CF06-009: AI Output Uncertainty & Confidence Disclosure

AI Control Library / CF-06: Transparency & Explainability

Designation: Core | Control types represented: Operational, Technical and Contextual

Control requirement

Communicate uncertainty and confidence information only in forms supported by the system and relevant evaluation, making limitations and appropriate action clear. Avoid presenting fluent language or unvalidated scores as reliable probabilities of correctness.

Why this matters

A confident answer can be wrong, and a numerical score may measure something other than task accuracy. Disclosure must help users choose an appropriate action rather than supply an impressive but misleading number.

How the control types work together

Operational controls define review and intervention duties. Technical controls enforce limits or supply relevant evidence. Contextual controls shape the information, interface and conditions in which people interpret results and decide whether to act.

When it applies

AI outputs used for decisions or factual reliance, including predictions, generated answers and workflows using confidence thresholds.

Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.

Ownership

The model and decision owners define uncertainty use with evaluation and user-experience specialists.

Implementation guidance

Identify the uncertainty information available and validate what any score actually means for the intended task and population.
Define audience-appropriate wording and indicators, accounting for missing evidence, unsupported conditions and distribution change.
Connect uncertainty to verification, abstention, escalation or alternative handling, enforcing action thresholds where required.
Test interpretation and behavior, monitoring for overreliance and revising claims when calibration or evaluation assumptions no longer hold.

How to verify it

Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.

Test	Expected result
Inspect a confidence claim	Relevant evaluation supports its meaning and scope.
Present an unsupported or ambiguous case	The output signals limits and follows the required handling path.
Test user interpretation	People do not mistake an unvalidated score for a guaranteed likelihood of correctness.

Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.

Evidence to retain

Uncertainty specification and validation
Interface and threshold configuration
User and adverse-case tests
Monitoring and reassessment records

Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.

If the control fails

Escalate misleading confidence displays or ineffective uncertainty handling to model and decision owners. Remove unsupported numbers and restrict affected reliance while the method is corrected.

Example in practice

Hypothetical example: An assistant reports “95% confident” from its own generated text. Evaluation replaces the number with a supported evidence indicator and routes insufficient-source cases for verification.

Related controls

Framework mappings

NIST AI RMF (MEASURE 2.6)
EU AI Act (Art. 13(3))
ISO 42001 (Cl. 8.4, A8.1)

Review and maintenance

Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.

Back to Transparency & Explainability

Version 1.0