AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Operational and Contextual
Control requirement
Publish accurate, proportionate information about organizational AI uses where public disclosure is required or adopted as a transparency commitment. Maintain ownership, evidence, accessibility and correction for those statements.
Why this matters
Public claims shape trust and expectations before a person uses a service. Broad assurances can mislead when they omit material limitations or describe safeguards that do not operate in practice.
How the control types work together
Operational controls establish ownership, review and handling procedures. Contextual controls shape the information, expectations and operating environment that guide how people interpret and use the system.
When it applies
Public AI statements, service information, relevant registers and transparency reports, according to applicable duties and organizational commitments.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The communications owner coordinates with AI program, service, privacy and legal reviewers.
Implementation guidance
- Identify which uses and information require public disclosure or support an approved transparency commitment.
- Prepare audience-appropriate descriptions of purpose, AI involvement, relevant limits, responsibility and review contacts.
- Verify claims against current operations and evidence, protecting confidential, personal and security-sensitive detail.
- Publish through accessible channels and maintain correction and update processes after material changes or substantiated complaints.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Compare a public claim with live operation | Its material statements remain supported. |
| Follow the public contact route | The relevant function can receive and act on questions. |
| Review a changed AI use | Public information is revised where necessary. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Public disclosure scope and approvals
- Supporting evidence and content
- Publication and accessibility checks
- Update and correction history
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate inaccurate public claims to communications and service owners. Correct the statement and consider whether affected audiences need a targeted clarification.
Example in practice
Hypothetical example: An organization publishes that AI only drafts correspondence, then enables autonomous sending. Review updates both the operational approval and public description before the changed service is offered.
Related controls
- CF06-007: Organizational AI Transparency Policy
- CF06-003: AI System Transparency Obligations
- CF06-005: AI Capability & Limitation Notices
Framework mappings
- NIST AI RMF (GOVERN 4.1)
- EU AI Act (Art. 13)
- ISO 42001 (Cl. 5.2, A8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0