AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational
Control requirement
Assess how an AI-supported workflow affects relevant demographic groups and intersections, including differences in access, error, treatment and opportunity. Record evidence quality, privacy constraints, uncertainties, mitigations and the resulting use decision.
Why this matters
Equal aggregate accuracy can conceal uneven false rejections, missing language support or inaccessible channels. Demographic analysis must examine the decision pathway and who is excluded from the measured population.
How the control types work together
Operational controls establish the review, approval and follow-through processes described here. Their effectiveness depends on who performs the work, what evidence they use and how the findings change decisions.
When it applies
People-affecting uses where group differences could cause material harm, including systems that advise human decision makers rather than directly issuing final decisions.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The business owner is accountable; qualified assessment specialists work with domain, privacy and legal reviewers and appropriate affected perspectives.
Implementation guidance
- Map affected groups, relevant intersections and the stages where exclusion or unequal treatment may arise; include people absent from successful-use records.
- Establish a lawful, proportionate data approach with privacy review; document missingness and avoid assuming sensitive traits from names or appearance.
- Evaluate relevant outcomes and error types with suitable sample sizes, uncertainty and qualitative evidence; distinguish observed differences from claims about cause.
- Define mitigations and acceptable-use conditions, document limits and reassess when the population, purpose or workflow changes.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Review an aggregate pass result | Relevant group and intersectional effects were examined or evidence limitations explicitly constrain the claim. |
| Inspect demographic data collection | Purpose, authority, access and minimization were reviewed. |
| Trace a material disparity | Its investigation influenced mitigation or the use decision. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Population and workflow scope
- Reviewed data approach
- Disaggregated findings and uncertainty
- Mitigations and deployment decisions
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate material disparities or insufficient evidence for a consequential fairness claim to the business and review authorities. Use narrower deployment, additional evidence or human safeguards while the issue is investigated.
Example in practice
Hypothetical example: A benefits assistant appears equally accurate among completed cases. Assessment includes people who abandoned the interface and finds a language barrier that the completion-only benchmark missed.
Related controls
- CF01-008: AI Impact Assessment
- CF02-007: Bias Metrics Definition & Monitoring
- CF02-008: Bias Remediation Process
Framework mappings
- NIST AI RMF (MEASURE 2.11, MAP 5.1)
- EU AI Act (Art. 10(2)(f), Art. 15)
- ISO 42001 (Cl. 8.4, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0