AI Governance - Systems Page

This guide shows how to manage and audit tracked AI systems end-to-end—discovering, filtering, reviewing, and documenting their controls, risks, vendor responses, and supporting files. It explains generating and managing vendor questionnaires, conducting formal reviews, preserving history/attachments, and when to archive systems. Use it to streamline governance tasks, keep an auditable trail, and ensure consistent risk-based review processes.

[CLICK HERE to watch a video for this page!](https://academy.finosec.com/hubfs/Demo%20Videos/AI%20Governance/AI%20Governance%20-%20Systems%20Page.mp4)

System Map

You must first use the "Uses AI" checkbox for a system on the System Map for the system to be included in the AI governance scope.

From the AI Governance module, click the Systems page.

Overview

Review the summary cards displayed across the top of the Systems page. These metrics show residual risk breakdown, assessment statuses, and total assessed systems.

Review the information available in each system row of the AI System Assessments table. Each entry includes vendor details, data sources, control scores, and review dates.

Use the Search field to locate AI systems by name.

Filter the systems list using the Type, Data Access, Harm Potential, Residual Risk, and Status dropdowns.

Click Clear Filters to remove all applied filter criteria.

Click the Archive button in the row of a system to remove it from active scope. Archiving retains all historical answers, approvals, and attached files.

Click the Archive button to confirm archiving the system. Archiving removes the system from active views while retaining its historical answers, approvals, and files.

System Review

Click any system to open its detailed governance view, including controls and associated use cases.

The header displays the system name, completion status, assigned vendor, and the date it was last reviewed.

Click the Overview tab header to view system ownership and classification details. The expanded panel displays business owners, next review date, AI system type, and harm potential.

Click Vendor Contract to expand the vendor controls panel. Vendor contract controls require choosing Yes, No, or Not Applicable, which automatically applies to all system use cases.

AI Use Cases Tab

The AI Use Cases tab lists all active use cases associated with the system.

Click the Add Use Case button. Starting a new use case allows you to document another AI application within the system.

Vendor Questionnaire Tab

Click on the Vendor Questionnaires tab.

Click the section header to collapse/expand it. Opening a section displays each question, its answer, and a comment box.

You can answer the questions from the due diligence documentation the vendor provided, or you can send them a questionnaire link.

Click the Generate Vendor Questionnaire button.

Label the recipient to help distinguish generated links within the system.

Click the Create link button to generate a unique URL and email text.

Click the Copy link button and paste it into an email to send it directly to your vendor point of contact.

Click the Deactivate link next to an active questionnaire link. Administrators can deactivate open links at any time to revoke external access.

Vendors do not need to login to the platform. They have access to all the questions, ability to answer Yes, No, or N/A and provide optional explanatory comments.

AI Governance Administrators will receive email notification when a vendor submits answers to a questionnaire.

Click the Review answers link to inspect the vendor's submitted responses.

Click the Apply vendor answers button to update system records.

Click the History tab to view past questionnaire submissions.

Attachments Tab

Click the Attachments tab to access supporting files.

Click the upload region to attach a file to the system. Files can be uploaded by clicking to browse or dragging them into the drop target.

You can archive or delete attachments as needed.

Notes Tab

Click the Notes tab to review or add entries.

Click the Create Note button to post the written entry. Saving the note attaches the current timestamp and author name to the record.

Reviews Tab

Click on the Reviews tab.

Any previous reviews are listed.

Click the New Review button. Starting a review initiates a new governance cycle for the selected system.

The system and its use cases remain read-only while a review is in progress, with the banner detailing required items.

Click the Open review button. Opening the review displays the active audit modal while locking the underlying system details into read-only mode.

Review the navigation tabs inside the review modal to access use cases, vendor questionnaires, attachments, and notes. These sections allow team members to approve specific use cases, complete questionnaires, and attach supporting documentation.

Once done, click the Mark Reviewed button to submit the system review. A mandatory review note must document what was checked and why the system was reviewed before an AI Governance admin can complete the action.

If needed, you can click the Cancel review link. Canceling a review logs the review status as cancelled while preserving the system's previous review date.

[Click here to return to AI Governance Overview Guide.](https://scribehow.com/o/r51ExDipRwSDgjjMi6O7uw/page/AI_Governance__Overview_Guide__Vx_h5G80SPeaI2ogbAJv1A)