MANAGE function

MANAGE covers prioritization, response, remediation, communication, and ongoing treatment of AI risks.

Supporting records

• policy results and evidence gaps;
• assigned exceptions and review work;
• decisions, rationale, and conditions;
• remediation owner, status, and evidence;
• risk acceptance and review date; and
• follow-up records for the affected application.

Respond to a risk

1. Confirm the source, affected application, and current evidence.
2. Apply the organization’s severity and priority method.
3. Assign the authorized decision and remediation owners.
4. Record the treatment, rationale, conditions, and review date.
5. Verify the expected evidence after the change.

Agree on response targets with the accountable owner. They should reflect the risk and operating environment, not a timing example from documentation.

Related guidance

• Inbox
• Policy exceptions
• GOVERN function