NIST Privacy Framework, Identify-PID.RA-P2

The Commission advises you to identify and mitigate biases in AI algorithms and datasets, and to perform regular audits to assess and address biases in AI models.

Make sure AI and ML systems do not result in discriminatory or manipulative outcomes, train models on data that is sufficiently accurate, relevant and representative of the customer populations they are applied to, and test AI once a year or each time a model is upgraded, materially changed or introduced to identify and remediate undue or unintended biases (Sections 3(a) to 3(c)).

Develop models under documented standards: a clear statement of purpose and design objectives, development data shown to be suitable, representative and free of inappropriate bias and used in compliance with data privacy and other relevant data regulations, development testing against the design objectives including for material changes in dynamic models that adapt, recalibrate or change autonomously, justified and recorded expert-judgement adjustments, and documentation detailed enough for an independent third party to understand and replicate the model (Principle 3).

Make reasonable efforts to identify any clinical decision support system you develop or deploy that is known or has a reasonably foreseeable risk of biased impacts in health programs or activities

Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.

Do not use profiling that leads to discrimination against individuals on the basis of the special categories of personal data.

Do not take decisions that would lead to biased and discriminatory outcomes on the basis of personal data covered by Article 9 of Regulation (EU) 2016/679 (Article 76(2), point (c)).

Ensure transparency and non-discriminatory treatment in any automated decision made using personal information, and do not use it for unreasonable differential pricing.