NIST AI RMF KitNIST AI RMF MANAGE 3
Risks from third-party AI are monitored and managed, not just checked once at purchase.
What NIST says
AI risks and benefits from third-party entities are managed.
Category statement quoted from NIST AI 100-1 (AI RMF 1.0). Function: MANAGE, risks are prioritized and acted upon based on a projected impact.
Evidence that shows you're doing it
- Periodic supplier reviews
- Monitoring of third-party model changes
Rate yourself
- Not done
- Ad hoc
- Defined
- Operating
- Measured and improving
The AI Governance Toolkit (Professional, $599) has the NIST AI RMF mapping workbook: maturity scoring, evidence, owners and next steps for every category, plus the ISO/IEC 42001 crosswalk.
Other MANAGE categories
- MANAGE 1: Risks found in Map and Measure are ranked and have a decision: treat, transfer, accept or stop.
- MANAGE 2: You plan how to get the benefits while limiting harm, and you can switch a system off if needed.
- MANAGE 4: Treatments, incident response and communication plans for AI risks are written down and reviewed regularly.