MLASTG-TEST-GOV-002: AI Ethics Board & Human-in-the-Loop Assessment¶

Control Reference¶

Controls Tested: MLASVS-GOV-011 (AI Ethics Board — L2), MLASVS-GOV-012 (Human-in-the-Loop for Critical Decisions — L2), MLASVS-GOV-013 (Bias Continuous Monitoring — L2), MLASVS-GOV-014 (Model Performance Drift Monitoring — L2), MLASVS-GOV-015 (EU AI Act Conformity Assessment — L2), MLASVS-GOV-016 (Regular Red Team Exercises — L2), MLASVS-GOV-017 (Bias Continuous Monitoring — L2), MLASVS-GOV-018 (Adversarial Robustness Monitoring — L2), MLASVS-GOV-019 (Model Retirement Policy — L2), MLASVS-GOV-020 (ML System Impact Assessment — L2)

Severity¶

High (L2)

Overview¶

This test assesses the maturity of an organization's AI governance beyond baseline L1 controls. It evaluates whether an AI Ethics Board is established and functional, whether human-in-the-loop mechanisms are enforced for high-stakes decisions, and whether continuous monitoring for bias, drift, and adversarial robustness is operational. This is a L2-only test — L1 assessments do not require these controls.

Prerequisites¶

Step-by-Step Procedure¶

Step 1: AI Ethics Board Assessment¶

1. Verify that an AI Ethics Board exists with:
2. Formal charter or mandate document
3. Defined membership (technical, legal, ethicist, domain expert, affected-party representative)
4. Meeting schedule (at least quarterly)
5. Decision authority (binding vs. advisory)
6. Review the last 6 months of meeting minutes for:
7. Topics discussed (bias incidents, new model deployments, policy changes)
8. Decisions made and implementation status
9. Dissenting opinions and how they were addressed
10. Pass if: Ethics Board is established, meets regularly, and has documented decision authority
11. Fail if: No Ethics Board exists, or it exists but has no authority or meeting history

Step 2: Human-in-the-Loop Mechanism Assessment¶

1. Identify all high-stakes ML decision points:
2. Credit lending decisions
3. Hiring/recruitment screening
4. Healthcare diagnostics or triage
5. Content moderation at scale
6. Law enforcement risk scoring
7. For each high-stakes decision point, verify:
8. Human review is required before the decision is finalized
9. The human reviewer has sufficient context (input features, model confidence, explanation)
10. The human can override the model's recommendation
11. Override decisions are logged
12. Pass if: All high-stakes decision points have enforced HITL with override capability
13. Fail if: Any high-stakes decision can be executed autonomously without human review

Step 3: Continuous Bias Monitoring Assessment¶

1. Verify that bias monitoring is configured for each production model:
2. Protected attributes are defined (gender, race, age, disability, etc.)
3. Fairness metrics are computed (demographic parity, equalized odds, disparate impact)
4. Alert thresholds are set for metric violations
5. Monitoring cadence is defined (real-time, daily, weekly)
6. Review the last 6 months of bias monitoring reports for:
7. Metric trends over time
8. Alerts triggered and how they were addressed
9. Any bias incidents that occurred between monitoring periods
10. Pass if: Continuous bias monitoring is active with defined thresholds and incident response

Step 4: Model Drift and Performance Monitoring¶

1. Verify that model performance monitoring includes:
2. Input data drift detection (statistical tests on feature distributions)
3. Output prediction drift detection (prediction distribution monitoring)
4. Ground truth monitoring (accuracy/F1 tracking when labels become available)
5. Alert thresholds for performance degradation
6. Pass if: Drift monitoring is active with defined alert thresholds and response procedures

Step 5: Adversarial Robustness Monitoring (L2)¶

1. Verify that adversarial robustness is periodically retested:
2. Red team exercises conducted within the last 6 months
3. Automated adversarial robustness tests in CI/CD
4. Findings tracked to remediation
5. Pass if: Adversarial robustness is retested at least quarterly

Step 6: Model Retirement Policy¶

1. Verify that a model retirement policy exists:
2. Criteria for retirement (performance below threshold, bias threshold exceeded, regulatory change)
3. Process for decommissioning a model (rollback to previous version, notification to stakeholders)
4. Archive requirements for retired models
5. Pass if: Model retirement policy is documented and at least one model has been retired per the process

Step 7: ML System Impact Assessment¶

1. Verify that each production ML system has an impact assessment:
2. Potential harms to individuals and groups
3. Risk severity and likelihood classification
4. Mitigation measures implemented
5. Review cycle (at least annually)
6. Pass if: Impact assessments exist for all high-risk ML systems

Expected Result¶

Evidence Requirements¶

• AI Ethics Board charter and last 6 months of meeting minutes
• HITL configuration for each high-stakes decision point
• Continuous bias monitoring configuration and last 6 months of reports
• Drift monitoring configuration and alert history
• Red team exercise report (within last 6 months)
• Model retirement policy and any retirement records
• ML System Impact Assessment documents

Remediation Guidance¶

If Ethics Board does not exist: 1. Establish a cross-functional AI Ethics Board with technical, legal, and ethics expertise 2. Define a charter with meeting schedule and decision authority 3. Ensure at least one affected-party representative is on the board

If HITL is not enforced: 1. Identify all high-stakes ML decision points in the system 2. Implement a review gate that requires human approval before execution 3. Ensure reviewers have sufficient context (explanations, confidence scores)

If continuous bias monitoring is absent: 1. Deploy automated fairness monitoring using AIF360 or Fairlearn 2. Define alert thresholds for each protected attribute 3. Integrate monitoring into the ML pipeline with automated alerts

References¶

• NIST AI RMF: GOVERN 1.1, GOVERN 1.2, MEASURE 2.9
• EU AI Act: Articles 14 (Human Oversight), 26 (Obligations of deployers)
• ISO/IEC 42001: AI Management System Standard
• MLASWE: MLASWE-0015 (Governance and Accountability Gap)