MANAGE: Act on what was mapped and measured: prioritize, respond, recover, communicate.
The complete MANAGE function of the NIST AI Risk Management Framework, every category and subcategory, verified against NIST AI 100-1 on August 25, 2026.
MANAGE is where risk work becomes decisions: which risks get treated first, whether the system should run at all, what happens when something unknown goes wrong, and who hears about it. It allocates resources to the risks MAP and MEASURE surfaced, on a regular basis.
It is also the function that plans for failure. Response and recovery, deactivation of systems that stop behaving, and honest communication to the people affected all live here.
MANAGE 1: Risks from MAP and MEASURE are prioritized, responded to and managed
- MANAGE 1.1
A determination is made whether the system achieves its intended purposes and whether its development or deployment should proceed.
- MANAGE 1.2
Treatment of documented risks is prioritized based on impact, likelihood and available resources or methods.
- MANAGE 1.3
Responses to high-priority risks are developed, planned and documented: mitigating, transferring, avoiding or accepting.
- MANAGE 1.4
Negative residual risks to downstream acquirers and end users are documented.
MANAGE 2: Strategies to maximize benefits and minimize negative impacts are planned and carried out
- MANAGE 2.1
The resources required to manage AI risk are weighed, along with viable non-AI alternatives, to reduce the magnitude or likelihood of impacts.
- MANAGE 2.2
Mechanisms are in place to sustain the value of deployed AI systems.
- MANAGE 2.3
Procedures are followed to respond to and recover from a previously unknown risk when it is identified.
- MANAGE 2.4
Mechanisms supersede, disengage or deactivate systems whose performance becomes inconsistent with intended use.
MANAGE 3: AI risks and benefits from third-party entities are managed
- MANAGE 3.1
Risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.
- MANAGE 3.2
Pre-trained models used in development are monitored as part of regular monitoring and maintenance.
MANAGE 4: Risk treatments, response and recovery, and communication plans are documented and monitored
- MANAGE 4.1
Post-deployment monitoring plans are implemented: user feedback, appeal and override, decommissioning, incident response, recovery and change management.
- MANAGE 4.2
Measurable continual-improvement activities are integrated into system updates, with regular engagement of interested parties.
- MANAGE 4.3
Incidents and errors are communicated to relevant actors, including affected communities, and response and recovery processes are followed and documented.
MANAGE is a skill before it is a checklist
Reading the categories tells you what good looks like. The AI Governance program drills the calls themselves, and the credential shows an employer you made them under assessment.
Category and subcategory identifiers follow NIST AI 100-1 exactly; the wording is our plain-English paraphrase. Read the authoritative text in NIST AI 100-1. Not affiliated with or endorsed by NIST. Last verified: August 25, 2026.