AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational
Control requirement
Establish an approved bias and fairness assessment policy that defines covered decisions, assessment responsibilities, relevant harms, evidence standards, release criteria and reassessment triggers. Require unresolved material concerns to influence deployment decisions.
Why this matters
A system can meet its overall quality target while failing particular groups or making existing barriers harder to challenge. Fairness review needs a repeatable decision process, not a promise that the model is unbiased.
How the control types work together
Operational controls establish the review, approval and follow-through processes described here. Their effectiveness depends on who performs the work, what evidence they use and how the findings change decisions.
When it applies
AI development, acquisition and deployment where outcomes, access, representation or treatment can materially affect people; include generated content and human-assisted decisions.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The AI program owner maintains the policy with domain, privacy, legal and assessment specialists; business owners are accountable for deployment consequences.
Implementation guidance
- Define assessment scope using the decision, affected people and possible harms; identify groups and intersections relevant to the actual use.
- Specify evaluation methods, uncertainty treatment, privacy safeguards and evidence needed before a fairness claim can support release.
- Define escalation, acceptance authority and remediation expectations; require an explicit rationale for the chosen fairness objectives and tradeoffs.
- Integrate the policy into procurement, lifecycle gates and monitoring; train reviewers and revisit it after relevant complaints, incidents or changed use.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Trace a consequential release | Fairness findings and uncertainty informed its conditions or rejection. |
| Review a provider claim of unbiased performance | The claim receives a context-specific evidence assessment rather than automatic acceptance. |
| Inspect an assessment exception | Owner, limits, expiry and residual exposure are recorded. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Approved assessment policy
- Assessment criteria and role assignments
- Release and exception decisions
- Training and policy review records
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate unassessed material impact to the business owner and designated review authority. Hold or narrow the affected use until suitable evidence and safeguards support a decision.
Example in practice
Hypothetical example: A hiring tool performs well on an overall benchmark. The policy still requires evaluation of the actual recruitment stage, candidate population, accessibility and review process before automated screening is allowed.
Related controls
- CF01-008: AI Impact Assessment
- CF02-003: Demographic Impact Assessment
- CF02-007: Bias Metrics Definition & Monitoring
Framework mappings
- CSA AICM (GRC-11)
- NIST AI RMF (MEASURE 2.11)
- EU AI Act (Art. 10(2)(f))
- ISO 42001 (Cl. 8.4, A5.4)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0