AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Technical
Control requirement
Investigate material fairness findings, implement proportionate corrections and verify their effects before closing the issue. Address data, model, decision rules, human workflow and access barriers as relevant, with accountable ownership and tracked residual risk.
Why this matters
A disparity does not identify its cause, and changing the model alone may leave the harmful process intact. Remediation needs a supported diagnosis and evidence that the proposed correction improves the actual outcome.
How the control types work together
Operational controls define the objectives, review duties and response decisions. Technical controls implement the data checks, measurement or system changes needed to test and enforce those decisions.
When it applies
Fairness findings from assessments, monitoring, audits, complaints or incidents, including problems involving human decisions influenced by AI.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The business owner is accountable; data, model and process owners implement actions and qualified reviewers verify outcomes.
Implementation guidance
- Record the finding, affected scope, evidence, uncertainty and urgency; contain ongoing exposure where warranted.
- Investigate plausible causes across data, thresholds, interfaces and human practices without treating a statistical association as proof of causation.
- Evaluate alternatives against relevant outcomes, privacy, access and other safeguards; document tradeoffs and control changes through the release process.
- Retest with representative and independent evaluation where feasible, check unintended effects and verify complaint or recourse access before closing.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Trace a significant finding | Diagnosis, action owner and containment decision are recorded. |
| Evaluate the corrected workflow | Relevant outcomes improve under credible evaluation and new harms are assessed. |
| Inspect closure evidence | An approved result supports closure; a changed configuration alone is insufficient. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Finding and investigation record
- Containment and correction decisions
- Before-and-after evaluations
- Residual-risk and closure approval
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate persistent material harm or failed corrections to the business and oversight authorities. Reduce, suspend or replace the affected decision process when acceptable operation cannot be demonstrated.
Example in practice
Hypothetical example: A model correction reduces one group’s false rejections but increases harmful errors for another. The issue remains open while the team examines alternatives, including changes to the workflow rather than repeated threshold tuning.
Related controls
- CF02-007: Bias Metrics Definition & Monitoring
- CF01-009: AI Change Management Policy & Procedures
- CF10-011: AI Harm Remediation
Framework mappings
- NIST AI RMF (MANAGE 2.4)
- EU AI Act (Art. 9(2)(a))
- ISO 42001 (Cl. 10.1, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0