Active

Fairness

The organization shall ensure fairness in AI systems, preventing discrimination and bias in AI decisions and outcomes. Fairness requirements shall include identification of potential biases, mitigation of discriminatory outcomes, and monitoring of fairness over time, assessed throughout the AI lifecycle.

Requirement ID
AIG-004-R004
Parent Control
AIG-004
Domain Code
AIG

Requirement Details & Guidance

AIG-004-R004 · AIG-004
Why This Requirement Exists

This requirement exists to identify, prevent, mitigate, and monitor discriminatory or unfair AI outcomes, ensuring AI systems are governed, secured, assessed, and operated in a controlled and accountable manner.

Implementation Guidance

Establish and document the process to identify, prevent, mitigate, and monitor discriminatory or unfair AI outcomes. Define accountable roles, scope, required inputs and outputs, assessment or approval criteria, decision thresholds, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process across the AI lifecycle and integrate it with information security, privacy, risk, compliance, change management, incident management, and business governance as applicable.

Practical Application & Audit Readiness

AIG-004-R004 · Field Guidance

Business Examples

    Common Audit Findings

      Common Mistakes

        Best Practices & Ownership

        AIG-004 · Recommended Approach

        Recommended Practices

          Typical Owner

          Cross-Mapped Regulatory Frameworks

          Harmonized Control Mappings
          FRAMEWORK CODE FRAMEWORK NAME & DETAILS FAMILY / CATEGORY VERSION ACTION
          COBIT2019 COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO13 – Managed Security > APO13.03 – Monitor and review the information security management system (ISMS). 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.04 – Define and implement the organizational structures.
          COBIT
          Governance Framework
          		 v2019 View →
          GDPR General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 22 – Automated individual decision-making, including profiling; Article 5(1)(a) – Lawfulness, fairness and transparency; Article 25(1) – Data protection by design and by default
          EU
          Regulation
          		 vCurrent View →
          ISO27002 ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.16 – Monitoring activities
          ISO
          Standard
          		 v2022 View →
          NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RM – Risk Management Strategy | GV.RM-03 – Cybersecurity risk management activities and outcomes are included in enterprise risk management processes ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
          NIST
          Framework
          		 v2 View →

          Parent Domain Context

          Governance Domain Baseline
          Domain Name:
          AI Governance & Model Security (AIG)
          Purpose:
          To ensure the trustworthy, secure, and ethical development and deployment of AI.
          Scope:
          Enterprise
          View

          Parent Control Context

          Control Baseline
          Control Name:
          Responsible AI Management (AIG-004)
          Summary:
          Establishes responsible AI including principles, transparency, explainability, fairness, bias management, human oversight, ethical AI, accountability, review, and continuous improvement.
          Business Description:
          Establish and maintain controls to ensure Artificial Intelligence systems operate transparently, fairly, ethically, explainably, and under appropriate human oversight while respecting legal and societal expectations.
          View