Algorithmic bias: what it is and how compliance programmes address it

Where algorithmic bias comes from

Bias can enter an AI system at every stage. Historical data reflects past decisions, including unfair ones. Feature selection can use proxies for protected characteristics. Model architecture can amplify small imbalances. And evaluation metrics can hide disparities by averaging across groups.

Because the causes are varied, there is no single fix. A compliance programme treats bias as a risk: assess it, apply controls, test for it and monitor after deployment.

What the frameworks say

The EU AI Act requires providers of high-risk AI systems to take steps to detect and correct bias in training data and to test for it before and after deployment. ISO 42001 addresses bias through the risk assessment process and the controls in Annex A. The NIST AI RMF's Measure function includes fairness metrics.

• EU AI Act: data governance and bias testing for high-risk systems
• ISO 42001: risk assessment covering harm to individuals
• NIST AI RMF: fairness as a dimension of trustworthy AI
• All three: monitoring after deployment to catch drift

Addressing bias in your programme

In Certifyi, bias is a risk in the AI risk register, linked to the AI system it applies to. The controls that treat it — data audits, testing, monitoring, human review — sit in the control set and carry evidence like any other control.

• AI risk management: register the risk and link it to controls.
• Human oversight: a person reviews high-stakes decisions.
• AI transparency: disclose limitations and known biases.

Related terms

AI transparency

The practice of making an AI system's purpose, training data, decision logic and limitations visible to affected people, regulators and auditors. The EU AI Act requires varying degrees of transparency by risk category.

AI impact assessment

An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.

Human oversight

The requirement that a qualified person can monitor, intervene in, or override an AI system's decisions. Required by the EU AI Act for high-risk AI systems and by ISO 42001 as a control objective.