AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Operational and Contextual
Control requirement
Explain the actual role, availability and limits of human oversight in AI-supported interactions and decisions. Provide an accurate route to request intervention or review and distinguish it from automated processing.
Why this matters
“Human in the loop” is misleading if no person reviews the relevant decision or can change it. Users need to know what oversight exists and what happens when they seek help.
How the control types work together
Operational controls establish ownership, review and handling procedures. Contextual controls shape the information, expectations and operating environment that guide how people interpret and use the system.
When it applies
AI workflows described as supervised, reviewed or subject to human intervention, including appeal and escalation channels.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The decision owner confirms oversight arrangements; communications and operations keep notices aligned with actual staffing and authority.
Implementation guidance
- Document where humans review, approve, monitor or respond, including scope, authority and service limitations.
- Communicate oversight and contact routes in terms appropriate to users and affected people, without promising unavailable intervention.
- Make requests traceable and distinguish automated acknowledgement from substantive human consideration.
- Test the end-to-end route and update notices when coverage, authority or review arrangements change.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Request human review through the published route | A responsible person receives the case under the defined process. |
| Inspect a supervised-use claim | The claimed human role exists for the relevant decision. |
| Exercise unavailable coverage | Users receive accurate next steps rather than a false live-review assurance. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Oversight role and availability records
- Published notices and contacts
- Request and handoff tests
- Change and correction records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate broken review routes or misleading oversight claims to decision and operations owners. Restore an effective route and correct affected communications.
Example in practice
Hypothetical example: A service labels an automatic second model pass as human review. The label is corrected and an actual authorized reviewer is added for the consequential challenge route.
Related controls
- CF07-001: Human Oversight Policy & Procedures
- CF07-004: AI Escalation Paths & Triggers
- CF10-009: AI Decision Recourse Mechanism
Framework mappings
- NIST AI RMF (GOVERN 4.2)
- EU AI Act (Art. 14, Art. 26)
- ISO 42001 (Cl. 8.4, A8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0