SC-AI-013 · Data

Data bias and representativeness checks

Medium effortCovered by ISO 27001: New for AISatisfies 9 obligations in 8 policies

What it means

  • Before training, check whether the data fairly represents the people the AI will serve, and whether it carries historic bias.
  • Look at how groups are represented: gender, age, region, language, urban or rural, income band, and proxies that stand in for protected traits (PIN code, surname, device type).
  • Check labels too: if past human decisions were biased, a model trained on them learns the bias.
  • This is about the input data. Testing the model's outputs for fairness is SC-AI-017 Fairness and discrimination testing of outputs.

Why it matters

  • RBI FREE-AI expects data that is relevant, fairly representative and ethically sourced.
  • MeitY's 2024 advisory says systems must not allow bias or discrimination.
  • A model trained mostly on metro, English-speaking customers will perform worse for everyone else, which is both a fairness and a business problem.

Checklist

  1. Define the groups that matter for each AI use case and which attributes or proxies to check.
  2. Profile training data: group counts, outcome rates by group, missing data by group.
  3. Compare training data distribution against the real customer or applicant population.
  4. Look for proxy variables strongly correlated with sensitive traits; justify or remove them.
  5. Document gaps and the fix chosen (more data, reweighting, exclusion of the use case for some segments).
  6. Repeat on each data refresh.

Evidence examples

  • Data representativeness report for the loan model training set, with group breakdowns against the applicant base.
  • Proxy variable analysis and decision log (for example PIN code dropped as a feature).
  • Sign-off by the model owner and an independent reviewer.

Common pitfalls

  • Not collecting any group data, then claiming you cannot check bias.
  • Checking headline counts only, not outcome rates by group.
  • Treating Indian diversity (language, region) as out of scope.

Satisfies

Also relevant to

Standards crosswalk

Clause references only. Check the standard itself for the exact wording.

ISO/IEC 42001

  • A.5.4 Assessing AI system impact on individuals or groups of individuals
  • A.7.4 Quality of data for AI systems

ISO/IEC 27001

No direct equivalent

SOC 2

No direct equivalent

Key takeaways

Find your gaps

Our free compliance gap assessment shows which of these controls you already run.

Start the gap assessment

Have us build it with you

Our AI Governance service implements controls like this one and produces the evidence auditors expect.

Explore AI Governance