The study, authored by Nirmal Acharya of Central Queensland University and Padmaja Kar of the Australian International Institute of Higher Education, argues that conventional transport-AI governance was built for a different species of machine. Older tools such as adaptive signal controllers, origin-destination estimators, and automatic vehicle location pipelines had bounded decision envelopes, numerical outputs, and failure modes that could be written into procurement documents. Generative systems break every one of those assumptions simultaneously. Their outputs are open-ended natural language, their failure modes include hallucination and prompt injection, and their decision envelopes shift whenever a vendor silently updates the base model, something a municipal contract cannot pin down.

The authors first test whether the four canonical cross-sector AI instruments can fill the void: the NIST AI Risk Management Framework, the EU AI Act, the OECD AI Principles, and ISO/IEC 42001. Each, they conclude, is serious but insufficient. The NIST framework’s domain-agnostic functions do not specify safety-critical, spatially distributed failure modes. The EU AI Act’s high-risk obligations assume the product-lifecycle conformity familiar from medical devices, not foundation models that retrain continuously. The OECD principles are non-binding and offer no maturity scale, and ISO/IEC 42001’s annual audit cadence is incompatible with systems that drift on weekly timescales. These instruments answer what values an agency should uphold, but not how mature a given system’s governance is today or what the next operational increment should be.

To make the gap tractable, the paper organizes the missing controls into six governance voids, split into two classes. Operability voids break day-to-day assurance: output-level traceability, where a single prompt’s output cannot be traced to an audit artifact because prompt-response logs and versioned model snapshots are not contractually retained; audit-cadence mismatch, where a system passes a scheduled audit and then changes materially the following week through a vendor-side update; and meaningful human control, where operators flooded with high-frequency co-pilot recommendations learn to rubber-stamp approvals, leaving logs that are formally complete but cognitively empty. Institutional voids break the contracts that make operability enforceable: liability diffusion across the vendor, integrator, and operator chain; equity measurement that ignores the conversational surface where accents and dialects determine whether service is delivered at all; and cross-jurisdictional portability, where conformity in a strict regulatory regime does not transfer to a lighter one.

The remedy is a five-pillar lifecycle governance framework: transparency and explainability, accountability and liability, equity and non-discrimination, auditability and oversight, and human-in/on-the-loop control. Each pillar carries a five-level maturity scale from 0 to 4, anchored in concrete transport failure scenarios. On transparency, level 2 requires public model cards, disclosed geographic and linguistic training boundaries, and prompt-response logs retained for at least 90 days, while level 4 offers citizens a public API to query and appeal decisions. On accountability, level 2 demands a formally mapped decision authority chain, frozen third-party updates before validation, and insurance covering generative-AI failures. On human control, level 2 requires a real-time override usable within five seconds and logged in structured form.

The framework’s dependency lattice is where the argument becomes sharpest: transparency feeds auditability, which feeds accountability, which feeds human control, with equity feeding back into transparency as disparate-impact findings reveal which lineages must be disclosed. The ordering is causal, not decorative. A city that writes strong accountability contracts while publishing no model or data-lineage cards cannot enforce those contracts after an incident, because the audit trail needed to allocate responsibility does not exist. Similarly, operators pressing override controls cannot reconstruct outcomes if auditability is missing. The authors frame this as a ceiling effect rather than a temporal rule: upstream maturity is necessary but not sufficient, and out-of-order investment yields diminishing returns rather than certain failure.

What distinguishes the paper from most governance literature is its commitment to falsifiability. The authors propose twelve testable propositions linking pillar maturity to observable outcomes, including incident severity, mean-time-to-resolution, disparate-impact detection latency, override-exercise rate, deployment survival, and public trust. Candidate designs range from partial least squares structural equation modeling on transit-authority surveys, to difference-in-differences comparisons of matched incidents, to Cox proportional-hazards survival analysis on metropolitan pilots, to scenario-based rider surveys testing whether transparency builds trust indirectly through perceived contestability. All sample sizes are explicitly labeled as illustrative pending pilot power analysis, and the authors stress that no proposition counts as tested until its design is pre-registered.

For practice, the framework translates into a procurement-grade baseline of level 2 on all five pillars, written into generative-AI tenders as enforceable evaluation criteria. Agencies are advised to negotiate clauses requiring at least 24 hours notice of vendor-side model updates and prompt-log retention of at least 90 days. Vendors get design-phase boundaries, and regulators get a lifecycle conformity-assessment scaffold calibrated to generative drift timescales rather than annual cycles, with jurisdictions able to set minimum pillar levels vendors must demonstrate across all operating territories to prevent governance race-to-the-bottom. The authors caution that the framework is theoretically derived and not yet empirically validated, and that data-access friction, particularly undisclosed vendor prompt logs, will require partnerships with municipal authorities.

The validation path proceeds in three phases: pilot testing of the maturity matrix on three to five metropolitan planning organizations with inter-rater reliability targets, early empirical tests of four propositions using publicly available data, and comparative case studies of the cross-pillar predictions over six-to-eighteen-month operating windows. Whether the framework survives contact with real dispatch rooms, chatbot deployments, and signal-control centers will determine if generative AI in urban mobility gets the lifecycle scaffolding that, the authors argue, currently exists nowhere in the transport governance toolkit.

Subject of Research: Governance of generative AI in urban mobility operations

Article Title: Governing generative AI in urban mobility: a five-pillar framework and twelve falsifiable propositions for operations, accountability, and public trust

Article References: Acharya, N., & Kar, P. (2026). Governing generative AI in urban mobility: a five-pillar framework and twelve falsifiable propositions for operations, accountability, and public trust. Frontiers in Future Transportation, 7, Article 1951756. https://doi.org/10.3389/ffutr.2026.1951756

Image Credits: AI Generated

DOI: 10.3389/ffutr.2026.1951756

Keywords: generative AI, urban mobility, governance framework, transport policy, AI accountability, algorithmic auditing, public transit, foundation models, AI ethics, maturity model, human-in-the-loop, transport governance