ISO 42001 A.11.2: Addressing AI Bias in AI Systems

What this means

This control mandates that your organization establish processes to identify, assess, and mitigate bias in AI systems that could produce unfair or discriminatory results. You must examine bias across four dimensions: training data quality and representativeness, model architecture and algorithmic design, evaluation metrics that catch disparate impact, and real-world deployment context. Any residual bias that remains after mitigation must be documented and transparently disclosed to relevant stakeholders, including affected users and leadership.

How to comply

1. 1.Audit training datasets for representativeness, missing demographic groups, and historical bias that may be encoded in labels
2. 2.Document model architecture decisions and evaluate whether algorithmic choices introduce or amplify bias
3. 3.Define fairness metrics tailored to your use case (e.g., demographic parity, equalized odds) and test model performance across protected groups
4. 4.Conduct pre-deployment testing in realistic scenarios to identify context-specific bias that may not appear in controlled settings
5. 5.Create a bias assessment report documenting findings, mitigation actions taken, and any residual bias accepted as acceptable risk
6. 6.Establish a disclosure process to communicate residual bias to stakeholders, regulators, and end-users as appropriate
7. 7.Monitor deployed AI systems for emerging bias through ongoing performance tracking across demographic groups
8. 8.Review and update bias controls annually or when training data, models, or deployment contexts change significantly

Evidence auditors look for

• Training data audit report identifying demographic representation gaps and historical bias patterns
• Model architecture documentation explaining design choices and potential bias vectors
• Fairness testing results comparing model performance across protected classes (gender, race, age, etc.)
• Pre-deployment bias assessment in realistic business scenarios with results documented
• Bias mitigation action plan showing techniques applied (e.g., data rebalancing, fairness constraints, threshold adjustment)
• Residual bias disclosure document shared with stakeholders outlining acceptable remaining bias and monitoring plans
• Model performance dashboards tracking fairness metrics in production across demographic groups
• Bias incident logs recording discovered bias events, root causes, and remediation taken

Frequently asked questions

See how GRCWatch handles this control automatically.

See how GRCWatch handles this control automatically

Related controls