AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Operational and Contextual
Control requirement
Clearly disclose AI involvement where people could otherwise reasonably misunderstand the identity or nature of the service. Keep the disclosure accurate through channel changes, handoffs and materially different interaction modes.
Why this matters
A human-like name, voice or interface can invite assumptions that a person is speaking. Identity disclosure helps users interpret the exchange and choose appropriate reliance or human assistance.
How the control types work together
Operational controls establish ownership, review and handling procedures. Contextual controls shape the information, expectations and operating environment that guide how people interpret and use the system.
When it applies
AI chat, voice, generated communications and other interactions where the service’s identity matters to user understanding.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The service owner defines disclosure with user-experience and communications teams; channel operators verify consistent presentation.
Implementation guidance
- Identify interaction points where users may mistake AI for a person, including third-party embeds and asynchronous messages.
- Provide clear, timely language appropriate to the channel without hiding it solely in lengthy terms.
- Distinguish AI interaction, human review and actual transfer to a person, avoiding misleading names or availability claims.
- Test representative journeys and accessibility, revisiting disclosure when channels or interaction behavior change.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Enter through a normal user route | AI involvement is apparent without searching unrelated terms. |
| Request or receive a handoff | The user can distinguish AI processing from actual human interaction. |
| Review a voice or embedded channel | Disclosure remains understandable in that medium. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Identity disclosure standard
- Channel and interface content
- Journey and accessibility tests
- Handoff and change reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate misleading identity presentation to the service owner. Correct the affected channel and assess whether users need clarification of prior interactions.
Example in practice
Hypothetical example: A voice assistant introduces itself as automated and marks when a live operator joins. It does not describe a request queued for later review as a current conversation with a person.
Related controls
- CF06-005: AI Capability & Limitation Notices
- CF06-008: Human Oversight Transparency
- CF06-007: Organizational AI Transparency Policy
Framework mappings
- NIST AI RMF (GOVERN 4.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0