AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Governance and Operational
Control requirement
Identify and implement applicable AI transparency obligations for the organization’s role and use, specifying required information, audience, timing, accessibility, ownership and evidence of delivery.
Why this matters
A generic AI notice may not provide the information needed for a particular role or decision. External duties and voluntary commitments must be translated into concrete disclosure activity.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
AI services and deployments subject to applicable laws, contracts or organizational transparency commitments; qualified review establishes their scope.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Legal or compliance validates obligations; the service and communications owners implement delivery and maintain evidence.
Implementation guidance
- Record the actual role, purpose, audience and jurisdiction, identifying applicable transparency requirements and authoritative references.
- Translate each requirement into specific content, delivery points and update triggers, distinguishing mandatory information from optional commentary.
- Review accuracy, accessibility, confidentiality and security before publishing through the relevant service channels.
- Verify delivery and maintain versioned notices, correcting omissions after changes or complaints.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace an applicable disclosure requirement | Content, audience and delivery evidence address it. |
| Inspect a changed feature or role | Transparency obligations are reassessed before affected use. |
| Test the intended audience route | Information is accessible where and when needed. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Transparency obligation register
- Reviewed disclosure content
- Delivery and accessibility evidence
- Update and correction records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate missing required disclosures to legal and service owners. Correct affected notices and restrict the relevant activity where mandatory conditions are unmet.
Example in practice
Hypothetical example: A general website notice does not reach users of an embedded assistant. The service adds the required information to the actual interaction and documents its delivery.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF06-007: Organizational AI Transparency Policy
- CF06-010: High-Risk AI System Transparency Requirements
Framework mappings
- NIST AI RMF (GOVERN 4.1)
- EU AI Act (Art. 13)
- ISO 42001 (Cl. 8.4, A8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0