I worked in a LTE stack software and in that software, PDCP layer was generating MAC-I for the RRC message that was being sent from eNodeB to UE. This MAC-I appended with the RRC message and after that encryption is applied.
In case of rrc re-establishment procedure, RRC Re-establishment Request message carries short-MAC-I information. Since PDCP layer already has both algorithms to perform integrity and ciphering of RRC messages, MAC-I can be calculated at PDCP layer and get back at the RRC layer. RRC layer compares the short-MAC-I of the RRC re-establishment request message with the 16 least significant bits of MAC-I, just to make sure that this is valid RRC re-establishment request message.
In short, for the validation of short-MAC-I, RRC layer prepares and send the message to PDCP. After getting the response from PDCP layer, it compares. This is one kind of implementation in which I worked. It is completely dependent on vendor specific implementation.