Measuring AI Governance: A Capability Maturity Model for Board-Level Oversight

Abstract

Artificial Intelligence (AI) governance has emerged as a critical organisational and board-level concern as AI systems become increasingly embedded in business operations and decision-making. Although existing AI maturity models assess technological capability and deployment readiness, they provide limited mechanisms for evaluating governance effectiveness, accountability, and board oversight. Consequently, organisations lack structured approaches for assessing whether AI governance practices are achieving their intended objectives. This study addresses this gap through the development of an AI Governance Capability Maturity Model that reconceptualises AI governance as a measurable organisational capability. Using a qualitative integrative synthesis of regulatory frameworks, legal doctrine, governance standards, and academic literature, the study identifies key governance mechanisms and integrates them within a six-phase governance framework. These governance phases are subsequently transformed into a five-level maturity model supported by a multi-dimensional measurement architecture comprising input, process, output, and outcome metrics. The analysis demonstrates that existing maturity models focus primarily on AI deployment capability, while governance-oriented frameworks emphasise operational controls but provide limited support for performance evaluation, strategic governance, and board-level accountability. To address these limitations, the proposed model links governance processes to measurable indicators and maturity levels, enabling organisations to assess governance effectiveness, identify capability gaps, and monitor continuous improvement. The study contributes to theory by positioning AI governance as a dynamic organisational capability rather than a collection of compliance activities. It contributes to practice by providing a structured framework that supports governance assessment, performance monitoring, and board oversight. The model aligns with emerging governance expectations reflected in the NIST AI Risk Management Framework, ISO/IEC 42001, and the European Union Artificial Intelligence Act. By integrating governance processes, capability development, maturity assessment, and performance measurement, the proposed framework provides a practical and theoretically grounded approach for advancing responsible AI adoption and strengthening board-level governance oversight.