Measuring AI Governance: A Capability Maturity Model for Board-Level Oversight

Artificial Intelligence (AI) governance has emerged as a critical organisational and board-level concern as AI systems become increasingly embedded in business operations and decision-making. Although existing AI maturity models assess technological capability and deployment readiness, they provide limited mechanisms for evaluating governance effectiveness, accountability, and board oversight. Consequently, organisations lack structured approaches for assessing whether AI governance practices are achieving their intended objectives.
This study addresses this gap through the development of an AI Governance Capability Maturity Model that reconceptualises AI governance as a measurable organisational capability. Using a qualitative integrative synthesis of regulatory frameworks, legal doctrine, governance standards, and academic literature, the study identifies key governance mechanisms and integrates them within a six-phase governance framework. These governance phases are subsequently transformed into a five-level maturity model supported by a multi-dimensional measurement architecture comprising input, process, output, and outcome metrics.
The analysis demonstrates that existing maturity models focus primarily on AI deployment capability, while governance-oriented frameworks emphasise operational controls but provide limited support for performance evaluation, strategic governance, and board-level accountability. To address these limitations, the proposed model links governance processes to measurable indicators and maturity levels, enabling organisations to assess governance effectiveness, identify capability gaps, and monitor continuous improvement.
The study contributes to theory by positioning AI governance as a dynamic organisational capability rather than a collection of compliance activities. It contributes to practice by providing a structured framework that supports governance assessment, performance monitoring, and board oversight. The model aligns with emerging governance expectations reflected in the NIST AI Risk Management Framework, ISO/IEC 42001, and the European Union Artificial Intelligence Act.
By integrating governance processes, capability development, maturity assessment, and performance measurement, the proposed framework provides a practical and theoretically grounded approach for advancing responsible AI adoption and strengthening board-level governance oversight.

Artificial Intelligence Governance, Governance Capability Maturity Model, Board-Level Oversight, Responsible AI, AI Risk Management

1. Australian Institute of Company Directors (AICD) (2024) Governing Artificial Intelligence: Guidance for Boards. Sydney: AICD. [Google Scholar] [Crossref]

2. Eisenhardt, K.M. and Martin, J.A. (2000) ‘Dynamic capabilities: What are they?’, Strategic Management Journal, 21(10–11), pp. 1105–1121. [Google Scholar] [Crossref]

3. Dwivedi, Y.K. et al. (2021) ‘Artificial Intelligence (AI): Multidisciplinary perspectives on emerging challenges, opportunities, and agenda for research, practice and policy’, International Journal of Information Management, 57, Article 101994. https://doi.org/10.1016/j.ijinfomgt.2019.08.002 [Google Scholar] [Crossref]

4. European Union (2024) Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, Brussels. [Google Scholar] [Crossref]

5. Floridi, L. et al. (2018) ‘AI4People—An ethical framework for a good AI society: Opportunities, risks, principles, and recommendations’, Minds and Machines, 28(4), pp. 689–707. [Google Scholar] [Crossref]

6. International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) (2023) ISO/IEC 42001:2023 Artificial intelligence — Management system requirements. Geneva: ISO. [Google Scholar] [Crossref]

7. Jobin, A., Ienca, M. and Vayena, E. (2019) ‘The global landscape of AI ethics guidelines’, Nature Machine Intelligence, 1(9), pp. 389–399. [Google Scholar] [Crossref]

8. Kaplan, R.S. and Norton, D.P. (1996) The balanced scorecard: Translating strategy into action. Boston: Harvard Business School Press. [Google Scholar] [Crossref]

9. Mallin, C.A. (2019) Corporate Governance. 6th edn. Oxford: Oxford University Press. [Google Scholar] [Crossref]

10. Mittelstadt, B. (2019) ‘Principles alone cannot guarantee ethical AI’, Nature Machine Intelligence, 1(11), pp. 501–507. [Google Scholar] [Crossref]

11. National Institute of Standards and Technology (NIST) (2023) Artificial Intelligence Risk Management Framework (AI RMF 1.0). Gaithersburg, MD: NIST. [Google Scholar] [Crossref]

12. Neely, A., Gregory, M. and Platts, K. (2005) ‘Performance measurement system design: A literature review and research agenda’, International Journal of Operations & Production Management, 25(12), pp. 1228–1263. [Google Scholar] [Crossref]

13. OECD (2019) OECD Principles on Artificial Intelligence. Paris: OECD. [Google Scholar] [Crossref]

14. Raji, I.D. et al. (2020) ‘Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing’, Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAccT '20), pp. 33–44. [Google Scholar] [Crossref]

15. Schumacher, A., Erol, S. and Sihn, W. (2016) ‘A maturity model for assessing Industry 4.0 readiness and maturity of manufacturing enterprises’, Procedia CIRP, 52, pp. 161–166. [Google Scholar] [Crossref]

16. Sonntag, M., Mehmann, S., Mehmann, J. and Teuteberg, F. (2024) ‘Development and evaluation of a maturity model for AI deployment capability of manufacturing companies’, Information Systems Management, 42(1), pp. 37–67. doi:10.1080/10580530.2024.2319041 [Google Scholar] [Crossref]

17. Teece, D.J. (2007) ‘Explicating dynamic capabilities: The nature and microfoundations of (sustainable) enterprise performance’, Strategic Management Journal, 28(13), pp. 1319–1350. [Google Scholar] [Crossref]

18. Tricker, B. (2019) Corporate Governance: Principles, Policies, and Practices. 4th edn. Oxford: Oxford University Press. [Google Scholar] [Crossref]

19. Wendler, R. (2012) ‘The maturity of maturity model research: A systematic mapping study’, Information and Software Technology, 54(12), pp. 1317–1339. [Google Scholar] [Crossref]

20. Wong, B. (2025) ‘AI in corporations: Legal and environmental risks and their impact on leadership, governance, and sustainability in Australia’, International Journal of Environmental Sciences, 11(20s), pp. 467–474. Available: https://theaspd.com/index.php/ijes/article/view/5751/4167 [Google Scholar] [Crossref]

21. Wong, B. (2026) 'Operationalising AI Legal Governance: A Regulatory Compliance Framework for AI Systems', Journal of International Commercial Law and Technology, 7(1), pp 1374-1384. Available: https://jiclt.com/article/operationalising-ai-legal-governance-a-regulatory-compliance-framework-for-ai-systems--459/ [Google Scholar] [Crossref]

22. Wong, B. (2026a). Human-Centred Governance for Responsible AI Adoption: Enabling Sustainable Business Transformation and Societal Value. Accepted for presentation at the 17th International Conference on Applied Human Factors and Ergonomics (AHFE 2026), Istanbul, Türkiye, 20–24 July 2026 [Google Scholar] [Crossref]

• Assessment of the Role of Artificial Intelligence in Repositioning TVET for Economic Development in Nigeria
• Teachers’ Use of Assure Model Instructional Design on Learners’ Problem Solving Efficacy in Secondary Schools in Bungoma County, Kenya
• “E-Booksan Ang Kaalaman”: Development, Validation, and Utilization of Electronic Book in Academic Performance of Grade 9 Students in Social Studies
• Analyzing EFL University Students’ Academic Speaking Skills Through Self-Recorded Video Presentation
• Major Findings of The Study on Total Quality Management in Teachers’ Education Institutions (TEIs) In Assam – An Evaluative Study