AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Governance and Operational
Control requirement
Provide a controlled process for responding to applicable requests for explanations of AI-supported decisions, supplying accurate, meaningful information and a review or challenge route appropriate to the person’s rights and circumstances.
Why this matters
A generic model description may not explain a particular outcome. Response needs to connect the actual decision record to understandable information without inventing rationale or disclosing others’ protected data.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
Consequential AI-supported decisions and related explanation requests; qualified reviewers determine applicable rights, scope and timing.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The decision and privacy request owners coordinate; authorized domain reviewers assess records with legal input on obligations and limits.
Implementation guidance
- Provide accessible intake and proportionate identity checks, determining the applicable scope and response requirements.
- Retrieve relevant decision facts, inputs, system versions and human involvement through authorized access.
- Prepare an understandable explanation grounded in evidence, distinguishing known facts, method limits and reviewed disclosure restrictions.
- Deliver the response and meaningful review route, record required actions and verify resulting corrections or remedies.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a valid request | An authorized owner evaluates it and retrieves relevant evidence. |
| Compare the response with the record | Material reasons and human involvement are accurate. |
| Challenge an incorrect input | The route supports substantive review rather than repeating the same automated answer. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Request procedure and applicability decisions
- Protected decision evidence
- Reviewed explanations
- Delivery and review outcomes
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unavailable evidence, disputed rights or misleading explanations to decision and legal authorities. Correct the response and address affected outcomes through the approved review process.
Example in practice
Hypothetical example: An applicant requests an explanation of a rejection. The reviewer identifies an incorrect input, explains the documented decision path and initiates correction instead of asking a model to improvise a reason.
Related controls
- CF04-014: AI Decision Record & Traceability
- CF05-009: AI Data Subject Rights Implementation
- CF10-009: AI Decision Recourse Mechanism
Framework mappings
- NIST AI RMF (GOVERN 4.2)
- EU AI Act (GDPR Art. 22, EU AI Act Art. 26)
- ISO 42001 (Cl. 8.4, A8.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0