AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Technical
Control requirement
Evaluate and document whether training, adaptation and evaluation datasets represent the distinctions and conditions needed for the intended use. Separate dataset purposes and splits so that relevance claims and performance evaluation remain credible.
Why this matters
A large dataset can still omit the situations that matter in deployment. Apparent performance may also reflect leakage between training and evaluation rather than an ability to serve the intended population.
How the control types work together
Operational controls define the objectives, review duties and response decisions. Technical controls implement the data checks, measurement or system changes needed to test and enforce those decisions.
When it applies
Model development, fine-tuning and dataset selection; for opaque third-party models, assess available evidence and use representative local evaluation to address relevant unknowns.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The data or model owner is accountable; domain experts and evaluation specialists assess coverage, sampling and separation.
Implementation guidance
- Define target populations, environments, time periods and task distinctions before selecting data; identify relevant groups and rare high-impact cases.
- Assess coverage, sampling, missingness, labels and domain mismatch rather than equating volume with relevance.
- Separate training, validation and held-out evaluation using appropriate subject, time or source boundaries; test leakage and duplication.
- Document coverage gaps and collection constraints; obtain more suitable data or narrow deployment claims and re-evaluate after material data changes.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Compare the dataset with intended use | Relevant conditions and gaps have explicit evidence and treatment. |
| Test held-out split integrity | Material overlap or leakage is detected and corrected before reporting results. |
| Evaluate an underrepresented high-impact case | The result informs additional evidence or a deployment restriction. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Data relevance specification
- Coverage and sampling analysis
- Split and leakage checks
- Gap treatment and use limitations
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate critical coverage or separation failures to the model and release owners. Withhold unsupported performance claims and affected release decisions until credible evaluation is available.
Example in practice
Hypothetical example: A service model is trained on urban customer records. Rural cases differ in connectivity and address formats, so the team adds relevant evaluation cases and limits automated handling where evidence remains weak.
Related controls
- CF02-003: Demographic Impact Assessment
- CF02-005: Training Data Integrity for Bias Prevention
- CF02-006: Training Data Provenance & Transparency
Framework mappings
- CSA AICM (DSP-24)
- NIST AI RMF (MEASURE 2.11)
- EU AI Act (Art. 10(2)(f))
- ISO 42001 (Cl. 8.4, A7.1)
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0