AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Governance and Operational
Control requirement
Determine whether an AI use is subject to specific high-risk or equivalent external fairness obligations, and establish a use-specific evidence and control plan before deployment. Keep external legal classification separate from the organization’s internal risk rating.
Why this matters
A system called low risk internally may still fall within a regulated category, while high internal risk does not by itself establish a particular legal classification. The applicable obligations depend on role, purpose and jurisdiction.
How the control types work together
Governance controls establish binding external rules, laws and regulations. Operational controls translate applicable obligations into assessment, decision and review processes. Internal approval cannot substitute for meeting an applicable external duty.
When it applies
AI uses potentially subject to sector-specific or high-risk requirements; reassess when purpose, deployment role, population or jurisdiction changes.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
Legal or compliance validates classification and duties; the business owner is accountable for implementation and release authorities require evidence.
Implementation guidance
- Record intended purpose, provider and deployer roles, affected people and locations; obtain qualified classification review against authoritative requirements.
- Identify applicable fairness, data, oversight, assessment and recordkeeping obligations, relevant dates and unresolved interpretation.
- Map each obligation to owned activities and evidence, distinguishing full coverage from partial support; establish release conditions and review routes.
- Reassess classification and controls after material changes or new authoritative information, preserving the rationale for earlier decisions.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Inspect the classification decision | Purpose, role, jurisdiction and source support the conclusion. |
| Trace an applicable fairness obligation | Specific evidence and accountable implementation address its scope. |
| Expand the use into a new sector or jurisdiction | Classification is reviewed before consequential deployment. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Classification and applicability analysis
- Obligation-to-evidence plan
- Release and review decisions
- Change and reassessment history
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate unresolved classification or unmet applicable conditions to legal and the release authority. Hold the affected use rather than treating a generic model certificate as sufficient assurance.
Example in practice
Hypothetical example: A vendor’s general assistant is configured to rank candidates. The organization reassesses the actual employment use and its role rather than assuming the original general-purpose description settles its obligations.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF02-009: Non-Discrimination & Equal Treatment Policy
- CF01-017: AI System Lifecycle Stage Controls
Framework mappings
- NIST AI RMF (MEASURE 2.11)
- EU AI Act (Art. 9(7), Art. 10, Annex III)
- ISO 42001 (Cl. 8.4, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0