Regulators across jurisdictions have required that AI systems be fair and unbiased. None has specified how either should be measured. The compliance burden falls on organizations to define the standard they are meeting — and to defend that choice.

Key points
  • Governments requiring AI fairness and bias assessment share three convergent goals: preventing discriminatory outcomes in consequential decisions, protecting fundamental rights, and creating accountability for automated decisions. The problem is not the goals — it is the gap between what regulators want to achieve and what they have told organizations to measure.
  • "Bias" is not one thing. It encompasses at least five distinct concepts — statistical bias, data bias, design and framing bias, outcome bias, and automation bias — each requiring different interventions and carrying different legal implications. Most technical audits measure one or two of these. Most regulatory requirements are aimed at a different one entirely.
  • "Fairness" has over twenty formal definitions in the academic literature, several of which are mathematically incompatible. Demographic parity, equal opportunity, and calibration cannot all be satisfied simultaneously when base rates differ across groups. Choosing among them is a policy decision with legal implications — not a technical one.
  • The EU, US, and China each ground their fairness requirements in different legal theories — fundamental rights, disparate impact doctrine, and substantive anti-discrimination respectively — pointing toward different implied measurement standards. A multinational organization must navigate all three simultaneously, and satisfying one does not guarantee satisfying the others.
  • No jurisdiction has specified which statistical test or fairness metric constitutes compliance. The choice of metric is itself a governance decision that must be made, documented, and defensible — and most organizations have not made it deliberately.
This article does not teach GCs and compliance officers how to conduct a bias audit. It explains what a bias audit is actually measuring, why the choice of what to measure is a governance decision rather than a technical one, and what a meaningful audit report should contain.

The regulatory requirement without a measurement standard

Governments requiring AI fairness and bias assessment share three convergent goals: preventing discriminatory outcomes in consequential decisions, protecting fundamental rights from AI-mediated erosion, and creating accountability for automated decisions that affect individuals. These objectives are legitimate and important.

The problem is not the goals. It is the gap between what regulators want to achieve and what they have told organizations to measure.

The EU AI Act — the most comprehensive AI regulatory framework to date — requires that training, validation, and testing datasets be examined for possible biases likely to affect fundamental rights or lead to discrimination prohibited under Union law. Nowhere in the Act is the term "bias" defined. No specific statistical test or metric is prescribed. US civil rights law applies disparate impact doctrine to AI-mediated decisions across employment, credit, and housing — without specifying how that doctrine translates into a technical measurement standard for algorithmic systems. China's Generative AI Measures require effective measures to prevent discrimination across specified protected attributes, without specifying what "effective" means in technical or statistical terms.

The result is that organizations deploying AI in consequential domains — employment, credit, healthcare, education, legal services — are required to demonstrate compliance against standards that have not been defined with precision. That burden requires choices that are themselves governance decisions: which definition of bias applies, which protected attributes are in scope, which outcomes are being measured, which metric is used, and by whose standard the system is fair.

Most organizations have not made these choices deliberately. Many have outsourced them implicitly to the technical vendor that conducted their last audit — without realizing that the vendor's default choices are normative positions, not neutral technical measurements.

"Bias" is not one thing

Before any measurement can take place, GCs and compliance officers need to understand what is actually being measured — because "bias" as used in regulatory contexts conflates at least five distinct concepts, each requiring different interventions and carrying different legal implications.

Statistical bias
A systematic deviation between a model's predictions and the true values — errors that are not random but consistently skew in one direction. This is a purely mathematical property with no inherent ethical content. A model can be statistically unbiased in this sense while producing outcomes that are discriminatory in any meaningful sense of the word.
Data bias
The training data reflects historical patterns that encode past discrimination, underrepresentation, or measurement error. A model trained on such data learns and reproduces those patterns. This is the most commonly cited source of AI unfairness and the one most directly targeted by the EU AI Act's Article 10. But addressing data bias does not guarantee fair outcomes — a model trained on representative, balanced data can still produce unfair outcomes if the problem it was designed to solve is itself discriminatory.
Design and framing bias
The choices made during system design, feature selection, outcome definition, and problem framing reflect the assumptions of the people building the system. A hiring model that optimizes for "culture fit" encodes whatever assumptions the designers hold about what culture fit means. This is arguably the most pervasive and the hardest to measure — it is embedded in the decision about what to build and what to optimize for. No dataset audit will detect it.
Outcome or allocative bias
The model produces systematically different results for different groups in ways that reflect or reinforce social inequity. This is what most people mean when they say an AI system is "biased" in ordinary language, and what regulators are primarily concerned about preventing. It is a normative concept — it requires a judgment about which differences in outcomes are acceptable and which are not. It is not a statistical measurement.
Automation bias
The tendency of human decision-makers to over-rely on AI output — accepting recommendations without adequate scrutiny. The EU AI Act specifically addresses this in Article 14(4)(b), requiring that high-risk AI systems enable human oversight sufficient to avoid over-reliance on system outputs. This is a bias in human behavior enabled by AI design, not a property of the model itself — and it requires governance responses that go beyond dataset auditing.

Most technical audits measure statistical bias or data bias — the first and second on the list above. Most regulatory requirements are aimed at outcome bias — the fourth. The gap between what is measured and what is required is where compliance risk lives. An organization whose audit report addresses only dataset representativeness has not answered the question most regulators are actually asking.

The gap between what a bias audit measures and what a regulator is asking about is not a technical oversight. It is the consequence of deploying a technical tool to answer a normative question.

"Fairness" has multiple incompatible definitions

Even accepting that outcome fairness is the goal, there is no single agreed measure. The academic literature has identified over twenty formal definitions of algorithmic fairness. Several of the most commonly used are mathematically incompatible with each other — they cannot all be satisfied simultaneously except in trivial cases.

Three definitions appear most frequently in regulatory and compliance contexts:

Demographic parity
The model produces positive outcomes at equal rates across groups — regardless of any other factor. A credit model satisfies demographic parity if approval rates are equal across racial groups.
Maps approximately to US disparate impact analysis, but the two are not equivalent.
Equal opportunity
The model produces equal true positive rates across groups. A hiring model satisfies equal opportunity if qualified candidates from different groups are identified at equal rates, even if overall approval rates differ.
Focuses on outcomes for qualified individuals rather than population-level rates.
Calibration
Predicted probabilities match actual outcomes equally across groups. A risk assessment model is calibrated if its scores mean the same thing regardless of the group being assessed.
Often in tension with the other two metrics when base rates differ across groups.

The incompatibility problem — established formally by Chouldechova (2017) and Kleinberg et al. (2016) — demonstrates that demographic parity, equal opportunity, and calibration cannot all be satisfied simultaneously when base rates differ across groups. This is almost always the case in real-world applications. Optimizing for one definition of fairness necessarily means accepting that the system will fail the others.

This is not a technical problem awaiting a better algorithm. It is a policy problem requiring a normative choice about which kind of unfairness is more acceptable. That choice has legal and ethical implications that go beyond what a data science team should be deciding alone — and yet in most organizations, it is the data science team that decides it by default, through whichever metric their tooling happens to optimize for.

Why this matters for audit reports

An audit report that says "the model achieves demographic parity across protected groups" has made a normative choice — that demographic parity is the right definition of fairness for this system and use case. That choice may simultaneously mean that the model fails equal opportunity and calibration. The report is not wrong, but it is incomplete unless it discloses what definition was used, why, and what the model's performance looks like under alternative definitions.

An organization that receives such a report and presents it as evidence of compliance without understanding the underlying definitional choice is making a compliance claim it cannot fully defend.

Different jurisdictions, different legal theories

The three major regulatory approaches to AI fairness are grounded in different legal theories pointing toward different implied measurement standards. A multinational organization must navigate all three simultaneously — and satisfying one does not guarantee satisfying the others.

How the three major regulatory frameworks compare
Jurisdiction Legal grounding Pipeline stage addressed Measurement standard specified? Key gap
EU Fundamental rights; EU non-discrimination directives Training data (Art. 10) + human oversight layer (Art. 14) Not specified No definition of "bias"; no prescribed metric; bridge between legal non-discrimination standard and technical measurement absent
US Civil rights statutes: Title VII (employment), ECOA (credit), Fair Housing Act (housing) Decision outcomes across all domains; model outputs and human decisions incorporating them Partial Disparate impact doctrine is the standard but does not map cleanly onto any single fairness metric; four-fifths rule is a rule of thumb, not a safe harbor; black box is not a defense in credit
China Anti-discrimination obligations (Generative AI Measures); algorithmic transparency (Algorithm Recommendation Provisions) Entire AI lifecycle: design, training data, model generation, optimisation, service provision Not specified "Effective measures" required without specifying what "effective" means technically; values-alignment requirements distinct from and should not be conflated with anti-discrimination obligations

The EU approach — fundamental rights and data governance

The EU AI Act addresses bias through two distinct mechanisms that serve different purposes and are often conflated in compliance discussions.

Article 10(2)(f) requires that datasets be examined for biases likely to affect health and safety, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law — particularly where data outputs influence future inputs. This is an input-side obligation targeting bias in training data. Article 10(5) adds a limited debiasing exception permitting processing of sensitive data categories for bias detection and correction under strict conditions.

Article 14(4)(b) addresses a different problem: automation bias. High-risk AI systems must be designed to enable human oversight sufficient to avoid over-reliance on system outputs. This is a behavioral requirement targeted at the human decision-making layer — not the model. Most compliance programs focused on data auditing are not addressing this obligation at all.

The Act's fairness requirements are anchored to discrimination "prohibited under Union law" — existing EU non-discrimination directives and the Charter of Fundamental Rights — without specifying how those legal standards translate into technical measurement obligations. The Act defines neither "bias" nor a measurement methodology. Organizations subject to it must determine, with legal counsel, which technical measurement approach is consistent with the legal non-discrimination standard applicable to their use case.

The US approach — civil rights doctrine across multiple domains

The United States has not enacted comprehensive federal AI legislation. Instead, existing civil rights frameworks apply to AI-mediated decisions across multiple domains, with a consistent underlying principle: existing anti-discrimination law applies fully to algorithmic systems, the fact that a decision was made by an AI is not a defense, and organizations using third-party AI tools remain liable for discriminatory outcomes those tools produce.

In employment, disparate impact doctrine under Title VII applies to algorithmic decision-making tools used in hiring, promotion, and termination. The EEOC has confirmed that such tools are subject to the same analysis as any other selection procedure. The four-fifths rule — under which adverse impact is generally indicated when a selection rate for a protected group is less than 80% of the rate for the highest-scoring group — is a rule of thumb in enforcement guidance, not the legal standard itself. The EEOC has explicitly stated it does not provide a safe harbor, and that smaller differences may indicate adverse impact depending on context and sample size.

In credit and consumer finance, the Equal Credit Opportunity Act and Consumer Financial Protection Act apply. The CFPB has confirmed that courts have held that using an algorithmic tool can itself constitute a policy producing bias under disparate impact theory. Critically, the CFPB has rejected the black box argument: the complexity or opacity of a model cannot be used as a defense against violations of the ECOA. Fair lending testing must include both disparate treatment and disparate impact analysis, and must include searches for less discriminatory alternatives.

In housing and property appraisal, a 2024 joint rule from the CFPB and five federal banking agencies requires companies using algorithmic appraisal tools to implement safeguards ensuring accuracy, data integrity, and compliance with non-discrimination law.

A precision point the article must make clearly: the four-fifths rule is not the same as disparate impact doctrine, and disparate impact doctrine does not map cleanly onto any single technical fairness metric. The field of AI fairness has sometimes treated demographic parity as an approximation of disparate impact — which is an imprecision with real compliance consequences. An organization that has tested its model for demographic parity has not necessarily satisfied its disparate impact obligations. The relationship between the legal doctrine and any specific fairness metric is more complex and contested than a one-to-one substitution implies, and should be assessed with legal counsel familiar with the applicable civil rights framework.

The China approach — anti-discrimination and values alignment as distinct obligations

China's AI governance framework combines two types of fairness requirements that serve different regulatory purposes and should not be conflated.

The Interim Measures for the Management of Generative Artificial Intelligence Services (effective August 2023) contain substantive anti-discrimination obligations: providers must take effective measures to prevent discrimination on the grounds of nationality, religion, country or region, gender, age, occupation, and health — across algorithm design, training data selection, model generation and optimization, and service provision. This is a lifecycle-spanning obligation, not limited to output monitoring.

The Algorithm Recommendation Management Provisions (effective March 2022) impose obligations on algorithm transparency, fairness, content moderation, and algorithm filing — and separately require that providers promote "mainstream values" and avoid content endangering national security or disrupting social order. This values-alignment requirement is distinct from the anti-discrimination obligation and serves a different regulatory purpose. Treating them as the same requirement mischaracterizes both.

Neither set of requirements specifies a measurement methodology. The anti-discrimination obligation is process-oriented — take effective measures — without specifying what "effective" means in technical or statistical terms. Organizations operating in China must determine, with counsel familiar with Chinese law, what process and measurement approach is sufficient to demonstrate compliance.

What meaningful measurement actually requires

A meaningful bias assessment is not a single test. It is a sequence of governance decisions, each of which must be made before technical measurement begins. Most audit reports GCs and compliance officers receive do not reflect this — they present a metric without specifying why that metric was chosen, what alternatives were considered, or what the result means relative to the applicable legal standard.

A defensible bias assessment requires specifying six things explicitly:

1
Which protected attributes are in scope — and why
Not all jurisdictions protect the same attributes. Some attributes are legally protected but technically unavailable or inappropriate to use in testing. The choice of which attributes to test is a legal decision, not a technical default. It must be made in consultation with legal counsel and documented with its rationale.
2
Which outcomes are being measured
Approval rates, error rates, score distributions, and final decisions are different outcomes that produce different findings from the same model. The choice of which outcome to measure encodes an assumption about where in the decision process fairness should be evaluated.
3
At which point in the decision pipeline
Bias can be introduced or amplified at the model level, at the human decision-making layer incorporating model output, or at the level of final outcomes. The EU AI Act's Article 14 obligation on automation bias makes clear that measuring only at the model level is insufficient. An audit that does not address the human decision layer has not addressed the full compliance requirement.
4
Against which baseline
Equal rates across groups, equal rates among similarly situated individuals, equal error rates, or something else. Each baseline encodes a different normative assumption about what equality means — and the choice among them is a policy decision with legal implications.
5
Using which fairness metric — and why not the alternatives
The choice of metric must be documented as a governance decision. If the audit uses demographic parity, it should explain why demographic parity rather than equal opportunity or calibration — and what the model's performance looks like under those alternative definitions. An audit that reports only the metric it satisfies, without disclosing how the model performs under alternatives, is presenting an incomplete picture.
6
How the metric relates to the applicable legal standard
The metric chosen for technical measurement may not map onto the disparate impact standard, fundamental rights framework, or anti-discrimination obligation governing enforcement in the relevant jurisdiction. The relationship between the technical metric and the legal standard must be assessed — and the gap, if any, must be addressed — before the audit result can be presented as compliance evidence.

What GCs and compliance officers should require

Before commissioning an audit

Has the organization made a deliberate choice about which definition of fairness it is measuring — and documented the rationale? Has legal counsel confirmed which legal standard applies in each relevant jurisdiction for this specific use case and domain? Has the scope of protected attributes been defined in consultation with legal counsel, not delegated entirely to the technical team? Is the audit designed to address the full decision pipeline — model output, human decision incorporating that output, and final outcome — or only the model?

In reviewing an audit report

Does the report specify which fairness metric was used and why — and why not the alternatives? Does it disclose how the model performs under alternative fairness definitions? Does it specify which protected attributes were tested, at which point in the pipeline, and against which baseline? Does it address automation bias in the human decision-making layer, not only model-level bias? If a disparity was identified, does the report include a remediation plan with identified owners and timelines?

Most importantly: does the report explain how its findings relate to the applicable legal standard in each relevant jurisdiction — not just the technical metric used? An audit result that speaks only to the technical metric, without bridging to the legal standard, is not a compliance document. It is evidence that a measurement was taken.

On vendor claims

"Bias-free AI" is not a meaningful claim. It implies a single agreed standard of fairness that does not exist. A product described as bias-free has been found to satisfy one definition of fairness — and that definition, by the incompatibility theorem, means it fails others.

A claim that a model has been tested for bias is only meaningful if the methodology, the metric used, the attributes tested, the point in the pipeline assessed, and the relationship to the applicable legal standard are all specified. An audit report that does not specify these is a technical exercise without a normative anchor. It is not evidence of compliance — and presenting it as such creates, rather than reduces, legal exposure.

Working through these questions?

The analysis this article describes sits at the intersection of AI governance, data science methodology, legal non-discrimination standards, and organizational risk management — disciplines that most organizations do not have integrated under one function. If you are assessing your AI bias compliance posture or evaluating an audit you have received, we are happy to talk.

Note
This article is for informational purposes only and does not constitute legal advice. It examines general questions about how regulatory frameworks approach AI fairness and bias assessment. The observations are general in nature and do not account for the specific circumstances, jurisdiction, or regulatory environment of any particular organization. Professional advice should be sought where specific action is contemplated.

歐盟、美國、中國等主要司法管轄區均已明確要求AI系統具備公平性並不得存在偏差，然而均未指明應以何種方式加以測量。合規舉證的責任，因此落在機構身上——機構須自行界定所達到的標準，並在必要時為這項選擇進行辯護。

本文要點
  • 各司法管轄區要求AI公平性與偏差評估的政府，共同指向三個目標：防止重大決策中的歧視性結果、保護基本權利免受AI媒介的侵蝕，以及建立對自動化決策的問責機制。問題不在於目標本身，而在於監管機構的訴求與機構被告知應測量之事物之間的落差。
  • 「偏差」不是一個概念，而是至少五種截然不同的概念——統計偏差、資料偏差、設計與框架偏差、結果偏差，以及自動化偏差——各自需要不同的干預措施，在法律上的含意亦各有差異。多數技術稽核所測量的，是其中一兩種；多數監管要求所針對的，卻是另一種。
  • 「公平性」在學術文獻中有逾二十種正式定義，其中數種在數學上相互不相容。人口均等性、機會均等性與校準性，在各群體基礎比率不同的情況下，無法同時得到滿足。在三者之間作出選擇，是一項具有法律含意的政策決定，而非技術決定。
  • 歐盟、美國與中國各以不同的法律理論——基本權利、差異影響原則，以及實質性反歧視義務——為其公平性要求奠基，並隱含指向不同的測量標準。跨國機構必須同時應對三者，滿足其中一項並不必然意味著滿足其他。
  • 目前沒有任何司法管轄區明確規定，以何種統計測試或公平性指標構成合規。指標的選擇本身，是一項必須作出、記錄在案且具備可辯護性的治理決策——而多數機構從未刻意作出這項選擇。
本文的目的，不在於教導法務長或法遵長如何執行偏差稽核，而在於說明偏差稽核實際測量的是什麼、為何指標的選擇是治理決策而非技術決定，以及一份有意義的稽核報告應當包含哪些內容。

沒有測量標準的法規要求

各司法管轄區要求AI公平性與偏差評估的政府，均指向三個共同目標：防止重大決策中的歧視性結果、保護基本權利免受AI媒介決策的侵蝕，以及建立對自動化決策影響個人的問責機制。這些目標具有正當性，也確有其重要性。

問題不在於目標本身，而在於監管機構的訴求與機構被告知應測量之事物之間的落差。

《歐盟AI法案》——迄今最為全面的AI法規框架——要求對訓練、驗證及測試資料集進行審查，以識別可能影響基本權利或導致歧視的偏差。然而，「偏差」一詞在法案全文中從未得到定義，亦未規定任何具體的統計測試或指標。美國民權法律框架將差異影響原則適用於AI媒介的就業、信貸與住房決策，卻未說明該原則如何轉化為演算法系統的技術測量標準。中國《生成式人工智能服務管理暫行辦法》要求業者採取有效措施防止歧視，卻未說明「有效」在技術或統計層面意指何物。

結果是：在就業、信貸、醫療、教育、法律服務等重大領域部署AI的機構，須就尚未精確界定的標準承擔合規舉證責任。這項責任要求機構在技術測量之前，先行作出一系列本身即屬治理決策的選擇：適用哪種偏差定義、哪些受保護屬性納入範疇、測量哪些結果、採用哪種指標、依據誰的標準判定系統是否公平。

多數機構從未有意識地作出這些選擇。許多機構在不自覺的情況下，將這些選擇轉包給負責執行稽核的技術供應商——卻未意識到，供應商的工具預設值是規範性立場，而非中立的技術測量結果。

「偏差」不是一個概念

「偏差」在監管文件中頻繁出現，但監管機構與技術實務所指涉的，往往是截然不同的概念。在委託任何測量工作之前，法務長與法遵長須先釐清：技術團隊實際測量的是哪一種偏差，這與監管要求所針對的，是否為同一回事。這不是細節問題。至少五種截然不同的概念被「偏差」這個詞所涵蓋，各自需要不同的干預手段，在法律層面的含意亦各有差異。

統計偏差
模型預測值與真實值之間的系統性偏離——誤差並非隨機分布，而是持續朝同一方向偏斜。這是一個純粹的數學性質，本身不帶任何倫理內涵。一個在此意義上不存在統計偏差的模型，仍可能在任何實質意義上產生歧視性結果。
資料偏差
訓練資料反映了歷史上的歧視模式、代表性不足，或測量誤差。以此類資料訓練的模型，會學習並重現這些模式。這是AI不公平性最常被引用的來源，也是《歐盟AI法案》第10條最直接針對的問題。然而，消除資料偏差並不保證產出公平的結果——一個以具有代表性、平衡的資料訓練的模型，若其所設計解決的問題本身帶有歧視性，仍可能產生不公平的結果。
設計與框架偏差
系統設計、特徵選擇、結果定義與問題框架過程中所作的選擇，反映了建構系統之人員的假設與視角。一個以「文化契合度」為優化目標的招募模型，編碼了設計者對文化契合度意涵的任何預設。這種偏差可以說是最普遍也最難以測量的——它嵌入於「建構什麼、優化什麼」的決策之中，而非資料或模型本身。任何資料集稽核都無法偵測到它。
結果或分配偏差
模型對不同群體產生系統性差異的結果，這些差異反映或強化了社會不平等。這是多數人在日常語言中說AI系統「有偏差」時所指的含義，也是監管機構主要關注預防的問題。這是一個規範性概念——它需要就哪些結果差異可被接受、哪些不可接受作出判斷——而非統計測量的結果。
自動化偏差
人類決策者過度依賴AI輸出——在未經充分審查的情況下接受系統建議。《歐盟AI法案》第14條第4款第(b)項明確針對此問題，要求高風險AI系統的設計須能使人類監督者避免過度依賴系統輸出。這是AI設計所助長的人類行為偏差，而非模型本身的屬性——它需要超越資料集稽核的治理回應。

多數技術稽核所測量的，是統計偏差或資料偏差——上述五類中的第一或第二類。監管機構所關切、亟需防範的，卻是結果偏差——第四類。稽核所觸及的範疇，與監管要求所指向的範疇，並不重合。一份僅就資料集代表性進行審查的稽核報告，尚未觸及多數監管機構所實際要求回答的問題。

稽核報告測量的，與監管要求的，往往不是同一回事。以技術工具回答規範性問題，本就是這道落差的根源。

「公平性」有多種互不相容的定義

即便承認結果公平性是目標，也不存在單一公認的測量方式。學術文獻已識別出逾二十種演算法公平性的正式定義，其中數種在數學上相互不相容——在非平凡情況下，無法同時得到滿足。

以下三種定義在監管與合規脈絡中最為常見：

人口均等性
模型在各群體間以相同比率產出正向結果，無論其他因素為何。一個信貸模型若在各族裔群體間批准率相同，即滿足人口均等性。
與美國差異影響分析大致相近，但兩者並不等同。
機會均等性
模型在各群體間產生相等的真陽性率。一個招募模型若能以相同比率識別出不同群體中的合格候選人，即滿足機會均等性，即使整體批准率存在差異。
著重於合格個體的結果，而非群體層面的整體比率。
校準性
各群體間的預測概率與實際結果以相同程度吻合。一個風險評估模型若其評分在各群體間具有相同含義，即滿足校準性。
當各群體間基礎比率存在差異時，往往與其他兩種指標形成張力。

Chouldechova（2017年）與Kleinberg等人（2016年）已從數學上嚴格證明：在各群體基礎比率不同的情況下，人口均等性、機會均等性與校準性三者無法同時成立。而在實際應用場景中，各群體的基礎比率幾乎必然存在差異。換言之，優化任何一種公平性定義，必然在其他定義下製造新的失敗。沒有例外。

這不是演算法優化能夠解決的工程問題，而是「哪一種不公平在當前使用情境中較為可被接受」的政策判斷。這項判斷牽涉法律義務與倫理責任，遠非資料科學團隊所能獨自承擔——但在多數機構中，恰恰是資料科學團隊，透過其工具所預設的優化目標，在不自覺間代替整個機構作出了這項選擇。

對稽核報告的啟示

一份聲稱「模型在受保護群體間實現了人口均等性」的稽核報告，在作出這項陳述的同時，已作出了一項規範性選擇：以人口均等性作為衡量此系統與此使用情境是否公平的準繩。這項選擇的代價，是模型在機會均等性與校準性定義下可能存在的缺陷。報告本身並無錯誤，但若未揭示所採用的定義、選擇該定義的理由，以及模型在替代定義下的表現，便只呈現了部分事實。

機構若在未充分理解這項定義性選擇的情況下，接受並提交此份報告作為合規證據，其合規主張的可辯護性，便已出現無法以事後補救填補的缺口。

不同司法管轄區，不同法律理論

三大主要監管框架的法律理論基礎各異，所隱含的測量標準亦不相同。對跨國機構而言，三者須同時應對；滿足其中一項監管框架的要求，不等於在其他框架下亦已合規。

三大主要監管框架比較
司法管轄區 法律基礎 涵蓋的決策管線階段 是否指定測量標準 核心缺口
歐盟 基本權利；歐盟反歧視指令 訓練資料層（第10條）＋人類監督層（第14條） 未指定 「偏差」一詞未獲定義；無規定的測量指標；法律反歧視標準與技術測量之間缺乏橋接
美國 民權法律：《第七章》（就業）、《機會平等信貸法》（信貸）、《公平住房法》（住房） 跨領域的決策結果；模型輸出及納入其中的人類決策 部分指定 差異影響原則是法律標準，但不直接對應任何單一公平性指標；五分之四原則是執法準則而非安全港；信貸領域明確拒絕以黑箱為抗辯
中國 實質性反歧視義務（生成式AI辦法）；演算法透明度（演算法推薦規定） AI全生命週期：設計、訓練資料、模型生成、優化、服務提供 未指定 要求採取「有效措施」但未說明「有效」的技術含義；價值觀對齊義務與反歧視義務性質不同，不應混為一談

歐盟——基本權利與資料治理

《歐盟AI法案》透過兩項在合規討論中常被混淆的不同機制處理偏差問題。

第10條第2款第(f)項要求對資料集進行審查，以識別可能影響基本權利或導致歐盟法律禁止的歧視的偏差，特別是在資料輸出影響未來輸入的情況下。這是一項輸入端義務，針對的是訓練資料中的偏差。第10條第5款增設了有限的「去偏差例外」，在嚴格條件下允許為偵測和糾正偏差的目的處理敏感資料類別。

第14條第4款第(b)項針對不同的問題：自動化偏差。高風險AI系統的設計須能使人類監督者充分履行監督職能，避免過度依賴系統輸出。這是針對人類決策層的行為要求，而非模型屬性。多數聚焦於資料稽核的合規方案，並未就此項義務採取任何回應措施。

法案將公平性要求連結至「歐盟法律所禁止的歧視」——即現行歐盟反歧視指令及《歐盟基本權利憲章》——卻未說明這些法律標準如何在技術層面落地。「偏差」一詞在法案全文中從未獲得定義，測量方法亦未有規定。法律標準已然錨定，技術實施的橋樑卻付之闕如。受法案適用的機構，須與法律顧問共同釐清，就其具體使用情境而言，何種技術測量方式能夠回應法律反歧視標準的要求。

美國——橫跨多個領域的民權法律原則

美國迄今未制定全面的聯邦AI法規，現行民權法律框架承擔了反歧視義務的主要載體功能，並橫跨多個領域適用於AI媒介的決策。貫穿各領域的共同立場是：現行反歧視法律完整適用於演算法系統；以「由AI決策」為由提出抗辯，在現行法律框架下不能成立；使用第三方AI工具的機構，仍須對該工具所產出的歧視性結果承擔責任。

在就業領域，《第七章》下的差異影響原則適用於招募、晉升與解僱中使用的演算法決策工具。美國就業機會均等委員會（EEOC）已確認此類工具與其他任何甄選程序適用相同分析。五分之四原則——即受保護群體的錄取率低於最高得分群體80%時，通常被認為存在不利影響——是執法準則中的參考標準，並非法律本身，EEOC亦明確表示其不構成安全港。

在信貸與消費金融領域，《機會平等信貸法》及《消費者金融保護法》適用。美國消費者金融保護局（CFPB）已確認，法院已認定機構選擇使用演算法決策工具，本身即可構成差異影響理論下產生偏差的政策。尤其值得關注的是，CFPB明確拒絕黑箱抗辯：模型的複雜性或不透明性，不能用作違反《機會平等信貸法》的抗辯理由。公平貸款測試須同時涵蓋差異對待與差異影響分析，並須尋找歧視性較低的替代方案。

在住房與不動產評估領域，2024年CFPB聯合五家聯邦銀行監管機構頒布的規則，要求使用演算法評估工具的機構建立保障措施，確保估值準確性、資料完整性，並符合反歧視法律。

此處有一項值得特別釐清的精確性問題。五分之四原則與差異影響原則並不等同，差異影響原則亦不直接對應任何單一的技術公平性指標。AI公平性實務有時將人口均等性當作差異影響分析的技術代理，此舉在合規層面存在實質後果。通過人口均等性測試的模型，未必滿足差異影響義務；反之亦然。兩者之間的關係遠比一對一對應所暗示的複雜，應與熟悉相關民權法律框架的法律顧問共同釐清，而非逕行假設等同。

中國——實質性反歧視義務與價值觀對齊義務

中國的AI治理框架同時包含兩類公平性要求，二者各有其監管目的，性質上截然不同，不宜混為一談。

《生成式人工智能服務管理暫行辦法》（2023年8月施行）包含實質性反歧視義務：業者須在演算法設計、訓練資料選擇、模型生成與優化及服務提供等各環節，採取有效措施防止基於民族、宗教、國別或地區、性別、年齡、職業、健康等原因的歧視。這是一項涵蓋AI全生命週期的過程性義務，並非僅限於輸出端的監控。

《互聯網信息服務演算法推薦管理規定》（2022年3月施行）就演算法透明度、公平性、內容審核及演算法備案設定義務，並另行要求業者積極傳播「主流價值觀」、避免危害國家安全或擾亂社會秩序的內容。這項價值觀對齊義務在性質上與反歧視義務截然不同，服務於不同的監管目的。將兩者混同，既歪曲了中國的公平性要求，亦遮蔽了其所包含的實質性反歧視義務。

上述兩套規定，均未指明合規所需採用的測量方法論。反歧視義務要求業者採取「有效措施」，卻未賦予「有效」任何技術或統計層面的具體含義。在中國市場運營的機構，須與熟悉中國法律的顧問共同評估，何種過程設計與測量方法，足以在實務上支撐合規立場。

有意義的測量究竟需要什麼

有意義的偏差評估，不是一次性的技術測試，而是一系列必須在測量展開之前完成的治理決策。法務長與法遵長所收到的多數稽核報告，往往缺乏這一層認識——報告呈現一個指標結果，卻未說明選擇該指標的理由、考量過哪些替代方案，也未說明這一結果相對於適用法律標準究竟意味著什麼。

一份具備可辯護性的偏差評估，至少須就以下六項作出明確說明：

1
哪些受保護屬性納入範疇——以及原因
並非所有司法管轄區保護相同的屬性。部分屬性受法律保護，但在技術上難以取得或不適合用於測試。應納入範疇的屬性之選擇，是法律決策，而非技術預設，須與法律顧問共同確認並記錄說明理由。
2
測量的是哪些結果
批准率、錯誤率、評分分布與最終決策，是針對同一模型可能產生截然不同結論的不同結果指標。選擇測量哪種結果，本身即包含了對公平性應在決策流程哪個環節評估的假設。
3
在決策管線的哪個節點進行測量
偏差的引入與放大，可能發生在模型輸出層、人類採納模型建議的決策層，或最終結果層——三者均有可能。《歐盟AI法案》第14條針對自動化偏差的規定，已明確指出單一停留在模型層的測量不足以覆蓋全部合規要求。未就人類決策層進行評估的稽核報告，在合規覆蓋上存在結構性缺口。
4
以哪個基準線為參照
各群體間的結果比率相等、相似個體間的結果比率相等、錯誤率相等，或其他基準。每種基準線都包含了對「平等意味著什麼」的不同規範性假設——這項選擇具有法律含意，須予以明確說明。
5
採用哪種公平性指標——以及為何不採用其他指標
指標的選擇須作為治理決策記錄在案。若稽核採用人口均等性，應說明為何選擇人口均等性而非機會均等性或校準性，以及模型在這些替代定義下的表現如何。一份僅呈現其所滿足之指標、而未揭示模型在替代指標下表現的稽核報告，所呈現的是不完整的圖像。
6
所採用的指標與適用法律標準之間的關係
技術測量所採用的指標，未必對應相關司法管轄區監管執法所依據的差異影響標準、基本權利框架或反歧視義務。技術指標與法律標準之間的關係須經評估，若兩者之間存在落差，亦須予以處理——方可將稽核結果作為合規證據提交。

法務長與法遵長應當要求什麼

委託稽核前的核心問題

在委託任何偏差稽核之前，機構至少須先釐清以下事項：機構是否已刻意選擇了所要測量的公平性定義，並留有選擇理由的書面記錄？法律顧問是否已就此具體使用情境，確認了各相關司法管轄區所適用的法律標準？受保護屬性的範疇，是否已與法律顧問共同劃定，而非全數委由技術團隊決定？稽核範圍是否涵蓋決策管線的完整節點——模型輸出、人類決策與最終結果——抑或僅止於模型本身？

審閱稽核報告的關鍵提問

報告是否說明了採用何種公平性指標、選擇該指標的理由，以及捨棄其他指標的依據？是否揭示了模型在替代定義下的表現狀況？哪些受保護屬性被納入測試、在管線哪個節點進行、以何種基準線為參照，報告是否均有所說明？對於人類決策層的自動化偏差，報告是否有所觸及，或僅限於模型本身的測量？若已識別出差異，報告是否附有責任歸屬清晰、時程明確的糾正方案？

尤其關鍵的一點：報告是否說明了其發現與各相關司法管轄區法律標準之間的對應關係——而非只呈現技術指標本身？一份只陳述技術指標、未就法律標準進行銜接的稽核報告，不是合規文件，而是「某項測量已完成」的技術紀錄，兩者不可混同。

如何看待供應商的聲明

「無偏差AI」並非實質性聲明。這四個字背後所隱含的，是一個根本不存在的單一公認公平性標準。所謂「無偏差」，不過意味著產品在某種特定定義下通過了測試——而根據不相容性定理，這同時意味著在其他定義下必然存在缺陷。

「模型已完成偏差測試」這項聲明，唯有在明確說明測試方法論、採用的指標、涵蓋的受保護屬性、評估的管線節點，以及與適用法律標準之間的關係後，方具有實質意義。一份未就公平性定義的選擇及其理由作出說明的稽核報告，是缺乏規範性基礎的技術練習，並非合規文件。以此作為合規證據向監管機構或法院提交，其所製造的法律暴露，很可能大於其所緩解的風險。

正在面對這些問題？

本文所描述的分析，橫跨AI治理、資料科學方法論、法律反歧視標準與組織風險管理——多數機構並不具備在同一架構下整合上述能力的條件。若貴機構正在評估AI偏差合規立場，或對所接收的稽核報告存有疑問，歡迎與雲蔚聯繫。

聲明
本文僅供資訊參考，不構成法律意見。本文就監管框架應對AI公平性與偏差評估的一般性問題進行概括性探討。所提出之觀察係就一般情形而言，未能涵蓋各機構之具體情況、所在司法管轄區或適用之監管環境。如擬就具體事項採取行動，應尋求專業建議。