The scientific foundation of DQPA rests on two pillars of international standardization. ISO 8000 establishes the principles of data quality management, while the ISO/IEC 33000 family provides the general mechanism for process capability assessment: a process reference model, process attributes rated on an ordinal scale, and a maturity model that aggregates those attributes into organizational levels. Although this mechanism has a long track record in domains such as software development, Green IT, and data quality certification, no international instantiation had ever covered data governance, data management, and data quality management jointly as integrated disciplines. The only ISO instantiation for the data domain, the ISO 8000-6x series, is confined to data quality management alone. The researchers built on a direct precedent, the MAMD model, and on the UNE 0077 through 0080 specifications—what they describe as the first standardization initiative to close that gap with normative status—enriched with the governance principles of ISO/IEC 38505 and the DAMA-DMBOK body of knowledge.

What distinguishes self-assessment from formal certification is its purpose. Under ISO/IEC 33000, assessment by an independent team enables certification with validity toward third parties, while self-assessment, performed by the organization itself, is an equally recognized application of the same method aimed at understanding one’s own situation recurrently and affordably as a basis for continuous improvement. Until now, no adequate instrument has existed for this second application, for two reasons. Independent assessment is too costly to repeat frequently, and its most expensive phase—evidence collection—depends heavily on tacit human knowledge that is difficult to automate. Moreover, translating normative processes into language that business profiles can act upon, one of the very purposes of data governance, rarely occurs in manual practice. Existing frameworks fall short in different ways: COBIT 2019 lacks an integrated data-domain maturity model; DCAM and CMMI-DMM support self-assessment but are not grounded in ISO/IEC 33000; and DAMA-DMBOK systematizes the disciplines without defining a maturity model of its own. None combines integrated coverage, an ISO/IEC 33000-based mechanism, automated scoring, automated recommendations, and open-source availability.

DQPA’s architecture is deliberately engineered around a strict separation between deterministic computation and generative artificial intelligence. The platform is a multilayer web application: a React single-page client, a Node.js and Express server exposing a REST API and hosting the deterministic assessment engine, a MongoDB document store accessed through Mongoose, and an external large language model service invoked only after results have been computed. Authentication is token-based with role-based access control, and both tiers deploy as independent containers. Crucially, the normative model itself—processes, questions, weightings, and improvement tasks—is maintained as configurable data through an administration module restricted to expert users, meaning the platform can adapt to revisions of the specifications or even to equivalent frameworks without touching the source code. This data-driven design is what makes the tool reusable and future-proof in a way that hard-coded assessment instruments cannot be.

The heart of the platform is its assessment engine, which algorithmically reproduces the measurement framework of ISO/IEC 33020. Question answers are first converted into weighted percentage scores at two granularities: one per process, from process-specific capability-level-1 questions, and one per capability level from 2 to 5, from cross-cutting questions shared across the scope. The four-category achievement scale maps onto these scores: Not implemented for 0 to 15 percent, Partially implemented for above 15 to 50 percent, Largely implemented for above 50 to 85 percent, and Fully implemented for above 85 to 100 percent. The staged aggregation rule then applies: a process reaches a given capability level when its process-specific score and all lower cross-cutting scores are Fully achieved and the score at that level is at least Largely achieved. The organizational maturity level, on a six-level scale from 0 to 5, is derived from the consolidated capability of the assessed processes in a staged manner. The entire computation is deterministic, traceable, and executed without any intervention from humans or the AI service—a design choice the authors argue is a property rather than a limitation, because transparency and auditability are explicit requirements of the ISO/IEC 33000 method itself.

Only after the numbers are settled does artificial intelligence enter the picture—and the boundaries are strict. The recommendation service neither trains nor fine-tunes any model. Instead, a pre-trained language model, Gemini 2.0 Flash Lite, selected after a structured comparison against alternatives including GPT-4o and GPT-4.1 nano for its large context window and high throughput, is conditioned at inference time by a purpose-built structured prompt. The model’s grounding is entirely deterministic: its input consists solely of the computed as-is state—levels, ratings, and gaps—and a catalogue of predefined improvement tasks curated by domain experts from an anonymized corpus of real projects, assessment reports, standards, and technical documentation. The prompt explicitly forbids the re-computation of levels and imposes prioritization criteria including impact on maturity, criticality of the gap, dependencies, feasibility, urgency, and normative alignment. If the model call fails, the service degrades gracefully to a template-based ordering of the curated catalogue, so a usable plan is always produced without the generative component.

The platform was validated in striking fashion against a real organization: a Spanish public river basin management body responsible for hydrological data acquisition and exploitation. Questionnaire responses were recorded in parallel through DQPA and through the manual procedure of an external expert assessment team, with each business process owner completing the instrument in roughly two and a half hours with support from assessors. The engine computed a largely achieved process-specific score, a partially achieved level-2 dimension, and an unattained level-3 dimension, yielding maturity level 1—precisely the level determined independently by the human experts. Verification went further: the engine’s logic was exhaustively checked against a reference spreadsheet used by the consulting team in professional practice, across all 1,024 possible rating combinations, with full agreement in every case, including boundary conditions between capability levels.

The quality of the AI-generated recommendations was then scrutinized by four expert evaluators—three of them external to the author team and blind to the study—who rated thirty recommendations on a five-point rubric covering consistency with the computed state, alignment with the specifications, actionability, and clarity for non-technical profiles. The overall mean was 4.35 out of 5, with no two evaluators differing by more than one point on any of the 480 ratings, and the restricted external-only mean of 4.23 confirmed the result does not depend on the internal rater. The platform was also applied to three further organizations—a local public administration, a port authority operating critical infrastructure, and a large private technology corporation—producing consistent operation across markedly different sectors, with resulting maturity levels ranging from 0 to 1. Perceived usability, measured with the System Usability Scale across four participants, averaged 80.6, comfortably above the scale’s commonly cited average of about 68. Performance testing showed the deterministic engine computing results in a median of 105 milliseconds and sustaining 150 concurrent users, while end-to-end report generation took a median of three seconds, dominated by the external model call.

The implications reach well beyond convenience. For public administrations and resource-constrained organizations facing obligations under the European Data Governance Regulation, DQPA substantially lowers the barrier to understanding and improving their data practices without depending on scarce certified assessors. For researchers, the platform’s elimination of inter-assessor variability in the computation phase opens the door to genuinely reproducible, longitudinal, and sector-level empirical study of data maturity—questions such as which processes systematically act as bottlenecks, or how maturity evolves after improvement plans are applied, that have been nearly impossible to address empirically until now. The authors are careful to delimit their claims: the platform does not verify declared evidence, cannot prevent deliberate misstatement, does not replace third-party certification, and its recommendations must be contextualized by each organization since the AI knows nothing of internal budgets or politics. Future work includes ablation studies contrasting catalogue-anchored with unconstrained generation, a self-hosted AI deployment for stricter data-residency control, sector-level benchmarking, and what-if simulation of improvement scenarios under explicit resource constraints. But the core message is already clear: the machinery once reserved for expensive consulting engagements has been reproduced as transparent, inspectable, open-source software that any organization can pick up and run.

Subject of Research: An open-source software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity

Article Title: DQPA: A software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity

Article References: Gualo, F., Ayuso, Y., Caballero, I., & Piattini, M. (2026). DQPA: A software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity. SoftwareX, 35, Article 103012. https://doi.org/10.1016/j.softx.2026.103012

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103012

Keywords: data governance, data quality, data management, maturity models, ISO/IEC 33000, ISO 8000, self-assessment, process capability, large language models, open-source software, SoftwareX, UNE 0080