AI Control Library / CF-02: Fairness, Bias & Rights Impact
Designation: Core | Control types represented: Operational and Contextual
Control requirement
Maintain provenance and audience-appropriate documentation for training and adaptation data, including origin, collection purpose, selection, annotation, transformations, known limitations and permitted use. Make material unknowns explicit in model and deployment decisions.
Why this matters
Without provenance, reviewers cannot determine whether labels, populations and assumptions are suitable for a new use. Documentation also shapes whether downstream teams recognize limitations instead of treating the dataset as universally representative.
How the control types work together
Operational controls establish documentation, review and ownership. Contextual controls shape the information and limitations available to people deciding whether and how to use the data or model.
When it applies
Internally collected, licensed, public and supplier-provided datasets; record visibility limits for third-party models without claiming knowledge of undisclosed training material.
Define the assessment boundary and potential harm before selecting methods. Record evidence gaps and a reasoned response; unavailable demographic data does not establish that the system is fair.
Ownership
The data owner maintains provenance; procurement, domain and model reviewers evaluate use constraints and missing information.
Implementation guidance
- Record sources, acquisition dates, collection context, custodians and relevant permissions, linking each deployed dataset version to its history.
- Document selection, exclusions, annotation instructions and transformations, including material representational limitations.
- Provide appropriate summaries for developers, assessors and decision makers, protecting confidential and personal information in detailed records.
- Verify supplier statements where feasible; record unresolved provenance gaps and the evaluation, restriction or alternative that addresses them.
How to verify it
Use an authorized evaluation or a representative sample of actual decisions and records. Establish the relevant population, evidence limits and acceptance criteria before interpreting a result.
| Test | Expected result |
|---|---|
| Trace a deployed dataset version | Sources and significant processing steps are identifiable. |
| Review a limitation relevant to deployment | It appears in the information used by the decision authority. |
| Inspect an opaque provider dataset | Unknowns remain explicit and do not become unsupported assurance claims. |
Record a finding when required evidence or action is absent. Treat insufficient evidence as an unresolved limitation rather than a favorable result. A statistically observed difference requires contextual investigation and does not by itself establish its cause or legal meaning.
Evidence to retain
- Dataset provenance register
- Collection and processing documentation
- Permitted-use and limitation records
- Supplier evidence and gap decisions
Protect demographic and other sensitive information with appropriate access, minimization and retention. Use privacy-preserving reporting where suitable, and prevent published small-group results from exposing individuals.
If the control fails
Escalate missing origin or incompatible-use information to data, procurement and system owners. Restrict affected use where suitability or authorization cannot be established.
Example in practice
Hypothetical example: A team considers customer-service transcripts for employment analysis. Provenance reveals a different collection purpose and skewed population, leading to rejection of the reuse rather than assuming availability establishes suitability.
Related controls
- CF02-004: Training Data Differentiation & Relevance
- CF01-015: AI Model Documentation
- CF03-014: Model Provenance & Integrity Verification
Framework mappings
- CSA AICM (DSP-20)
- NIST AI RMF (MAP 1.1, MEASURE 2.11)
- EU AI Act (Art. 10(2))
- ISO 42001 (Cl. 8.4, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after material changes to purpose, population, data, decision rules or human workflow. Revisit relevant complaints, incidents and changed external obligations, and verify corrective action before closing findings.
Back to Fairness, Bias & Rights Impact
Version 1.0