United States (federal) · voluntary framework
NIST AI RMF · MANAGE: what it asks, and the records to keep
MANAGE allocates resources to the risks mapped and measured, through 4 categories and 13 subcategories covering prioritization, risk response, third-party risk, and post-deployment monitoring, incident response and recovery. It includes the decision whether an AI system should proceed at all and how to disengage one that misbehaves.
01 / What it asks
What NIST AI RMF · MANAGE asks
Organizations adopting the AI RMF; MANAGE is done by system owners and risk owners who decide and carry out risk responses.
- 01Decide whether the AI system meets its purpose and should proceed; prioritize risk treatment by impact and likelihood (MANAGE 1.1, 1.2).
- 02Plan and document responses to high-priority risks: mitigate, transfer, avoid or accept (MANAGE 1.3).
- 03Assign mechanisms and responsibility to supersede, disengage or deactivate AI systems performing outside intended use (MANAGE 2.4).
- 04Monitor third-party AI resources and pre-trained models and apply documented controls (MANAGE 3.1, 3.2).
- 05Implement post-deployment monitoring plans with user input, appeal and override, and decommissioning (MANAGE 4.1).
- 06Track, respond to, recover from and communicate incidents and errors (MANAGE 4.3).
02 / AI work
Where it touches AI work
AI-specific. It covers risk treatment and lifecycle response for AI systems, including shutdown and incident handling.
03 / Dates
The dates that matter
NIST releases AI RMF 1.0 (NIST AI 100-1)
Generative AI Profile (NIST AI 600-1) released
AI Action Plan directs NIST to revise the AI RMF
Concept note for critical infrastructure AI RMF profile
04 / Enforcement
Who enforces it
None; voluntary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Go or no-go decision record for deployment
- 02Risk treatment plan with accepted residual risk
- 03Post-deployment monitoring plan and override or deactivation procedure
- 04Incident log with response, recovery and communication records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST AI RMF · MANAGE for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4