Governing generative AI in urban mobility: a five-pillar framework and twelve falsifiable propositions for operations, accountability, and public trust

1 Introduction

1.1 The four-quadrant problem

Urban mobility operations are entering a phase of transformation. Within a short window, generative AI systems have moved from research demonstrations to operational deployments in dispatch rooms, traffic management centers, para-transit scheduling platforms, and customer-facing mobility-as-a-service interfaces (Movahedi and Choi, 2025; Wang and Shalaby, 2025). Foundation models now coordinate multimodal transfers, draft rescheduling instructions, generate synthetic demand scenarios, and reason above deep RL signal controllers (Wang and Shalaby, 2025; Yang et al., 2026); the methodological capacity has crossed a deployment threshold.

What has not crossed a comparable threshold is the governance architecture. Conventional transport-AI oversight was developed for narrow predictive models (adaptive signal controllers, origin–destination estimators, and automatic vehicle location pipelines) whose decision envelopes were bounded, outputs were numerical, and failure modes were specifiable in procurement documents. Generative systems break each assumption simultaneously: outputs are open-ended natural language, failure modes include hallucination and prompt-injection, and decision envelopes shift with vendor-side model updates that municipal contracts cannot pin down (Bender et al., 2021).

This produces a structurally asymmetric quadrant, where methods mature and governance is absent, which is diagnosed in Figure 1 as the four-quadrant problem. The other three quadrants have institutional remedies; however, the methods-mature–governance-absent quadrant does not, because the speed delivering methodological capacity outpaces committee-driven governance cycles (Hopkins and Schwanen, 2018; Gasser and Almeida, 2017; Mittelstadt, 2019). The asymmetry operationalizes the foundational claim that mature technical methods require formalized fairness constraints and audit machinery (Dwork et al., 2012).

1.2 Why the four reference instruments are not enough

Public agencies reaching for governance scaffolding typically consult one of the four canonical cross-sector AI instruments: NIST AI RMF 1.0, the EU AI Act (2024), the OECD AI Principles (2019/2024), and ISO/IEC 42001:2023 (Tabassi, 2023; Smuha, 2025; Organisation for Economic Co-operation and Development OECD, 2019; Benraouane, 2024). Each is serious; however, none is sufficient for transport operations.

The NIST AI RMF organizes risk around four functions (govern, map, measure, and manage) (Tabassi, 2023), but its domain-agnostic functions do not specify safety-critical, spatially distributed failure modes. The EU AI Act’s high-risk transport obligations assume product-lifecycle conformity familiar to medical devices, not foundation-model continuous retraining (Smuha, 2025). The OECD AI Principles are non-binding and supply no operational maturity scale (Organisation for Economic Co-operation and Development OECD, 2019). ISO/IEC 42001s annual audit cadence is incompatible with systems that drift weekly (Benraouane, 2024). The instruments sit within a broader ethical discourse: Floridi and Cowls’s five-principle synthesis for AI in society (Floridi and Cowls, 2019) and the AI4People ethical framework (Floridi et al., 2018), which articulate what values should be upheld but, like the regulatory instruments, leave the transport-specific maturity gradient unspecified (Gasser and Almeida, 2017). The fact that principles alone cannot guarantee ethical AI (Mittelstadt, 2019), combined with documented governance voids in data-extractive AI systems (Zuboff, 2015) and the global data-justice framing of cross-border infrastructure asymmetries (Taylor, 2019), reinforces the gap between values and operational governance.

In short, the four instruments answer what governance values should a public agency uphold? However, they do not answer how mature is this system’s governance today, and what is the next operational increment (Gasser and Almeida, 2017)?

1.3 Contribution of the study

This study offers three contributions: (1) a five-pillar lifecycle governance framework custom-built for generative mobility, with each pillar operationalized through a five-level maturity scale anchored in transport failure scenarios; (2) a structural dependency lattice demonstrating why out-of-order progressions (e.g., high accountability without baseline transparency) are unstable; and (3) 12 falsifiable propositions linking pillar maturity to operational outcomes, supplying an empirical agenda for SEM, survival analysis, and scenario-based survey research. The framework is situated within the responsible-urban-AI conversation opened by Calzada (2025), and “trustworthy for whom” remains the unresolved question for generative systems in municipal services.

1.4 Research questions

The following three research questions structure the analysis.

• RQ1. What structural failures of conventional transport-AI governance does generative-AI entry expose?
• RQ2. What transport-specific pillars are required, and what is the operational maturity increment for each?
• RQ3. What observable outcomes covary with pillar maturity, and which designs can falsify those covariances?

2 Background: generative AI in urban mobility operations

2.1 Use-case taxonomy

Seven deployment vectors constitute the principal application surface of generative AI in urban mobility (Figure 2); several remain at pilot rather than full deployment.

LLM-driven signal control. LLMs function as high-level reasoners above deep RL controllers, generating natural-language justifications for phase changes, accepting dispatcher queries, and proposing override actions during incidents (Movahedi and Choi, 2025; Sural and Naren, 2024); adversarial-scenario generation via diffusion-based synthesis (Wang et al., 2025; Bai et al., 2025) has begun to expose the failure surface of these pipelines. The lineage-failure class addressed by Pillar 1 of the present framework is already documented in adjacent transport-AI work: Jaradat, Acharya et al. (2025) deployed a fine-tuned LLM (GPT-3.5) on 6,400 crash reports and flagged 80 work-zone label mismatches, of which expert review confirmed four genuine misclassifications, i.e., audit-relevant label corruption that an automated pipeline can surface before it propagates into downstream generative models (Jaradat et al., 2025).

Route planning with foundation models. Generative planners propose para-transit and micro-mobility routes, draft multimodal transfer instructions, and produce contingency schedules (Wang and Shalaby, 2025; Yang et al., 2026), ingesting textual and visual context to produce human-legible routing rationales unlike classical shortest-path solvers.

Demand forecasting via generative simulation. Conditional diffusion models synthesize travel-demand scenarios under extreme conditions (Lou, 2025; Wang et al., 2025), enabling planning exercises that four-step models cannot supply.

Customer-service chatbots. Conversational interfaces handle ticketing, wayfinding, accessibility inquiries, and disruption rebooking; in several voice-first deployments (Yang et al., 2026; Larsen et al., 2025), they are the vector that is most exposed to linguistic and dialect exclusion.

Multi-modal coordination. Generative agents negotiate across bus, rail, micro-mobility, and active-mode operators to balance disruptions, draft coordinated contingency messages, and synchronize headways (Wang and Shalaby, 2025); related multi-agent coordination patterns appear in adjacent autonomous inspection settings (Din et al., 2026). This agentic pattern is the architecturally novel and least governance-mature vector.

Autonomous fleet management. Foundation models act as co-pilots above autonomous vehicle stacks, providing zero-shot contextual exception routing, drafting incident reports, and querying remote dispatchers (Sural and Naren, 2024), a failure surface distinct from the vehicle control loop. Trolley-problem and social-dilemma framings (Bonnefon et al., 2016) and large-scale cross-cultural preference evidence (Awad et al., 2018) supply the moral geometry within which any agentic decision is inscribed.

Generative design of road infrastructure. A smaller emerging vector uses generative design to propose corridor geometries, intersection layouts, and signal-timing plans; outputs are typically reviewed by engineers rather than executed autonomously.

2.2 Deployment-readiness gradient

The seven vectors are not at uniform deployment readiness. Customer-service chatbots and LLM-above-RL signal controllers have been reported in pilot and early production deployments in several cities, though multi-metro production status remains unevenly documented. Generative demand simulation is operational for offline planning. Agentic multi-modal coordination is in pilot. Generative infrastructure design remains experimental. National-scale AV-policy preparation frameworks already documented the gradient (Acheampong et al., 2021; Fagnant and Kockelman, 2015); generative AI accelerates that timeline. Governance maturity expectations should scale accordingly: a chatbot at scale demands higher transparency and auditability than a generative design tool still in research evaluation.

2.3 What makes generative systems different from predictive transport AI

Three properties distinguish generative systems from the predictive transport AI that existing governance instruments were designed for. First, output open-endedness: generative systems produce natural-language, image, or trajectory outputs whose semantic content cannot be validated against a finite enumerated specification; the resulting “spatial hallucination” risk is documented in the hallucination literature (Ji et al., 2023). Second, probabilistic decision envelopes: the same input can yield materially different outputs across runs, making deterministic test-and-accept procurement procedures unreliable (Bender et al., 2021). Third, direct-to-human legibility: outputs are surfaced to operators and citizens without translation, exposing the conversational surface to linguistic exclusion; web-scale training corpora themselves carry documented bias (Baeza-Yates, 2018). Together, these properties produce the governance vacuum diagnosed in Section 1.1.

3 The governance voids

3.1 Introduction

This section recasts the six weaknesses diagnosed in the submitted manuscript not as incremental ‘gaps’ closable by patching existing instruments but as governance voids—structural absences where no current transport, product-safety, or AI-management regime supplies lifecycle scaffolding for open-ended, probabilistic, and directly legible generative systems. A gap implies a missing control within an otherwise functioning governance function; a void implies that the function itself is absent across the system lifecycle, from procurement and data-lineage capture through deployment, continuous operation, and retirement. To make the structure tractable, the six voids are regrouped into a two-class taxonomy. Operability voids (Sections 3.1–3.3) break day-to-day operation and assurance—whether an output can be traced, re-audited, and meaningfully controlled. Institutional voids (Sections 3.4–3.6) break the contracts, metrics, and jurisdictional arrangements that make operability enforceable—how liability, equity, and portability are allocated and measured. The taxonomy is anchored to the lifecycle in Figure 2: each void is located where the seven deployment vectors most acutely stress current practice, and it is bridged forward to the pillar remedies in Figure 3.

3.2 Operability void—output-level traceability

→ Pillar tag: primary, P1 transparency and explainability; secondary, P4 auditability and oversight.

Procurement-side traceability in classical transport IT assumes a versioned code base whose decision logic can be inspected and replayed. Foundation-model deployments invert this assumption: the base model is maintained by a vendor, fine-tuning datasets are updated silently, and inference behavior is conditioned on runtime temperature, prompt composition, and retrieved context (Bender et al., 2021; Mitchell et al., 2019). A single prompt’s output is, therefore, not traceable to a single audit artefact; post-incident reconstruction requires prompt-response logs, retrieval indices, and versioned model snapshots that most procurement contracts do not require vendors to retain (Metaxa et al., 2021).

Failure mode. The lineage problem is not hypothetical in adjacent transport-AI work: Jaradat et al. (2025) showed that an LLM audit of 6,400 work-zone crash records flagged 80 construction-zone label mismatches, with expert review confirming four genuine misclassifications, which is a lineage-sensitive labeling failure that a downstream generative model could inherit without per-record provenance checks (Jaradat et al., 2025). The class of failure scales markedly when the consumer of the data is an open-ended generative system rather than a narrow classifier, the precise scenario P1 is designed to detect.

3.3 Operability void—audit-cadence mismatch

→ Pillar tag: primary, P4 auditability and oversight; secondary, P1 transparency and explainability.

Annual or quarterly audit cadences aligned to fiscal cycles suffice for static deployments. Generative systems drift on weekly-to-monthly timescales as vendors update base models, conversational training data accumulates, and adversarial pressure shifts; the audit-cadence mismatch means that audits routinely certify a system that has already changed materially since the audit window closed (Costanza-Chock et al., 2022).

Failure mode. In operational terms, a system passes its scheduled audit, undergoes a vendor-side base-model update or accumulates shifted conversational data the following week, and then operates for months in a materially altered state without an independent red-team or drift monitor until the next audit cycle. Post-incident review, therefore, reconstructs a system that no longer exists, and drift-induced degradation remains undetected between audit points.

3.4 Operability void—meaningful human control

→ Pillar tag: primary, P5 human-in/on-the-loop control; secondary, P4 auditability and oversight.

Human-in-the-loop designs in classical transport IT (dispatcher approval of route changes and operator override of signal phases) were constructed around bounded decisions requiring seconds-to-minutes of cognitive review. Generative co-pilots produce high-frequency, low-stakes recommendations that train operators to rubber-stamp by default. When a high-stakes recommendation arrives, approval fatigue and cognitive lock-up combine to produce a meaningful-control gap: human approval that is present in form but absent in cognitive substance (Sheridan, 2021; Wickens et al., 2015). Without an articulated trust contract (Jacovi et al., 2021), a rubber-stamp approval cannot be distinguished from a substantive one. Recent takeover-experiment work (Qin et al., 2026) shows partial-automation conditions elevate cognitive load even at short horizons.

Failure mode. A metropolitan dispatch room integrating an LLM co-pilot that drafts automated rescheduling instructions during minor delays sees controllers systematically approve without reading route changes; during a major disruption, operators deskilled by long-term reliance cannot formulate a manual plan and accept flawed recommendations, leaving the approval log formally complete but cognitively empty.

3.5 Institutional void—liability diffusion across the LLM stack

→ Pillar tag: primary, P2 accountability and liability; secondary, P4 auditability and oversight.

When a generative system causes harm, liability can, in principle, attach to the foundation-model vendor, fine-tuning integrator, deployment operator, human dispatcher, or procuring public agency. Existing municipal contracts were drafted for vendor-as-product-seller relationships and rarely apportion liability for vendor-side silent updates, third-party base-model drift, or agentic actions (Smuha, 2025), producing liability diffusion that over-deters cautious vendors and under-deters negligent operators.

Failure mode. An LLM-based traffic-signal coordinator, silently updated by a SaaS vendor, alters routing logic to prioritize high-emission delivery vehicles over emergency vehicles, or an agentic micro-mobility dispatcher cancels para-transit services in a low-income area to maximize dynamic-pricing revenue; in either case, the authority faces a claim but holds no contractual clause that cleanly allocates responsibility for third-party model tuning or autonomous optimization, leaving enforcement without the lineage to enforce it.

3.6 Institutional void—equity and linguistic-accessibility measurement

→ Pillar tag: primary, P3 equity and non-discrimination; secondary, P1 transparency and explainability.

Predictive transport AI is audited for disparate impact using confusion-matrix parity metrics on fixed input features (race inferred from geocoded residence and age from smartcard history). Generative systems introduce a second equity surface, the conversational one, where accent, dialect, and idiom determine whether a service is even delivered. Spatial demographic redlining can re-emerge inside the embedding space of multimodal foundation models even when the surface decision rule is nominally neutral; the bias-from-language-data literature demonstrates that semantic content derives human-like biases directly from the training corpora (Caliskan et al., 2017), and standard disparate-impact audits are not calibrated for embedding-level bias. The broader bias-and-fairness literature (Mehrabi et al., 2021) has only begun to address how urban digital divides and smart-city infrastructures condition equity outcomes relevant to post-deployment monitoring (Caragliu and Del Bo, 2023). Empirical anchors substantiate the equity risks that the E2 maturity level operationalizes: documented TNC-rider discrimination (Ge et al., 2020), sharing-economy audit-confirmed discrimination (Edelman et al., 2017), and transport-justice scholarship (Verlinghieri and Schwanen, 2020).

Failure mode. A municipal mobility-as-a-service chatbot with a voice engine that fails to parse regional accents produces repeated booking failures for elderly and migrant riders, while a multi-agent traffic simulator optimized to reduce municipal emissions routes heavy freight through communities of color because demographic-priority weights in the embedding space under-weight those geographies—failures that are invisible to aggregate parity metrics that do not measure conversational or embedding-level disparity.

3.7 Institutional void—cross-jurisdictional portability

→ Pillar tag: primary, P2 accountability and liability; secondary, P4 auditability and oversight.

Transit authorities increasingly procure AI services from multinational vendors operating across regulatory regimes. A vendor’s conformity with the EU AI Act in one jurisdiction does not guarantee portability to a lighter-regime jurisdiction, and the converse holds (Benraouane, 2024); without explicit portability scaffolding, agencies face a binary choice between accepting lowest-common-denominator governance and incurring unaffordable jurisdiction-specific adaptations.

Failure mode. An agency procuring a single generative service for deployment across two jurisdictions discovers that conformity artefacts satisfying the stricter regime cannot be reused in the lighter regime without bespoke re-validation, or conversely, that a system certified in the lighter regime fails conformity when ported to the stricter one; when lacking tender clauses that bind post-deployment model updates across all operating territories, portability collapses into either governance dilution or prohibitive duplication.

3.8 Synthesis

Operability and institutional voids are not independent. Without traceability and continuous auditability, liability cannot be enforced; without enforceable liability, vendors have little incentive to retain lineage; without adequate equity measurement, disparate operational failures remain undetected even when technically auditable; and without portability scaffolding, any local maturity gain is arbitraged away when the service is redeployed elsewhere. Table 1 consolidates the taxonomy, mapping each void to its operational signature, pillar remedy, lifecycle location, and failure exemplar. The mapping makes explicit why isolated fixes fail: each void points to a primary pillar but requires a secondary pillar to be operationally closable. This joint-necessity is formalized in Section 4.7 as a dependency lattice (P1 → P4 → P2 → P5, with P3 feeding back into P1), where downstream maturity is unstable without upstream foundations.

TABLE 1. Void-to-pillar mapping.

Together, the six voids motivate the five-pillar response developed in Section 4: each pillar operationalizes the maturity increment required to close its primary void, while the lattice in Section 4.7 (Figure 3) captures the cross-pillar dependencies that Table 1 anticipates.

4 A five-pillar framework for generative AI governance in mobility operations

4.1 Architecture of the framework

The framework structures five mutually reinforcing pillars as a stacked hierarchy (Figure 3 introduces the conceptual diagram; Figure 4 provides the maturity matrix). Each pillar carries a definition, a transport-specific failure scenario, and a five-level maturity scale (levels 0–4). The pillars form a dependency lattice in which downstream pillars depend on upstream foundations (Section 4.7), internalizing Floridi and Cowls’s five-principle synthesis (Floridi and Cowls, 2019) and the well-established fairness–transparency–accountability triad (Lepri et al., 2018).

The five pillars are: (pillar 1) transparency and explainability; (pillar 2) accountability and liability; (pillar 3) equity and non-discrimination; (pillar 4) auditability and oversight; (pillar 5) human-in/on-the-loop control.

The dependency direction is not decorative. A concrete failure pattern illustrates why. A city that writes strong accountability contracts (high A-level maturity) while remaining at T0 (no public model or data-lineage cards) cannot enforce those contracts after an incident, because the audit trail needed to allocate responsibility does not exist. Likewise, raising human-override maturity (H) before auditability (A’) leaves operators pressing controls whose outcomes cannot be reconstructed. The recommended order, therefore, places transparency and auditability as upstream foundations before liability allocation and human-loop design, with equity (P3) feeding back into transparency requirements as disparate-impact findings emerge.

4.2 Pillar 1: transparency and explainability

Definition. Pillar 1 captures the degree to which a generative mobility system’s reasoning, training heritage, and operational path can be rendered legible to operators, agencies, and citizens (Gasser and Almeida, 2017). It decomposes into model transparency (Mitchell et al., 2019), data lineage (provenance, geographic coverage, and dataset-accountability practices) (Hutchinson et al., 2021), and output traceability (prompt-log retention and retrieval-source citation) (Metaxa et al., 2021). Datasheets-for-datasets (Gebru et al., 2021) operationalize the lineage component; uncertainty quantification is a complementary form of transparency (Bhatt et al., 2021), and documented limits of post hoc explanation (Mittelstadt et al., 2019) bound what each maturity level can promise.

• In SRPS terms, pillar 1 underwrites reliability (hallucination containment via per-prompt confidence signaling, retrieval-source citation, and prompt-log traceability) and privacy [training-data lineage disclosure (Hutchinson et al., 2021; Gebru et al., 2021) and purpose-bound retention of citizen prompt logs (Ji et al., 2023; Mitchell et al., 2019; Metaxa et al., 2021).

Transport failure scenario. An LLM-assisted multimodal coordinator hallucinates a wheelchair-accessible stop closure, directing a vulnerable passenger into a transit desert; without prompt-level traceability, the operator cannot reconstruct the failure vector (Bender et al., 2021; Ji et al., 2023). In a parallel case, a diffusion-model demand forecaster trained on smartphone check-ins under-forecasts demand in low-income suburbs; the lack of training-data lineage prevents diagnostic detection (Wang et al., 2025; Caragliu and Del Bo, 2023).

Maturity scale. T0 opaque: closed private model with no provenance. T1 documented: internal model cards and qualitative training descriptions. T2 disclosed: public model cards, disclosed geographical/linguistic training boundaries, and prompt-response logs retained for ≥90 days. T3 traceable: real-time confidence scores and retrieval sources per prompt and automated drift tagging. T4 contestable: public API exposing attention summaries and data-influence maps; citizens can query and appeal decisions.

4.3 Pillar 2: accountability and liability

Definition. Pillar 2 specifies the contractual and legal allocation of responsibility across the generative supply chain when non-deterministic actions cause harm (Smuha, 2025). The safety-focused regulatory framing developed for autonomous vehicles (London and Danks, 2018) complements the EU AI Act’s conformity-assessment model. It decomposes into supply-chain liability mapping (apportioning damages for vendor drift), decision authority chain (advisory versus agentic), independent algorithmic auditing practice (Raji and Buolamwini, 2019), and journalistic-investigation methodology that exposes algorithmic power asymmetries (Diakopoulos, 2015). Algorithmic-pricing harm in adjacent sectors (Gal, 2019) sharpens the supply-chain liability rationale.

• For SRPS, Pillar 2 assigns safety and security liability for drift- or injection-induced harm and codifies privacy accountability for training-data handling and prompt-log stewardship across the vendor–integrator–operator chain (Smuha, 2025; London and Danks, 2018).

Transport failure scenario. An LLM-based traffic-signal coordinator, silently updated by a SaaS vendor, alters routing logic to prioritize high-emission delivery trucks over emergency vehicles; the authority faces an obstruction suit but lacks contractual clauses for third-party model tuning. In a parallel case, an agentic micro-mobility dispatcher cancels para-transit services in a low-income area to maximize dynamic-pricing revenue; the platform claims autonomous optimization voids liability (Taylor, 2019).

Maturity scale. A0 diffuse: contracts silent on AI errors; vendor disclaims liability. A1 contractual: AI error disclaimers; base-model updates require 24-h notice. A2 documented: formally mapped decision authority chain, third-party updates frozen pre-validation, and insurance addresses GenAI failures. A3 Enforced: tamper-evident append-only logs of model outputs and operator actions; automated vendor fines on degradation. A4 adjudicable: regulatory body holds joint-and-several liability templates, and class-action frameworks allow citizens to hold operators accountable.

4.4 Pillar 3: equity and non-discrimination

Definition. Pillar 3 captures the prevention of disparate impacts, digital exclusion, and linguistic bias across protected demographic, geographic, and economic classes. It decomposes into mobility justice and spatial equity (Appleyard and Riggs, 2021; Caragliu and Del Bo, 2023), linguistic accessibility, and digital rights and procedural inclusion (Legacy et al., 2019). Disparate-impact certification (Feldman et al., 2015), fairness-definition ambiguity (Verma and Rubin, 2018), and trade-offs between competing fairness criteria (Corbett-Davies et al., 2017) supply the technical-fairness substrate; Black-feminist algorithmic critique grounds the equity claim in lived-experience analysis of automated power (Hampton, 2021).

• SRPS linkage: Pillar 3 treats inequitable service failure as a reliability and safety failure (e.g., accessibility or dialect exclusion that denies safe access) and requires that equity audits themselves respect privacy through data-minimization and aggregated subgroup reporting (Caragliu and Del Bo, 2023; Metcalf et al., 2021).

Transport failure scenario. A municipal MaaS chatbot with a voice engine that fails to parse regional accents produces repeated booking failures for elderly and migrant riders. In a parallel case, a multi-agent traffic simulator optimized to reduce municipal emissions routes heavy freight through communities of color because demographic-priority weights in the embedding space under-weight those geographies (Caragliu and Del Bo, 2023).

Maturity scale. E0 indifferent: no pre-deployment bias assessment. E1 aware: baseline demographic reports, WCAG 2.2 AA compliance. E2 measured: quarterly disparate-impact audits and linguistic testing on varied accents. E3 remediated: automated rollback if disparate wait times exceed a 10% demographic variance; community-led audits. E4 transformative: core metrics reward equitable access (e.g., higher scores for connecting transit deserts); native minority and indigenous dialect support.

4.5 Pillar 4: auditability and oversight

Definition. Pillar 4 captures the architecture, institutional frameworks, and legal mandates required to inspect, review, and halt generative systems across their operating lifecycles (Costanza-Chock et al., 2022). It decomposes into adversarial red-teaming (Weidinger et al., 2022), continuous monitoring and drift detection, and fail-safe rollback mechanisms. Algorithmic-impact-assessment instruments provide a complementary operational structure for documenting pre-deployment and post-deployment governance (Metcalf et al., 2021), while half a century of test-fairness scholarship in adjacent psychometrics supplies the methodological caution that audit instruments must respect (Hutchinson and Mitchell, 2019).

• SRPS linkage: Pillar 4 operationalizes security through independent red-teaming for prompt injection and model-update integrity (Weidinger et al., 2022), safety and reliability through continuous drift detection and fail-safe rollback, and privacy through audited, least-privilege controls on log and model-snapshot access (Costanza-Chock et al., 2022; Metcalf et al., 2021).

Transport failure scenario. A rogue user discovers a prompt-injection exploit in a public MaaS chatbot and uses it to issue unauthorized free travel passes or reroute scheduled micro-transit shuttles to private parties (Weidinger et al., 2022). In a parallel case, a deep RL signal coordination system with an LLM advisor experiences drift after a city-wide parade and gridlocks major arterials before operators detect it (Costanza-Chock et al., 2022).

Maturity scale. A’-0 uninspected: deployment without independent testing or continuous safety logging. A’-1 self-declared: vendor self-reports compliance; static pre-deployment verification only. A’-2 independently audited: pre-deployment red-teaming by accredited third parties; automated drift exception alerts. A’-3 supervised: real-time performance dashboards to state authorities; fail-safe rollbacks verified weekly. A’-4 publicly monitored: public registry of incident reports, vulnerability bounty programs, and independent ombudsperson access.

4.6 Pillar 5: human-in/on-the-loop

Definition. Pillar 5 captures the ergonomic design of human–machine interaction loops to prevent automation complacency and preserve meaningful control over non-deterministic outputs (Sheridan, 2021; Ficuciello et al., 2024). It decomposes into ergonomic cognitive calibration, active override accessibility, and operator skill preservation (Wickens et al., 2015).

• SRPS linkage: Pillar 5 secures safety and reliability by preserving meaningful override capability against automation bias and complacency (Sheridan, 2021; Wickens et al., 2015) and addresses security by requiring authenticated, tamper-evident override channels with structured logging (Sheridan, 2021; London and Danks, 2018).

Transport failure scenario. A metropolitan dispatch room integrates an LLM co-pilot that drafts automated rescheduling instructions during minor delays; controllers, overwhelmed by the suggestion volume, systematically approve without reading route changes (Wickens et al., 2015). In a parallel case, a major rail-signal failure produces dozens of conflicting schedule adjustments; operators deskilled by long-term reliance cannot formulate a manual plan and accept flawed recommendations (Sheridan, 2021; Sun et al., 2026).

Maturity scale. H0 autonomous: fully automated decision loop with no human validation. H1 nominal: human in the loop but limited to broad binary approvals in <1 s. H2 human-on-the-loop: real-time override usable within 5 s; override actions initiate structured logs. H3 meaningful: suggester limits recommendation frequency to preserve cognitive bandwidth; operators periodically pass active-control tests. H4 co-piloted: deep human–AI teaming with system adaptation to operator stress indicators [drawing on adjacent human–AI traffic interaction evidence (Sun et al., 2026)].

4.7 Maturity matrix and dependency lattice

Figure 4 presents the unified 5 × 5 maturity matrix that operationalizes the five pillars as a single reference card. The proposed municipal baseline is T2/A2/E2/A’-2/H2, the minimum operational maturity at which the dependency lattice in Figure 3 is internally consistent. Table 2 (new) shows how safety, reliability, privacy, and security (SRPS) thread across the same five pillars without adding a sixth pillar.

TABLE 2. SRPS concerns threaded across the five-pillar maturity matrix.

Legend: • Primary, pillar is the principal maturity locus for the SRPS sub-concern (advancing this pillar most directly advances the concern). ○ Secondary, pillar materially supports the concern but is not the principal locus. –, no direct locus; governed via other pillars.

SRPS is orthogonal to the five pillars. Figure 4 remains 5 × 5; Table 2 is read as an overlay. The primary-cell assignments are themselves falsifiable (e.g., if T-level improvements do not reduce hallucination-induced severity in P2). Citations reuse only the submitted list (Movahedi and Choi, 2025; Wang and Shalaby, 2025; Yang et al., 2026; Bender et al., 2021; Floridi et al., 2018; Dwork et al., 2012; Tabassi, 2023; Smuha, 2025; Organisation for Economic Co-operation and Development OECD, 2019; Benraouane, 2024; Floridi and Cowls, 2019; Hopkins and Schwanen, 2018; Gasser and Almeida, 2017; Mittelstadt, 2019; Zuboff, 2015; Taylor, 2019; Calzada, 2025; Sural and Naren, 2024; Wang et al., 2025; Bai et al., 2025; Jaradat et al., 2025; Lou, 2025; Din et al., 2026; Acheampong et al., 2021; Bonnefon et al., 2016; Awad et al., 2018; Ji et al., 2023; Fagnant and Kockelman, 2015; Larsen et al., 2025; Baeza-Yates, 2018; Mitchell et al., 2019; Metaxa et al., 2021; Appleyard and Riggs, 2021; Caliskan et al., 2017; Mehrabi et al., 2021; Caragliu and Del Bo, 2023; Ge et al., 2020; Edelman et al., 2017; Verlinghieri and Schwanen, 2020; Costanza-Chock et al., 2022; Sheridan, 2021; Wickens et al., 2015; Jacovi et al., 2021; Qin et al., 2026; Lepri et al., 2018; Hutchinson et al., 2021; Gebru et al., 2021; Bhatt et al., 2021; Mittelstadt et al., 2019; London and Danks, 2018; Raji and Buolamwini, 2019; Diakopoulos, 2015; Gal, 2019; Legacy et al., 2019; Feldman et al., 2015; Verma and Rubin, 2018; Corbett-Davies et al., 2017; Hampton, 2021; Weidinger et al., 2022; Metcalf et al., 2021; Hutchinson and Mitchell, 2019; Ficuciello et al., 2024; Sun et al., 2026; Docherty et al., 2018; Kitchin, 2015; Ouyang et al., 2022; Beidollahkhani, 2026).

The dependency lattice is pillar 1 → pillar 4 → pillar 2 → pillar 5, with pillar 3 feeding back into pillar 1. The ordering is causal, not ornamental. T → A’ (transparency → auditability): without prompt-response logs, retrieval-source citations, model-version snapshots, and data-lineage disclosure (T), there is no artefact to audit—no logs, no audit (Mitchell et al., 2019; Metaxa et al., 2021; Costanza-Chock et al., 2022). A’ → A (auditability → accountability): without independently reproducible audit evidence, liability cannot be allocated across the vendor, integrator, and operator because the evidentiary basis for contractual or joint-and-several apportionments does not exist—no evidence, no liability (Smuha, 2025; London and Danks, 2018). A → H (accountability → human control): without a defined decision-authority chain and contractual allocation of authority, human override has no enforceable scope and collapses into nominal rubber-stamping under automation bias and complacency—no authority, no meaningful override (Sheridan, 2021; Wickens et al., 2015). Equity (pillar 3) closes the loop by feeding back into pillar 1: disparate-impact findings reveal which training-data and retrieval-path lineages must be made transparent to remediate the harm (Caragliu and Del Bo, 2023).

This logic parallels safety-critical assurance precedents conceptually—aviation flight-recorder → independent audit → operator liability → pilot authority, and autonomous-vehicle safety-case and SOTIF-style lifecycle validation chains in which assurance at each step is conditional on artefacts produced upstream (Fagnant and Kockelman, 2015; Sheridan, 2021; Wickens et al., 2015; London and Danks, 2018). The transport-specific instantiation replaces flight-data traces with prompt-log and model-snapshot chains, but the conditionality is identical.

The lattice denotes a dominant logical ordering (ceiling effect), not a temporal sequence. Operationally, all five pillars co-influence one another, and agencies may advance them in parallel. The claim is that upstream maturity caps downstream effectiveness: higher investment in a downstream pillar cannot compensate for a weak upstream foundation, but downstream investment remains necessary; upstream maturity is necessary but not sufficient. Formally, this is testable as positive interaction terms between upstream and downstream maturity in P10 and P11 and as a main-effect ceiling in which downstream coefficients are attenuated when upstream scores are low. Nothing in this framing forbids concurrent progress; it predicts diminishing returns to out-of-order investment.

Consistent with a hypothesis and theory framing, out-of-order progressions, such as sustaining A3 while remaining at T0, are not asserted to fail deterministically. They are hypothesized to carry a hazard ratio greater than 1 for severe governance failure (service-disrupting, safety-relevant, or liability-crystallizing) over a 6-to-18-month operating window, relative to lattice-consistent controls at the same downstream level (P11). P10 hypothesizes the complementary positive interaction: balanced high-maturity stacking improves durability beyond the additive contribution of any single pillar. Both are falsifiable, as stated in Section 5.2.

5 Testable propositions

5.1 Why falsifiability matters

The framework is useful only if its structural claims can be empirically falsified. H&T articles are explicitly invited to commit to testable predictions, and transport-governance research has historically struggled to operationalize conceptual models. The 12 propositions below operationalize the central claim that pillar maturity covaries with observable outcomes into constructs and designs admitting rejection. Sample sizes, corridor counts, and significance thresholds below are candidate design parameters pending pilot power analysis; they are not pre-registered results.

All sample sizes (N), corridor counts, effect-size thresholds (beta, odds/hazard/incidence-rate ratios), and significance thresholds (alpha = 0.05; two-tailed unless directional pre-registration justifies one-tailed) reported in Section 5.2 are illustrative candidate design parameters pending pilot estimation of construct variances, inter-scale correlations, and intra-class correlations (e.g., corridors nested within agencies). They will be finalized after pilot estimation and replaced by pilot-informed, pre-registered targets. Power calculations will be performed in G*Power 3.1 (Faul et al., 2009) for bivariate and regression designs and in pwrSEM/WebPower Monte Carlo simulation (Zhang and Yuan, 2015) for PLS-SEM measurement and structural paths conditional on pilot loadings and residual covariances. Table 3 summarizes the candidate model family per proposition and the illustrative N that the pilot will replace; no proposition is considered tested until its pilot-powered design is pre-registered (see Supplementary Appendix B for the full protocol sketch, equations, and power targets).

TABLE 3. Candidate model families for the 12 propositions (illustrative N, all thresholds pending pilot power analysis; see Supplementary Appendix B Supplementary Table B1 for full detail).

PLS-SEM, partial least squares structural equation modeling; DID, difference-in-differences; FE, fixed effects; PH, proportional hazards; HR, hazard ratio; IRR, incidence-rate ratio; ATE, average treatment effect. All N are illustrative and will be superseded by pilot-informed G*Power/pwrSEM targets (Supplementary Appendix B Supplementary Section B4). P10–P11 use a censoring window of 6–18 months consistent with the lattice prediction (Section 4.7, P11).

5.2 The twelve propositions

Each proposition specifies the statement, constructs, empirical design, and falsification condition. The proposition map is shown in Figure 5.

P1: Transparency–auditability covariance (P1 × P4). Statement: Deployments at model transparency T2+ covary positively with auditability maturity A’-2+. Constructs: T-score (0–4); A’-score (0–4). Design: PLS-SEM on N transit-authority survey responses; capability inventories as indicators (Gasser and Almeida, 2017). Falsification: Non-significant or negative path coefficient (β ≤ 0, p ≥ 0.05).

P2: Data-lineage completeness → incident-severity mitigation (P1). Statement: Deployments with complete training-data lineage (T2+) exhibit lower mean incident severity when hallucinations emerge than that with T0–T1 systems. Constructs: Data lineage status (Disclosed vs. Opaque); composite incident severity score (harm, delay-hours, and recovery cost). Design: Matched case-study comparison via difference-in-differences on historical GenAI transit anomalies (Costanza-Chock et al., 2022). Falsification: Non-significant severity differential or opposite-signed effect (p ≥ 0.05).

P3: Contractual authority mapping → incident resolution latency (P2). Statement: An explicit decision authority chain (A2+) is negatively associated with incident resolution latency. Constructs: A-score (0–4); mean-time-to-resolution (hours). Design: Survival analysis on procurement and FOI logs, controlling for incident complexity. Falsification: Hazard ratio not significantly different from 1 (p ≥ 0.05).

P4: Vendor liability-exposure → pre-release regression testing (P2). Statement: The proportion of liability contractually assigned to the vendor is positively associated with rigor of pre-release regression testing. Constructs: Contractual vendor liability share (%); Pre-deployment test coverage (% of edge cases). Design: Multi-case contract analysis with executive interviews across public–private projects (Docherty et al., 2018; Legacy et al., 2019). Falsification: Non-significant positive correlation (r ≤ 0, p ≥ 0.05).

P5: Distributional equity audits → disparate impact latency (P3). Statement: Frequency of spatial and demographic equity audits (E2+) is negatively associated with detection latency of disparate transit-impact failures. Constructs: E-score (0–4); disparate impact detection latency (days). Design: Time-series regression on service-exception logs with matched case control. Falsification: Non-significant negative slope or positive coefficient (p ≥ 0.05).

P6: Accessibility coverage → disabled rider retention (P3). Statement: Multimodal accessibility testing (E2+) is positively associated with para-transit retention among disabled and elderly cohorts over 12 months. Constructs: Accessibility test coverage (present/absent); para-transit cohort retention rate (%). Design: Propensity-score matching on smartcard logs before and after accessibility upgrades. Falsification: Non-significant positive effect (p ≥ 0.05).

P7: Pre-deployment red-teaming → post-deployment exploit count (P4). Statement: Breadth and taxonomic diversity of pre-deployment adversarial red-teaming (A’-2+) is negatively associated with successful post-deployment exploits. Constructs: Red-teaming breadth index (attack vectors); successful exploits per quarter. Design: Multiple linear-regression on vulnerability registries and vendor patch logs (Weidinger et al., 2022). Falsification: Non-significant negative coefficient (p ≥ 0.05).

P8: Continuous subgroup monitoring → drift incident mitigation (P4). Statement: Deployments using continuous subgroup-level monitoring (A’-2+) exhibit lower drift-induced incident rates than aggregate-only monitoring. Constructs: Performance monitoring scale (subgroup vs. aggregate); drift-induced operational failures per quarter. Design: Panel data regression on N corridors using fixed-effects models on operational corridor panels (design to be powered in pilot work). Falsification: Non-significant reduction for subgroup-monitoring corridors (p ≥ 0.05).

P9: Suggested override latency → operator override-exercise rate (P5). Statement: Human override latency (H2+) is positively associated with operator override-exercise rates during safety anomalies. Constructs: Suggestion window latency (seconds); operator-initiated corrective overrides (%). Design: Lab simulation plus traffic-control-room observational studies with eye-tracking (Sheridan, 2021; Wickens et al., 2015). Falsification: Non-significant positive or negative slope (p ≥ 0.05).

P10: Five-pillar stacking compliance → political durability (cross-pillar). Statement: Balanced high-maturity deployments across all five pillars enjoy greater political durability than unbalanced ones. Constructs: Stacking compliance index (binary); deployment survival time (months). Design: event-history modeling and survival analysis on N metropolitan GenAI pilots (Floridi et al., 2018; Legacy et al., 2019). Falsification: Non-significant hazard reduction for compliant deployments (p ≥ 0.05).

P11: Out-of-order lifecycle progression → governance failure latency (cross-pillar). Statement: Deployments that skip baseline dependencies, high downstream maturity without upstream prerequisites, experience severe failures within 6–18 months. Constructs: Out-of-order progression index (lattice imbalance); months to first severe systemic failure. Design: Mixed-methods comparative case studies against matched balanced controls. Falsification: Out-of-order deployments surviving >18 months without severe failure.

P12: Public transparency → trust (mediated by perceived contestability) (cross-pillar). Statement: The positive transparency–trust relationship is fully mediated by perceived contestability, the public’s confidence that they can query and challenge AI decisions. Constructs: Public transparency (T-level); public trust (Likert); perceived contestability (Likert). Design: Scenario-based experimental survey of transit riders analyzed via PLS-SEM mediation. Falsification: Non-significant indirect effect through contestability or significant direct transparency effect after mediation.

5.3 A proposition map

Figure 5 maps the 12 propositions onto the pillar structure and six outcome categories (incident rate, override-exercise rate, disparate-impact detection latency, regulatory compliance, political durability, and public trust). P1–P9 are pillar-internal; P10–P12 are framework-level (distinct style). Every pillar carries at least two propositions; P10–P12 jointly test the lattice structure.

6 Discussion: implications for practice, policy, and research

This discussion draws together the four-quadrant problem, the six governance voids, the five-pillar maturity architecture, and the 12 falsifiable propositions. The practical claim is modest: agencies need a transport-specific lifecycle ladder that cross-sector instruments alone do not supply, and that ladder should be tested rather than only asserted.

6.1 For transport authorities

The framework supplies a procurement-grade checklist for insertion into GenAI tenders as evaluation criteria. The recommended municipal baseline is T2/A2/E2/A’-2/H2, with each level specified by observable indicators (Figure 4). Procurement language requiring level 2 maturity across all five pillars converts the framework into an enforceable contract artefact. The smart-cities critique (Kitchin, 2015) warns that procurement-driven “smart” upgrades can widen urban digital divides; agencies should negotiate explicit clauses on vendor-side model updates (24-h notice minimum) and prompt-log retention (≥90 days at T2).

6.2 For regulators

The framework offers regulators a lifecycle conformity-assessment scaffold complementing the EU AI Act’s product-lifecycle model and NIST AI RMF’s function-based vocabulary (Tabassi, 2023; Smuha, 2025). Regulators can use the five-pillar matrix to specify sectoral expectations, evaluate incident reports, and design continuous-monitoring obligations calibrated to generative-system drift timescales rather than annual cycles. The framework offers portability: jurisdictions can set the minimum pillar maturity levels that vendors must demonstrate across all operating territories, preventing cross-jurisdictional governance race-to-the-bottom (Floridi et al., 2018; Legacy et al., 2019).

6.3 For AI developers

The maturity matrix provides design-phase boundaries for product roadmaps. Achieving T2 across all pillars is an engineering commitment measured in months; the harder commitments are political and contractual (A2 supply-chain liability mapping, E2 community-led audits, and A’-2 third-party red-teaming). Alignment-via-human-feedback levers (Ouyang et al., 2022) provide an operational path for vendor-side conversational-safety controls. Vendors treating the matrix as a design requirement rather than a procurement hurdle will reduce downstream contract friction and post-deployment incident exposure.

6.4 For civil society and researchers

Civil-society organizations and academic researchers gain an operational vocabulary for monitoring public-sector GenAI deployments. The T4 contestable level (public API exposing attention summaries and data-influence maps) defines a baseline for transparency-rights advocacy. For researchers, the 12 propositions supply an empirical agenda whose priorities for early testing are P1, P4, P8, and P12, which are all addressable with publicly available planning and survey data (Docherty et al., 2018; Beidollahkhani, 2026). The “trustworthy for whom” framing advanced by Calzada (2025) supplies the normative anchor, ensuring that trust-formation metrics are stratified by demographic and geographic subgroup rather than aggregated to a single mean.

7 Limitations and future research

Pilot-site selection is a further external-validity risk: metro authorities willing to open their GenAI stacks for phase 1 maturity-matrix validation may already be governance-mature, so early empirical estimates could understate the voids that dominate average agencies.

The framework is theoretically derived and not yet empirically validated. The maturity scales await indicator validation through pilot testing (Section 6.1); the dependency lattice is a structural prediction whose failure window (P11) od 6–18 months requires empirical refinement.

Methodologically, the framework faces data-access friction: vendor-side prompt logs and base-model update histories are typically undisclosed, and procurement-side FOI responses are slow. Propositions depending on internal operational data (P3, P4, and P8) will require research partnerships with municipal authorities willing to share auditable logs under controlled access.

Future research proceeds in three phases. Phase 1 pilots the maturity matrix on three to five metropolitan planning organizations, producing inter-rater reliability statistics. Phase 2 tests P1, P4, P8, and P12 using publicly available data. Phase 3 extends to cross-pillar propositions (P10, P11, and P12) through comparative case studies and event-history modeling, converting the framework from conceptual architecture into empirically validated governance standard.

Phase 1 construct-validity protocol (maturity scales). Phase 1 includes a dedicated scale-validation protocol for the five maturity scales (T/A/E/A′/H, levels 0–4, Sections 4.2–4.6; Figure 4). Three independent coders, blinded to one another’s ratings and to any incident-count information, will code five published vignettes drawn from Section 2.1 use-case taxonomy—LLM-driven signal control, route planning with foundation models, demand forecasting via generative simulation, customer-service chatbots, and multimodal coordination on each pillar’s ordinal scale using the anchor descriptors as the codebook (Krippendorff, 2019; Hayes and Krippendorff, 2007). Reliability will be estimated per pillar using Krippendorff’s alpha for ordinal data (primary) and the intra-class correlation ICC (2, k) (two-way random-effects, absolute agreement, and average-measures) across the three coders as a consistency check (Koo and Li, 2016; Hallgren, 2012). Targets are alpha ≥0.67 for exploratory retention with anchor revision and alpha ≥0.80 for confirmatory readiness; scales not meeting 0.67 will be revised and re-piloted before phase 2 (Krippendorff, 2019). Mean pillar scores (average of three coders), per-pillar alphas, ICC (2, k) with 95% confidence intervals, and the adjudication rule for discrepant ratings (≥2-level splits resolved by consensus with audit log) will be reported. The codebook, vignette corpus, coder training protocol, and anonymized rating matrix will be archived as supplementary material; the vignettes are illustrative published cases and do not constitute deployment data.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. Generative AI tools (large language models) were used to assist with prose drafting, editing for clarity and conciseness, literature-search support, and figure generation during the preparation of this manuscript. All intellectual contributions, including the conceptual framework, the dependency-lattice architecture, the 12 falsifiable propositions, and all analytical arguments were conceived, developed, and verified by the authors. The authors reviewed, edited, and take full responsibility for the complete final content, including factual accuracy, scholarly integrity, and the correctness of all cited references.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Supplementary material

The Supplementary Material for this article can be found online at: https://www.frontiersin.org/articles/10.3389/ffutr.2026.1951756/full#supplementary-material

Supplementary material Supplementary material at the source

Footnotes

Edited by: Omar Darwish, Eastern Michigan University, United States

Reviewed by: Mohammad Reza Jabbarpour, Niroo Research Institute, Iran

Alina Patelli, Aston University, United Kingdom