{"slug":"us-nist-ai-rmf-manage","id":"AIPT-OBL-0115","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0115","title":"Prioritise, respond to and monitor AI risks (Manage)","short_title":"Manage function","category":"risk_management","summary":"Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.\n","practical_action":"Maintain a risk-treatment plan and an incident and monitoring log per system.","is_binding":false,"applies_from":null,"section":"Part 2: Core","source_reference":"MANAGE function","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["finance_and_credit","generative_ai"],"applicability":[{"description":"Voluntary; any organisation adopting the framework.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Risk treatment and monitoring plan","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clauses 8 and 10","note":"Operation and improvement.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"ai-risk-assessment","title":"AI risk assessment and lifecycle risk register","kind":"process","relationship":"satisfies","note":"Risk treatment planning and resource allocation for mapped and measured risks.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-risk-assessment"},{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"supports","note":"Incident response and communication outcomes.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"},{"slug":"third-party-ai-due-diligence","title":"Vendor and third-party AI due diligence","kind":"process","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence"}],"url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage","policy":{"slug":"us-nist-ai-rmf","title":"NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile","status":"voluntary_standard","jurisdiction":"us","url":"https://aipolicytracker.org/policies/us-nist-ai-rmf"}}