SBA · SBA-36 · record R3192

AI Resolution Notes Generation

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2025-12-12 (day precision)Source: 12/12/2025 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

Formal closing notes for security incidents take analysts 15–30 minutes to manually draft at incident closure, diverting time from active threat response and creating documentation backlogs.

Expected benefits

Automated drafting of formal resolution notes allows analysts to review and approve rather than write from scratch, accelerating incident closure and freeing analyst time for active defense.

System outputs

AI-generated draft formal closing and resolution notes for completed security incidents, including structured documentation of root cause, actions taken, and resolution status for analyst review and approval.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): ServiceNow Security Incident Response (SIR)
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): ServiceNow, Inc.
Vendors (standardized): ServiceNow

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: ServiceNow platform incident records, resolution data, and historical closure notes. Commercial vendor-managed AI models.
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in progressSource: b) In-progress

AI impact assessmentReported in progressSource: b) In-progress

Independent reviewReported in progressSource: d) In-progress

Ongoing monitoringReported in progressSource: b) Development of monitoring protocols is in-progress

Operator trainingReported in progressSource: b) Establishment of sufficient and periodic training is in-progress

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in progressSource: Planning includes direct usability testing with SOC analysts during pilot phase, feedback collection on note accuracy and completeness, and iterative refinement of AI output quality.Flag: free-text answer

Potential impacts and how they were identified

Impact assessment in progress. Primary risks include inaccurate or incomplete resolution documentation. Mitigated by mandatory human review and approval before notes are finalized. Identified through vendor documentation review and security operations workflow analysis.