AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Technical
Control requirement
Protect and assess training-data integrity in ways that reveal bias-producing label errors, missingness, duplication and transformations. Preserve traceability and verify that corrections improve the affected outcomes without introducing new material disparities.
Why this matters
Integrity is more than matching a file checksum. A dataset can be unchanged yet contain systematically incorrect labels or preprocessing that removes information needed to serve particular groups.
How the control types work together
Operational controls define the objectives, review duties and response decisions. Technical controls implement the data checks, measurement or system changes needed to test and enforce those decisions.
When it applies
Training and adaptation pipelines, annotation, cleaning and transformations; distinguish accidental or systemic integrity problems from deliberate poisoning addressed by related security controls.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The data owner is accountable; pipeline, annotation and assessment teams operate checks and reviewers verify material corrections.
Implementation guidance
- Protect approved source snapshots and record transformations, label rules and access to change data; retain reproducible lineage.
- Evaluate label consistency, missing values, duplicates and error patterns across relevant groups and contexts with suitable expert review.
- Test cleaning and preprocessing effects, including whether outlier removal or normalization disproportionately excludes relevant cases.
- Correct identified issues through controlled versions and re-evaluate fairness and task performance; retain unresolved uncertainty and ownership.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Reproduce a transformation | Source, rule version and resulting dataset can be traced. |
| Audit a sample of labels and missing records | Group-specific error patterns are considered and findings acted on. |
| Compare before and after correction | Relevant outcomes improve without an unexamined regression elsewhere. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Protected source and lineage records
- Label and quality audit results
- Transformation impact tests
- Correction and re-evaluation evidence
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate material systematic data errors to the model owner. Quarantine affected data or suspend retraining until correction and evaluation establish acceptable use conditions.
Example in practice
Hypothetical example: A cleaning rule drops records with nonstandard address formats. Review finds it disproportionately removes a relevant community, prompting revised validation and a new evaluation of the resulting model.
Related controls
- CF02-004: Training Data Differentiation & Relevance
- CF02-008: Bias Remediation Process
- CF13-003: Data Poisoning Attack Prevention & Detection
Framework mappings
- CSA AICM (DSP-23)
- NIST AI RMF (MEASURE 2.11)
- EU AI Act (Art. 10(3))
- ISO 42001 (Cl. 8.4, A7.1)
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0