AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Governance and Operational
Control requirement
Establish a non-discrimination and equal-treatment policy that translates applicable external obligations into clear rules for AI-supported decisions, review, escalation and remedy. Distinguish legal duties from additional organizational fairness commitments.
Why this matters
Removing an explicitly protected field does not establish equal treatment if other inputs or processes reproduce the same exclusion. Binding requirements and ethical objectives need explicit, context-specific interpretation and implementation.
How the control types work together
Governance controls establish binding external rules, laws and regulations. Operational controls translate applicable obligations into assessment, decision and review processes. Internal approval cannot substitute for meeting an applicable external duty.
When it applies
AI-supported activities affecting treatment, access or opportunity; qualified reviewers determine the relevant jurisdictions, sectors and protected interests.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
Legal or compliance validates external obligations; business owners implement the policy and the AI program lead integrates it into lifecycle decisions.
Implementation guidance
- Identify applicable external non-discrimination requirements and responsible organizational roles using qualified review; record uncertainty and scope.
- Translate obligations into prohibited practices, assessment requirements, review criteria and accessible complaint paths without assuming one rule applies everywhere.
- Assess indirect and proxy pathways, human use of AI outputs and reasonable alternative processes as relevant to the use.
- Train decision makers, integrate the rules into approval and monitoring, and review complaints or changed obligations for required updates.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Trace a consequential decision process | Applicable duties and operating rules are identified and owned. |
| Inspect removal of a sensitive input | Relevant proxy and workflow effects are still assessed. |
| Follow a complaint scenario | A person can reach a meaningful review route with recorded responsibility. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Reviewed obligations and policy
- Decision-process and proxy assessments
- Training and approval records
- Complaint and remedy records
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate suspected unlawful treatment to legal, compliance and the accountable business owner. Contain the affected process and preserve evidence; internal approval cannot waive binding external requirements.
Example in practice
Hypothetical example: A screening team removes age from model inputs but retains a feature that may track it indirectly. The policy requires investigation of the decision process instead of treating field removal as sufficient proof of compliance.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF02-003: Demographic Impact Assessment
- CF02-010: Algorithmic Accountability & Decision Audit
Framework mappings
- NIST AI RMF (GOVERN 1.1)
- EU AI Act (Art. 5(1)(c), Art. 10)
- ISO 42001 (Cl. 5.2, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0