NIST AI RMF Manage Function: How to Manage AI Risks

The NIST AI RMF Manage function is where AI risk assessment becomes action. It takes the risks an organization has identified and measured, decides which ones matter most, and puts documented responses, monitoring, and recovery plans in place. Without it, a risk register is only a list.

MANAGE draws on the context established in MAP and the analysis produced in MEASURE, and it operates within the policies, roles, and risk tolerance set through GOVERN. According to the NIST AI RMF Core, MANAGE involves allocating risk resources to mapped and measured risks on a regular basis, as defined by the GOVERN function.

This article explains NIST AI RMF 1.0, published by NIST in January 2023 as NIST AI 100-1. In that version, MANAGE contains four categories:

1. MANAGE 1: prioritizing and responding to AI risks.

2. MANAGE 2: maximizing benefits and minimizing negative impacts.

3. MANAGE 3: managing risks and benefits from third parties.

4. MANAGE 4: documenting and monitoring risk treatments, response, recovery, and communication.

NIST has indicated that the framework will be revised. Readers should check the NIST AI Risk Management Framework page for the current version before relying on the category structure described here.

What Is the NIST AI RMF MANAGE Function?

The NIST AI RMF MANAGE function directs organizations to prioritize the AI risks they have mapped and measured, respond to them, and document those decisions. It also covers benefit and impact management, third-party risk, post-deployment monitoring, incident response, recovery, and communication for as long as a system is in use.

MANAGE is one of four functionsNIST AI RMF . Each has a distinct role:

• GOVERN sets the culture, policies, accountability, and risk tolerance that apply across the organization.

• MAP establishes context: intended purpose, users, settings, and the risks and impacts that could arise.

• MEASURE analyzes, assesses, benchmarks, and tracks those risks using quantitative, qualitative, or mixed methods.

• MANAGE uses the outputs of MAP and MEASURE to prioritize risks and act on them.

GOVERN sets the boundaries for all three functions. MANAGE acts on what MAP and MEASURE produce, and new findings can send teams back to either one.

NIST does not present these as a strict sequence. The AI RMF 1.0 publication describes GOVERN as a cross-cutting function that informs the other three, and notes that the functions can be applied iteratively across the AI lifecycle. In practice, MANAGE often sends teams back to MAP or MEASURE when new information appears.

Risk management also continues after deployment. Data drifts, users find unexpected ways to use a system, third-party models change, and new harms emerge. MANAGE expects organizations to keep monitoring, respond to incidents, and adjust treatments over time rather than treating approval at launch as the end of the process.

The framework is voluntary. Applying MANAGE does not by itself satisfy any law or regulation, although the documentation it produces can support an organization's wider legal and compliance work.

What Are the Four Categories of the NIST AI RMF MANAGE Function?

In AI RMF 1.0, MANAGE has four categories and 13 subcategories. The category descriptions below follow the NIST AI RMF Core (Table 4 in NIST AI 100-1).

MANAGE 1: Prioritize and Respond to AI Risks

MANAGE 1 turns assessment results into decisions. Its four subcategories ask organizations to:

• MANAGE 1.1: Determine whether the AI system achieves its intended purposes and stated objectives, and whether its development or deployment should proceed.

• MANAGE 1.2: Prioritize the treatment of documented AI risks based on impact, likelihood, and available resources or methods.

• MANAGE 1.3: Develop, plan, and document responses to the high-priority risks identified through MAP.

• MANAGE 1.4: Document negative residual risks to downstream acquirers of AI systems and to end users. NIST defines residual risk as the sum of all unmitigated risks.

MANAGE 1.1 matters because "do not proceed" is a legitimate outcome. If a system cannot meet its objectives within the organization's risk tolerance, the framework supports stopping or redesigning it.

Under MANAGE 1.3, NIST lists four response options:

• Mitigate: reduce the likelihood or impact of a risk through technical, procedural, or organizational controls.

• Transfer: shift some of the consequences to another party, for example through contracts or insurance. Accountability for the system's effects does not disappear.

• Avoid: remove the activity or feature that creates the risk, or decide not to deploy.

• Accept: knowingly retain a risk that falls within risk tolerance, with the decision documented.

None of these options removes all risk. Some risk usually remains after treatment, which is why MANAGE 1.4 requires residual risks to be recorded and communicated.

MANAGE 2: Maximize AI Benefits and Minimize Negative Impacts

MANAGE 2 looks at the resources and mechanisms that keep a system worthwhile and controllable over time:

• MANAGE 2.1: Consider the resources required to manage AI risks, along with viable non-AI alternative systems, approaches, or methods, to reduce the magnitude or likelihood of potential impacts.

• MANAGE 2.2: Put mechanisms in place and apply them to sustain the value of deployed AI systems.

• MANAGE 2.3: Follow procedures to respond to and recover from a previously unknown risk when it is identified.

• MANAGE 2.4: Put mechanisms in place, and assign and communicate responsibilities, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.

Two points stand out. MANAGE 2.1 asks teams to consider whether a non-AI approach would do the job with less risk. MANAGE 2.4 requires a planned way to switch a system off, with named owners, before it is needed.

MANAGE 3: Manage Third-Party AI Risks

Most AI systems depend on external components: pretrained models, APIs, datasets, libraries, and cloud services. MANAGE 3 has two subcategories:

• MANAGE 3.1: Regularly monitor AI risks and benefits from third-party resources, and apply and document risk controls.

• MANAGE 3.2: Monitor pretrained models used for development as part of regular AI system monitoring and maintenance.

The framework does not prescribe a single vendor questionnaire or procurement process. Organizations choose controls that fit the dependency, such as contractual terms, documentation reviews, version tracking, or testing after a provider updates its model. MANAGE 3.2 makes clear that a pretrained model is not "set and forget": it stays inside the monitoring scope for as long as it is in use.

MANAGE 4: Monitor Risk Treatment and Incident Response

MANAGE 4 covers what happens after deployment:

• MANAGE 4.1: Implement post-deployment monitoring plans, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.

• MANAGE 4.2: Integrate measurable activities for continual improvement into AI system updates, including regular engagement with interested parties and relevant AI actors.

• MANAGE 4.3: Communicate incidents and errors to relevant AI actors, including affected communities, and follow and document processes for tracking, responding to, and recovering from them.

Monitoring improves the chance of catching problems, but it does not guarantee that every risk will be detected. That is why MANAGE 4 pairs monitoring with feedback channels, appeals, overrides, and documented recovery processes.

How to Apply the NIST AI RMF MANAGE Function

The five steps below are a practical workflow inspired by the MANAGE categories. They are not an official NIST sequence, and organizations can adapt the order, depth, and tools to their own context and risk tolerance.

1. Review AI Risk Assessment Findings

Start with the evidence you already have. Gather the outputs of your AI risk assessment: documented risks, impact assessments, intended use and known limitations, test and evaluation results, existing controls, and any monitoring data from systems already in production.

Check that the inputs are complete enough to act on. If the team has not yet worked through how to identify and map AI risks for the system's users and settings, MANAGE decisions will rest on a partial picture, and it is better to return to MAP or MEASURE first.

2. Prioritize Risks and Decide What to Do

MANAGE 1.2 names three factors for prioritization: impact, likelihood, and available resources or methods. Teams can weigh these against the organization's risk tolerance, as set through GOVERN, and against the consequences of proceeding at all.

NIST does not prescribe a scoring scale. Some organizations use qualitative tiers, others use matrices, and high-stakes uses often call for expert judgment alongside any score. Whatever method you choose, record the reasoning so others can review it. This step should also produce the MANAGE 1.1 decision: proceed, proceed with conditions, redesign, or stop.

3. Select and Document Risk Responses

For each high-priority risk, choose a response (mitigate, transfer, avoid, or accept) and record why. A useful treatment record names the owner, the controls or actions, the timeline, the evidence that will show whether the treatment is working, and the residual risk that remains.

Residual risks to downstream acquirers and end users deserve particular attention, since MANAGE 1.4 asks for them to be documented. This is also the point to confirm that the resources needed for treatment exist (MANAGE 2.1).

4. Monitor Systems and Prepare for Incidents

Define what you will monitor after deployment, how often, and who reviews it. Useful signals can include performance metrics, drift indicators, user complaints, appeals, human overrides, and incident reports.

Set escalation paths and recovery procedures in advance, including how and to whom incidents and errors will be communicated (MANAGE 4.3). Agree on the conditions under which a system should be restricted, superseded, or deactivated, and who has the authority to do it (MANAGE 2.4).

5. Review Third-Party Risks and Improve Controls

Track the external components the system relies on. Watch for provider model updates, changes to terms or data practices, deprecations, and incidents reported by the provider, and retest pretrained models after significant changes (MANAGE 3.1 and 3.2).

Then close the loop. Use monitoring results, incidents, and feedback to judge whether controls are effective and to feed measurable improvements into system updates (MANAGE 4.2). How often to reassess depends on the system, its risk context, and the evidence available. Teams that want to implement NIST AI RMF across a portfolio of systems usually find that this review cycle is where MANAGE becomes routine rather than a one-off exercise.

MANAGE Documentation Checklist: Evidence for Each Subcategory

NIST does not specify what evidence each MANAGE subcategory requires. The table below is a suggested starting point for teams and internal auditors, not an official NIST list. Scale it to the system's risk level and use whatever records your organization already keeps.

Applying MANAGE well depends on understanding how MANAGE connects to GOVERN, MAP, and MEASURE. For a structured walkthrough of the whole framework, AGC's NIST AI Risk Management Framework training offers a structured way to learn the framework as a whole.

NIST AI RMF MANAGE Example: Managing Risks in a Generative AI System

This is a hypothetical example for illustration. It does not describe a real organization, incident, or outcome.

A company uses a generative AI assistant, built on a third-party large language model, to draft replies for its customer-support team.

The risk. The assistant could produce inaccurate or inappropriate responses, such as wrong refund terms, invented policy details, or an unsuitable tone toward an upset customer. MAP identified the risk, and MEASURE testing showed it occurs often enough on billing and complaint queries to matter.

Assessment and priority. The team weighs the impact (financial loss for customers, complaints, and reputational harm) against likelihood and available resources. Billing and complaint drafts are rated high priority. Simple order-status replies are rated lower.

Responses. The company mitigates by requiring human review of every draft before sending and by grounding the assistant in approved policy content. It avoids part of the risk by restricting the assistant from answering legal or compensation questions, which are routed straight to staff. It accepts a small, documented risk of minor phrasing errors in low-stakes replies.

Residual risk. The team records that reviewers may miss subtle errors, especially under heavy workloads, and notes this for support leaders and, where relevant, for customers who rely on the replies.

Monitoring and feedback. The team tracks reviewer edit rates, customer complaints linked to AI-drafted replies, and agent flags on problematic drafts. A spike in edits on one topic triggers investigation.

Escalation and deactivation. A documented procedure lets the support lead pause the assistant for a query type, or entirely, if a serious error reaches customers. Incidents are logged, communicated to affected customers where appropriate, and reviewed before the assistant is restored.

Third-party dependency. Because the model comes from an external provider, the company monitors provider release notes, retests the assistant after model updates, and reviews the provider's data handling terms. A silent model change could alter behavior, so version changes are treated as a trigger for reassessment.

A simple treatment register for this hypothetical system might look like this:

Teams that need to manage generative AI risks in more depth can also consult NIST's Generative AI Profile (NIST AI 600-1), a companion resource to AI RMF 1.0 that maps generative AI risks to suggested actions.

NIST AI RMF MANAGE Implementation Resources

The most useful companion to this article is the official NIST AI RMF Playbook. For each MANAGE subcategory, the Playbook offers suggested actions, transparency and documentation prompts, and references for further reading.

NIST describes the Playbook as voluntary guidance, not a checklist. Organizations are expected to select the suggestions that fit their use cases, sector, and risk tolerance, and to skip those that do not apply. Treating every suggested action as mandatory tends to produce paperwork rather than better risk decisions.

The NIST AI Resource Center hosts the Core, the Playbook, and related materials in one place, and NIST's framework page is the place to check for revisions and new profiles.

If you need broader context before applying MANAGE, start with AGC's overview of the NIST AI RMF, which explains how the framework is structured and how its functions fit together.

Conclusion: Use MANAGE to Turn AI Risk Findings Into Action

The NIST AI RMF Manage function asks organizations to do four things well: prioritize risks and document responses (MANAGE 1), sustain benefits while limiting negative impacts and keeping a way to deactivate systems (MANAGE 2), oversee third-party resources and pretrained models (MANAGE 3), and monitor, communicate, respond, and recover after deployment (MANAGE 4).

Identifying risks is only the starting point. MANAGE expects documented decisions, named owners, recorded residual risks, and ongoing action for as long as the system runs.

Build Your NIST AI RMF Skills

If you are responsible for putting the framework into practice, structured training can help you connect MANAGE to the rest of the AI RMF and apply it with more confidence. Explore AGC's NIST AI Risk Management Framework training to see whether it fits your role and goals.