AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Technical
Control requirement
Provide accountable review and audit of consequential AI-supported decisions using protected records that identify the system, inputs or relevant references, decision rules, human interventions and resulting actions to the extent necessary and proportionate.
Why this matters
Fairness cannot be investigated reliably when no one can reconstruct the decision pathway. Accountability requires a responsible reviewer, access to relevant evidence and a route from a finding to correction or remedy.
How the control types work together
Operational controls define the objectives, review duties and response decisions. Technical controls implement the data checks, measurement or system changes needed to test and enforce those decisions.
When it applies
Consequential decisions and representative audit samples, including human decisions informed by model scores, rankings or generated recommendations.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The business decision owner is accountable; assurance reviewers investigate with appropriate independence and technical teams maintain suitable records.
Implementation guidance
- Define audit scope, sampling and decision-record requirements, limiting sensitive content to what is necessary for review.
- Record the relevant model and policy versions, input references, material outputs, human overrides and final actions with protected access.
- Review cases for adherence to approved criteria, unequal treatment, unsupported reliance and the operation of challenge routes.
- Assign findings to owners, verify remediation and communicate appropriate outcomes to the authorized decision or recourse function.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Reconstruct a sampled adverse decision | Relevant version, evidence and human involvement can be established. |
| Review an override or appeal | Authority, rationale and resulting action are recorded. |
| Trace an audit finding | It produces verified correction or a documented risk decision, not merely an archived report. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Decision-record specification
- Protected audit records
- Sampling and review findings
- Remediation and recourse outcomes
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate missing records, unjustified decisions or material patterns to the business and assurance authorities. Restrict affected automation where meaningful review is impossible and address people already affected.
Example in practice
Hypothetical example: An applicant challenges a rejection. The reviewer identifies the model version, criterion and human approval, finds an unsupported input and routes correction to both the case owner and the systemic remediation process.
Related controls
- CF04-014: AI Decision Record & Traceability
- CF02-008: Bias Remediation Process
- CF10-009: AI Decision Recourse Mechanism
Framework mappings
- NIST AI RMF (MANAGE 4.1, MEASURE 2.11)
- EU AI Act (Art. 14(1), Art. 26)
- ISO 42001 (Cl. 9.1, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0