# AI Bias Testing and Fairness Guide

**Organization:** [ORGANIZATION NAME]
**Prepared by:** [NAME / ROLE]
**Date:** [DATE]
**Version:** 1.0

---

## Purpose

A practical guide for testing AI and machine learning systems for bias and fairness before deployment and on a continuous basis in production. Aligned to NIST AI RMF "Measure" function, ISO 42001 Annex A.8, and the EU AI Act fairness requirements for high-risk systems.

Use this guide to define fairness objectives, select metrics, run tests, remediate gaps, and document evidence for auditors.

---

## Section 1 — Scope and Governance

| # | Item | Description |
|---|------|-------------|
| 1.1 | System in scope | Name, version, owner, business use case |
| 1.2 | Protected attributes | Race, gender, age, disability, religion, nationality, marital status |
| 1.3 | Protected attribute proxies | ZIP code, school, language, device type — document known correlations |
| 1.4 | Fairness objective | Demographic parity / Equal opportunity / Equalized odds / Individual fairness |
| 1.5 | Decision type | Classification, regression, ranking, recommendation, generative |
| 1.6 | Impact tier | Informational / Recommends / Automated decision |
| 1.7 | Regulatory scope | EU AI Act high-risk, EEOC, ECOA, CFPB, GDPR Art. 22, state AI laws |
| 1.8 | Review cadence | Pre-deployment and every [N] days in production |

---

## Section 2 — Data Audit

Test the training and evaluation data before testing the model.

| # | Check | Pass / Fail | Notes |
|---|-------|-------------|-------|
| 2.1 | Representation analysis: counts per protected group | | |
| 2.2 | Label distribution per protected group | | |
| 2.3 | Missing / imputed rates per protected group | | |
| 2.4 | Feature availability per protected group (e.g. credit history length) | | |
| 2.5 | Historical label bias review (are ground truth labels themselves biased?) | | |
| 2.6 | Sampling bias review (how was data collected?) | | |
| 2.7 | Temporal bias review (is older data systematically different?) | | |
| 2.8 | Proxy variable correlation test (ρ with protected attribute) | | |
| 2.9 | Data provenance and consent basis documented | | |
| 2.10 | Data augmentation / rebalancing decisions logged | | |

---

## Section 3 — Fairness Metrics

Select the metrics that match your fairness objective. Not every metric applies to every system — document why each is in or out of scope.

### Group Fairness Metrics

| Metric | When to Use | Formula (plain English) |
|--------|-------------|-------------------------|
| Demographic Parity (Statistical Parity) | When positive rates should be equal across groups | P(ŷ=1 \| A=a) should be equal across groups |
| Disparate Impact Ratio | US EEOC 4/5ths rule, lending | min(P(ŷ=1\|A)) / max(P(ŷ=1\|A)) ≥ 0.80 |
| Equal Opportunity | When true positive rate must be equal | TPR equal across groups |
| Equalized Odds | When both TPR and FPR must be equal | TPR and FPR equal across groups |
| Predictive Parity | When precision should be equal | PPV equal across groups |
| Calibration | When predicted probability should be meaningful per group | P(y=1\|ŷ=p, A=a) ≈ p |

### Individual Fairness Metrics

| Metric | When to Use |
|--------|-------------|
| Counterfactual fairness | Would the decision change if the protected attribute changed, holding all else equal? |
| Consistency score | Similar individuals receive similar predictions |

### Generative / LLM Fairness

| Metric | When to Use |
|--------|-------------|
| Output sentiment disparity | Sentiment per demographic prompt set |
| Refusal rate disparity | Refusals across demographic prompts |
| Toxicity disparity | Toxicity score per demographic condition |
| Representation disparity | Quality and length of generated content per group |
| Stereotype benchmarks | StereoSet, CrowS-Pairs, BBQ, WinoBias scores |

---

## Section 4 — Test Plan

| # | Activity | Owner | Due |
|---|----------|-------|-----|
| 4.1 | Define test dataset(s) with documented demographic labels | | |
| 4.2 | Document consent and lawful basis for demographic data collection | | |
| 4.3 | Calculate baseline metrics on held-out test set | | |
| 4.4 | Set acceptance thresholds for each metric | | |
| 4.5 | Run intersectional tests (e.g., Black women, Hispanic men over 50) | | |
| 4.6 | Run adversarial / counterfactual tests | | |
| 4.7 | Run LLM-specific fairness benchmarks where applicable | | |
| 4.8 | Compare results to the legacy or alternative system | | |
| 4.9 | Stakeholder review (legal, DEI, domain SMEs) | | |
| 4.10 | Sign-off before deployment | | |

---

## Section 5 — Demographic Data Handling

Demographic data is itself sensitive. Follow these rules:

- Collect protected attribute data **only** for bias testing, with documented legal basis.
- Separate the demographic data from the production pipeline; use it only in the test environment.
- Use privacy-preserving techniques (hashing, aggregation, differential privacy) where possible.
- Document retention and destruction of demographic data post-test.
- Offer data subjects meaningful opt-out where legally required.

---

## Section 6 — Remediation Strategies

| Technique | Stage | When to Apply |
|-----------|-------|---------------|
| Re-sampling / re-weighting | Pre-processing | Data imbalance drives disparity |
| Disparate impact remover | Pre-processing | Proxy variables correlate with protected attribute |
| Adversarial debiasing | In-processing | Enforce invariance during training |
| Constraint optimization (Fairlearn, Reductions) | In-processing | Explicit fairness constraint in the loss |
| Calibrated equalized odds post-processing | Post-processing | Cannot retrain — adjust scores |
| Reject option classification | Post-processing | High-uncertainty predictions need human review |
| RAG / system prompt rewriting | Post-processing (LLM) | Reduce stereotyped outputs |
| Remove the feature / model | Any | Harm cannot be mitigated to acceptable level |

Document every remediation and the residual disparity after remediation.

---

## Section 7 — Production Monitoring

Bias emerges over time. Monitor continuously.

| # | Monitor | Frequency |
|---|---------|-----------|
| 7.1 | Per-group prediction rates | Daily |
| 7.2 | Per-group model error rates | Weekly |
| 7.3 | Data drift vs. training distribution | Weekly |
| 7.4 | Label feedback drift (where labels arrive late) | Monthly |
| 7.5 | Calibration drift | Monthly |
| 7.6 | Fairness metric re-calculation against acceptance thresholds | Quarterly |
| 7.7 | Stakeholder fairness review meeting | Quarterly |

Define automated alert thresholds and an escalation path. Treat a fairness breach like a security incident.

---

## Section 8 — Documentation and Evidence

For every system, retain:

1. Fairness scoping document (Section 1)
2. Data audit results (Section 2)
3. Metric selection and rationale (Section 3)
4. Full test results with thresholds and pass/fail (Section 4)
5. Demographic data handling record (Section 5)
6. Remediation log and residual disparity (Section 6)
7. Monitoring dashboard and alert history (Section 7)
8. Sign-off records and model cards

This package satisfies evidence requirements for ISO 42001, EU AI Act Article 15 and 17, NIST AI RMF "Measure", and most sectoral audits.

---

## Appendix — Suggested Open-Source Tools

- Fairlearn (Microsoft) — metrics and mitigation
- AI Fairness 360 (IBM) — metrics, mitigation, explanations
- What-If Tool (TensorFlow) — interactive analysis
- Aequitas (Data Science for Social Good) — audit toolkit
- BBQ, BOLD, HolisticBias — LLM bias benchmarks

---

*This guide is provided free by Aona AI. Pair it with the AI Model Validation Checklist and AI Risk Assessment Checklist at `/resources/templates`.*