Algorithmic Risk and Bias Mitigation Policy

How to use this document

• What it is for. This is a base policy setting the controls to prevent, detect and correct bias, errors and other harms from AI models and systems throughout their lifecycle: how the problem is framed, which data are used, which tests are run before deployment, which thresholds trigger a response and what happens when one is crossed.
• Who should own it. Usually the AI lead, with system owners and their technical or data science teams. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER]. The AI committee approves thresholds and decides on serious cases.
• Decisions to take first. Before adopting it, decide: which systems fall into each control level (Section 5); which fairness metrics and thresholds you will use by type of system (Section 7 and aids E and G); how you will lawfully handle the protected-characteristic data needed to measure bias (Section 8); and when you will require independent review (Section 13).
• Fields to complete. Replace the bracketed fields, especially the thresholds marked [COMPLETE]. The example values are indicative: adjust them to the context, data volume and regulations of each use.
• Relationship with other documents. This policy sets the controls; the AI risk management procedure sets how all risks are recorded and treated, the bias audit report documents each test, the AI post-deployment monitoring plan details ongoing surveillance and the model card holds the documentation.
• Country variants. This document has no country variants. Some laws require specific tests, audits or assessments for certain uses (for example hiring, credit or insurance); use "Related regulatory references" to identify them and the use-specific policy where one exists.
• Review. Have legal and privacy validate Section 8 and the thresholds for high-impact uses, and have the AI lead connect it to the risk register of the "AI Risk Management Procedure".
• Approval and publication. Have it approved by the AI committee, record the approval in "Version history" and communicate it to the teams that build, buy or operate models affecting people.

Algorithmic Risk and Bias Mitigation Policy

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 AI systems learn from data and rules that may contain errors and imbalances or reflect past discrimination. They can also degrade over time, fail in new situations or be manipulated. When these systems influence decisions about people, the result can be unfair treatment, lost opportunities or harm that is hard to reverse.

1.2 This policy sets the controls with which [ORGANIZATION NAME] identifies, measures, treats and monitors algorithmic risks, especially bias, throughout the lifecycle of its AI systems, and how it acts when it detects a problem.

2. Scope

2.1 This policy applies to AI systems developed, fine-tuned, bought or integrated by the organization that:

a) make or support decisions about people, such as hiring and workforce management, credit, insurance, personalized pricing, eligibility for services, fraud detection, health care or education;
b) classify, score, rank or recommend content, products or opportunities to people;
c) generate content delivered to customers or published;
d) operate in processes critical to the organization.

2.2 It applies to all staff, contractors and vendors who design, develop, validate, deploy, operate or oversee these systems.

2.3 This policy supplements the "Responsible AI Use Policy (Including Generative AI)", the "AI Risk Management Procedure" and, where one exists, the "Model Risk Management Policy and Model Inventory". Bias and error risks identified when applying it are recorded in that procedure's risk register, and their acceptance follows the risk appetite in the "AI Risk Appetite Statement".