AI Control Library / CF-06: Transparency & Explainability
Designation: Core | Control types represented: Operational
Control requirement
Establish an organizational AI transparency policy defining the information communicated to users, operators, affected people and external reviewers, with owners, approval, delivery and correction processes.
Why this matters
Separate teams can publish inconsistent descriptions of the same service. A policy creates a coherent approach while allowing different audiences to receive the detail they actually need.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Organizational AI communications across product interfaces, procurement, operations, public statements and affected-person review.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The AI program owner maintains the policy with legal, communications, user-experience and service owners.
Implementation guidance
- Define audiences and required topics, including AI identity, capabilities, limitations, data use, oversight and challenge routes.
- Assign evidence and approval requirements for claims, balancing useful disclosure with privacy, confidentiality and security.
- Establish publication, translation, accessibility and update processes across the service’s actual channels.
- Review complaints, incidents and service changes for inconsistent or misleading communications, verifying correction.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Compare channels describing one service | Material claims and responsibilities agree. |
| Trace a published capability statement | Approval and relevant evidence support it. |
| Review a correction | Affected audiences receive updated information through an appropriate route. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Approved transparency policy
- Audience and content responsibilities
- Claim approvals and delivery records
- Consistency and correction reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate material inconsistency or misleading statements to the service and policy owners. Correct the claims and address decisions that relied on inaccurate information.
Example in practice
Hypothetical example: The product page promises human review while the interface offers only automated reprocessing. Policy review aligns the wording with a real, staffed review process.
Related controls
- CF06-003: AI System Transparency Obligations
- CF06-004: AI Identity Disclosure
- CF06-012: AI System Public Disclosure
Framework mappings
- NIST AI RMF (GOVERN 4.1)
- EU AI Act (Art. 13)
- ISO 42001 (Cl. 5.2, A8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Transparency & Explainability
Version 1.0