AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Technical
Control requirement
Monitor whether fairness outcomes remain acceptable as populations, inputs, labels, usage and decision practices change. Compare results with approved baselines and trigger investigation, correction or restricted use when material drift or loss of visibility occurs.
Why this matters
A model can remain unchanged while its effects shift. A change in who uses the service, how staff interpret outputs or whose outcomes are observed can alter fairness without a conventional model-performance alarm.
How the control types work together
Operational controls define the objectives, review duties and response decisions. Technical controls implement the data checks, measurement or system changes needed to test and enforce those decisions.
When it applies
Deployed AI with material people-related effects, including stable models operating in changing workflows and systems with delayed or incomplete outcome labels.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The system owner is accountable; assessment and monitoring teams maintain analysis and domain owners investigate emerging impact.
Implementation guidance
- Define fairness baselines, relevant populations and observation windows using approved metric specifications; distinguish this ongoing surveillance from initial metric selection.
- Collect proportionate evidence with privacy safeguards, track group coverage, missingness and label delay, and document gaps that limit conclusions.
- Compare outcome and error patterns over time with suitable uncertainty analysis; investigate population or workflow changes before attributing differences to the model.
- Set alert ownership and response authority, reassess after material changes and verify that remediation improves the affected outcomes.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Introduce a representative shift in a controlled evaluation | The method identifies the relevant change or records its detection limitation. |
| Inspect delayed or selective labels | Reports do not treat unobserved outcomes as successful ones. |
| Trace a drift alert | An owner investigates and records action, restrictions or a justified finding. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Fairness baselines and observation design
- Coverage and uncertainty reports
- Alert and investigation records
- Reassessment and corrective-action results
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate persistent material disparities or loss of usable evidence to the business owner. Limit affected use and fairness claims when monitoring can no longer support approved operating conditions.
Example in practice
Hypothetical example: A service expands to a new language population. Overall quality remains stable, but subgroup monitoring shows increased harmful errors and triggers restricted handling plus targeted reassessment.
Related controls
- CF02-007: Bias Metrics Definition & Monitoring
- CF02-008: Bias Remediation Process
- CF09-008: Operational Fairness & Bias Drift Monitoring
Framework mappings
- NIST AI RMF (MANAGE 4.1, MEASURE 2.11)
- EU AI Act (Art. 72)
- ISO 42001 (Cl. 9.1)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0