Risk and compliance" tab that classifies AI systems, models, and datasets into High, Medium, Low, and Unacceptable risk categories, tracked against the NIST AI RMF and the EU AI Act — confirming risk tiering as a real, named UI surface, consistent with (but not the same confirmation strength as) the sn_ai_governance_asset_governance_details table above.

Within IRM, AI-specific assessment work is increasingly handled by ServiceNow Otto for IRM (the current name for what earlier release material called "Now Assist for IRM," confirmed on a live docs page). Its documentation names two specific AI agents: a "Report a GRC issue" AI agent, which walks a user through reporting a governance, risk, or compliance issue and suggests relevant controls, entities, and policies before submission; and a Control Objective Change Agent, which lets a user review and update impacted control objectives against the latest citation details. Neither of these is an AI-intake-specific form. Treat AI Control Tower as the product surface this method's steps would run inside, and IRM's assessment and risk-register capabilities as the mechanism for this method's control list and risk-register entry.

ServiceNow's own IRM product page (servicenow.com/products/integrated-risk-management.html) and its AI Control Tower product page (servicenow.com/products/ai-control-tower.html) return connection errors to a direct, automated fetch, but both are readable through the Internet Archive's Wayback Machine, which holds snapshots from September 2026. A named AI Control Tower solution-brief PDF could not be retrieved by any method tried, including the Wayback Machine, which has no archived copy of it; ServiceNow's own press release describing the same AI Control Tower capabilities (Discover, Observe, Govern, Secure, Measure), issued through its investor-relations newswire, is a reachable substitute for the solution brief's content.

Flexera One: surfacing AI software and SaaS usage

Flexera merged its own and Snow's SaaS management products into a single Flexera One SaaS Management offering, which Flexera's press material frames explicitly around shadow AI: unsanctioned or unlicensed AI tools in use without governance visibility. Discovery runs through what Flexera's press release calls a Comprehensive Discovery Engine, combining Browser and Financial Discovery, an installed Agent, API connectors, CASB integration, and SSO connections — the same multi-source approach Flexera documents for its general SaaS and hybrid IT discovery, extended here to flag AI-powered applications and employee AI tool usage alongside ordinary SaaS.

Flexera's own SaaS Management page describes this as helping an organization take control of AI usage by discovering where AI is used, assessing risk and cost, and checking usage against company policy — which is the discovery-and-risk-flagging step this method's supplier-and-provider identification step (checklist item 6) would draw on before intake proceeds. Separately, Flexera's current (2026) product line — Flexera One AI Cost Management (covering AI Apps & Agents, AI Models & Tokenomics, AI Data Cloud Management, AI Compute Management), SaaS Management, and Technopedia — provides AI discovery, spend tracking, and usage-policy-alignment features. Its AI Cost Management plan-comparison table lists a generic feature row, "Policy and governance," described as enforcing guardrails, approvals, and compliance — a feature category, not a named field or record. A generic, non-AI-specific approval-workflow engine exists separately in Flexera One's Commander module (for IT service and change requests); nothing in Flexera's documentation or marketing names an AI-specific use of that engine for AI intake. No Flexera product names a specific table, field, or record for an AI intake decision, an approval, or a risk-tier classification; Flexera's own public-sector guidance describes intake and risk-review processes as something an organization must build, not a feature Flexera ships. This method's inventory record (AI inventory record template) has no confirmed Flexera equivalent.

What remains unconfirmed

Sources checked

Two pages named in earlier research were unreachable to a direct fetch but readable via an archived snapshot: ServiceNow's IRM product page and its AI Control Tower product page (both servicenow.com/products/..., connection errors on direct fetch; readable via the Wayback Machine snapshots cited above). The named AI Control Tower solution-brief PDF could not be retrieved by any method tried and has no Wayback Machine snapshot. Everything else above comes from a page that loaded directly.