cs.CYApr 7, 2026
SaveUGAF-ITS: A Standards Harmonization Framework and Validation Tool for Multi-Framework AI Governance in Distributed Intelligent Transportation Systems
Organizations: Higher Colleges of Technology, Fujairah, United Arab Emirates · Central Michigan University, Mount Pleasant, United States of America
Abstract
Organizations deploying AI-enabled Intelligent Transportation Systems face fragmented governance: ISO/IEC42001 demands a certifiable management system, the EU AI Act imposes binding high-risk obligations from August2026, and the NIST AI Risk Management Framework structures voluntary practice. This paper introduces UGAF-ITS, a standards harmonization framework that consolidates 154 source obligations from the three instruments into 12 unified controls across eight governance domains through a reproducible five-phase crosswalk methodology. A three-tier operating model allocates each control to the vehicle, edge, or cloud tier where enforcement and defensible evidence production are feasible. An evidence backbone of 20 versioned artifacts supports a single audit package across all three frameworks without duplicating content. We evaluate UGAF-ITS through an open-source governance engine applied to four architecturally distinct ITS deployment scenarios. The engine encodes the complete crosswalk catalog and executes eight compliance computations. Three-tier deployments achieve 91.7% average scoped framework coverage with 45.9% evidence reduction, complete bidirectional traceability, and 80% of artifacts serving all three frameworks simultaneously. Partial deployments contract predictably, with reduction holding between 25% and 50% across archetypes. The siloed baseline is enumerated document by document and computed by the tool at run time. These results establish structural properties of the harmonized catalog under architectural variation. They do not establish operational compliance readiness, which external assessment with practitioners has yet to test. The tool, scenarios, and all reported results are publicly available for independent replication.
Figures & tables
| Framework | Structure | Key Requirements | ITS Relevance | Compliance |
| ISO/IEC 42001:2023 | Clauses 4–10 (PDCA cycle) + 38 Annex A controls across 9 control areas | AI management system; risk assessment & treatment; human oversight; data governance; continuous improvement | Certifiable management system for OEMs and service providers | Voluntary; Certifiable |
| EU AI Act (2024/1689) | Articles 8–15 (high-risk) + Annexes III, IV, VI; 45 obligations | Risk management system; technical documentation; transparency & human oversight; accuracy & robustness; cybersecurity | ITS classified high-risk (Annex III); mandatory for EU market | Mandatory; Aug 2026 |
| NIST AI RMF 1.0 | 4 functions: govern , map , measure , manage ; 72 subcategories across 19 categories | Trustworthy AI principles; context mapping & risk measurement; continuous monitoring; incident response; stakeholder engagement | Implementation guidance; U.S. federal alignment; international interoperability | Voluntary; Best practice |
| PDCA = Plan-Do-Check-Act. High-risk AI under the EU AI Act includes vehicle safety components (Annex III, §2) and traffic management AI affecting road safety. The 45 EU AI Act obligations listed here reflect the full high-risk requirement set; the crosswalk extraction (Section 4.1 ) scopes this to 37 implementable technical obligations after excluding conformity assessment body, market surveillance, and CE marking procedural items. | ||||
Table 1: Comparison of AI governance frameworks relevant to Intelligent Transportation Systems.
Figure 1: Research design. Each governance failure defined in Section 1.3 motivates one research question, which is addressed by a stated method and evaluated at a declared level of evidence. Level L3, external validation, is outside the scope of this paper.
| Category | Reference | Domain | ISO 42001 | EU AI Act | NIST RMF | ITS Tiers | Crosswalk | Validation |
| General AI Governance | ||||||||
| Forrester AEGIS [ 26 ] | General AI | ● | ◐ | ● | ○ | ◐ | Conceptual | |
| Credo AI UCF [ 9 ] | General AI | ◐ | ● | ● | ○ | ○ | Colorado case | |
| CSA/ISACA [ 8 ] | General AI | ● | ● | ● | ○ | ○ | Guidance only | |
| Automotive & AV Safety | ||||||||
| ISO/PAS 8800 [ 17 ] | Automotive | ○ | ○ | ○ | ◐ | ○ | Standard | |
Table 2: Comparison of AI governance frameworks and integration approaches for Intelligent Transportation Systems. Within the approaches surveyed here, UGAF-ITS is the only one combining all three frameworks with tier-aware control allocation and tool-backed structural evaluation for distributed ITS deployments. The comparison reflects a targeted review and not a systematic review protocol.
Figure 2: UGAF-ITS framework integrating three framework sources (left) through eight governance domains (center) to ITS deployment tiers (right), governed across the AI lifecycle (bottom). The architecture consolidates 154 source obligations into 12 unified controls mapped to vehicle, edge/RSU, and cloud tiers. Primary UCs shown per tier; see Table 4 for complete applicability.
Figure 3: Three-tier ITS governance model with AI components and unified control (UC) applicability at each tier. Vehicle tier addresses on-board AI under real-time safety constraints; edge/RSU tier encompasses roadside AI with multi-stakeholder coordination; cloud tier supports centralized operations requiring governance across all eight domains. Primary UCs highlighted; complete tier applicability in Table 4 .
Figure 4: Five-phase crosswalk methodology for harmonizing AI governance frameworks into UGAF-ITS unified controls. The process transforms 154 source obligations through systematic coding, overlap analysis, and UC synthesis to produce 12 unified controls and 20 evidence artifacts.
| T1 | T2 | T3 | Classification and action | Instance |
|---|---|---|---|---|
| ✓ | ✓ | sym. | Full alignment. One control, one artifact binding | UC-01 risk register |
| ✓ | ✓ | asym. | Dominant strictness. Control takes the stronger objective; weaker atom trace-linked; ADR recorded | UC-07, Annex IV dominant |
| ✓ | any | Evidence-divergent overlap. One control, several artifact bindings | UC-03 data quality | |
| ✓ | any | incomp. | Conjunctive merge. Control takes the conjunction; both atoms trace-linked | UC-05, UC-06 oversight |
| same obj. | n/a | Framework-specific extension. Trace-linked to nearest control, no merge | Annex IV sub-items | |
| ext. actor | n/a | External actor. Excluded at Phase 1, reported as gap class | Conformity assessment |
Table 3: Alignment decision procedure. Every candidate atom pair resolves to exactly one classification. T1 = intent test, T2 = evidence test, T3 = strictness test.
| Domain | UC | Control Name | Control Objective | ISO 42001 | EU AI Act | NIST RMF | T1 | T2 | T3 |
| D1 Risk Management | 01 | AI Risk Assessment | Identify and evaluate AI-specific risks incl. safety, bias, and security | Cl. 6.1; A.4.1–4.3 | Art. 9(2a–c) | map 5.1–5.2 | |||
| 02 | Risk Treatment | Implement controls to mitigate identified risks to acceptable levels | Cl. 8.3; A.5.1–5.2 | Art. 9(2d), 9(5) | mg 1.2–1.4 | ||||
| D2 Data Governance | 03 | Data Quality Assurance | Ensure training/validation data quality, completeness, representativeness | A.7.1–7.3 | Art. 10(1–4) | map 2.3; me 2.6 | |||
| 04 | Bias Detection & Mitigation | Monitor for and address unfair bias in data and model outputs | A.7.4 | Art. 10(2f–g) | me 2.10–2.11 | ||||
| D3 Human Oversight | 05 | Human Oversight Design | Design systems enabling effective human understanding and intervention | Cl. 5; A.15.1–15.2 | Art. 14(1–3) | gv 3.2; map 3.5 | |||
| 06 | Override & Intervention | Implement mechanisms for human override and safe system interruption | A.15.3–15.4 | Art. 14(4–5) | mg 2.4 |
Table 4: UGAF-ITS unified control catalog with cross-framework traceability. Twelve unified controls (UC-01–UC-12) are organized under eight governance domains; each control traces to specific clauses across all three source frameworks. Tier activation ( = active, = not applicable) shows where each control is enforced across the vehicle–edge–cloud architecture.
| Stage | Result |
|---|---|
| Extraction | 12 atoms: ISO A.6.2.3, A.7.1–A.7.3; EU Art. 10(1)–10(5); NIST MAP 2.1–2.3 |
| Coding | Domain D2; tiers T2, T3; phases design, build, monitor |
| Intent test | Passes within the cluster; fails against bias atoms, which split to UC-04 |
| Strictness test | Asymmetric. Article 10 dominates; ISO and NIST atoms trace-linked |
| Extension | Art. 10(5) retained; no ISO or NIST counterpart |
| Unified control | UC-03 Data Quality Assurance, active at T2 and T3 |
Table 5: Data quality obligations traced end to end, from source clauses through coding and alignment to the engine output for the urban scenario.
| Tier | Components (examples) | Unified Controls | Evidence Sources (examples, operational strategic) | Owner |
|---|---|---|---|---|
| T1 Vehicle | ADAS perception, driver monitoring, V2X client, local planning under ODD constraints | UC-05, UC-06, UC-09, UC-10 UC-07 | Oversight Protocol; Intervention & Fallback Plan; Event & Override Logs; V&V Test Report (ODD-scoped); Security Test Report; Release Manifest | OEM vehicle operator |
| T2 Edge/RSU | VRU detection, adaptive signal logic, V2I gateways (e.g., SPaT/MAP), local decision engines | UC-03, UC-04, UC-08, UC-12 UC-06, UC-10 | Data Quality Report; Bias & Performance Report; Configuration Baseline (site + calibration); RSU Decision Logs; Monitoring & Alerting Plan; Escalation Record | Road authority + integrator |
| T3 Cloud | TMC analytics, cross-site monitoring, model registry, training/evaluation pipelines, OTA distribution | UC-01, UC-02, UC-07, UC-11, UC-12 UC-09, UC-10 | Risk Register + Treatment Log; Technical File; Supplier Audit Report; Third-Party Component Register; Incident Ticket Log; Model Change Notice; Deployment Record; Post-Deployment Monitoring Report | Authority ops / cloud operator |
Table 6: ITS deployment tiers, unified controls, and governance evidence sources. Primary UCs are listed first; trace dependencies noted with . Evidence sources are ordered from operational logs to strategic compliance artifacts.
| Configuration | Diverges | Framework response | Declared outside the model |
|---|---|---|---|
| Shared responsibility | A O | Split into production duty at O and acceptance duty at A | Evidence exchange contract |
| Outsourced operation | C A | UC-11 assessment at the procuring entity; Article 25 reclassification checked | Service contract and rebranding terms |
| Cross-tier ownership | E spans tiers | Control instantiated per tier with one lead instance | Consolidation lead and retention terms |
| Absent-tier accountability | A has no tier | Reported as ownership ambiguity (F4) | Contractual evidence flow-down |
Table 7: Divergence between architectural tier and accountability, and how UGAF-ITS responds. Attributes: E = execution locus, O = observation locus, C = operational control, A = legal accountability.
| Level | Question answered | Procedure | Cannot support | Status |
|---|---|---|---|---|
| L1 Internal verification | Is the encoded catalog self-consistent? | Exhaustive traversal of forward and reverse trace links across 154 obligations, 12 controls, and 20 artifacts | Correctness of the mappings against expert judgment | Performed |
| L2 Scenario demonstration | Do structural properties hold as architecture varies? | Identical computations executed across four deployment archetypes from three-tier to single-tier | Audit adequacy or usability in a live deployment | Performed |
| L3 External validation | Do practitioners agree, and does the framework work in the field? | Independent expert assessment, practitioner audits with the engine, operational deployment | Not applicable, since the level is not performed | Outstanding |
Table 8: Levels of evidence for a governance framework. Levels L1 and L2 are performed in this paper; level L3 is not.
Figure 5: Headline metrics for the urban smart intersection scenario, also presented in the engine’s HTML dashboard. The panel is generated from the JSON reports by python make_figures.py after python run_validation.py , so every value shown is read from the run and not transcribed. Source code, scenarios, the siloed baseline register, and the dashboard are available at https://doi.org/10.5281/zenodo.19339071 .
| Dimension | Metric | Urban | Highway | Transit | Rural |
|---|---|---|---|---|---|
| Architecture | Active tiers | T1–T3 | T1–T3 | T2, T3 | T2 |
| AI components | 12 | 7 | 5 | 2 | |
| Stakeholders | 3 | 3 | 2 | 1 | |
| M1: Coverage | ISO/IEC 42001 | 94.5% | 94.5% | 94.5% | 92.7% |
| EU AI Act | 91.9% | 91.9% | 91.9% | 89.2% | |
| NIST AI RMF | 88.7% | 88.7% | 88.7% | 82.3% |
Table 9: Multi-scenario comparative evaluation results. Metrics span five evaluation dimensions across four ITS deployment scenarios. The siloed baseline counts documents from the register of A that are producible at each scenario’s active tiers.
Figure 6: Top: framework coverage across four ITS deployment archetypes; bars represent ISO/IEC 42001, EU AI Act, and NIST AI RMF coverage per scenario. Left bottom: evidence document reduction from siloed baseline (scope-aware) to UGAF-ITS unified artifacts per scenario. Right bottom: artifact reuse distribution showing 80% of artifacts serve all three frameworks simultaneously in three-tier deployments.
| Domain | ISO | EU | NIST | Total | UCs | Ratio |
|---|---|---|---|---|---|---|
| D1 Risk Management | 23 | 6 | 24 | 53 | 2 | 96% |
| D2 Data Governance | 5 | 7 | 5 | 17 | 2 | 88% |
| D3 Human Oversight | 7 | 5 | 3 | 15 | 2 | 87% |
| D4 Transparency | 5 | 3 | 3 | 11 | 1 | 91% |
| D5 Accuracy & Robustness | 3 | 5 | 8 | 16 | 2 | 88% |
| D6 Documentation | 4 | 8 | 4 | 16 | 1 | 94% |
Table 10: Crosswalk consolidation by governance domain. All domains exhibit tri-framework alignment. Consolidation ratio = (1 UCs / source obligations) 100.
Figure 7: Crosswalk consolidation by governance domain. Stacked bars show the contribution of each source framework (ISO/IEC 42001, EU AI Act, NIST AI RMF) to the source obligation count per domain. All eight domains exhibit tri-framework convergence, confirming that unified controls synthesize genuine cross-framework overlap rather than relabelling single-framework requirements.
| Clustering level | Controls | Consolid. | Tri-fw | Tier sigs. |
|---|---|---|---|---|
| L1 coarse, one per domain | 8 | 94.8% | 100% | 4 |
| L2 published, object action | 12 | 92.2% | 100% | 4 |
| L3 fine, one per framework | 36 | 76.6% | 0% | 4 |
Table 11: Control granularity sensitivity. The same 154 source obligations re-clustered at three abstraction levels. Tri-framework convergence is the share of controls drawing on all three sources.
| Criterion | Siloed | Fw-first | Control lib. | UGAF-ITS |
|---|---|---|---|---|
| Fw coverage | High | Part.–High | High | High |
| Control consolidation | None | Partial | Yes | Yes |
| Tier allocation | None | None | None | Yes |
| Evidence reuse | None | Partial | Partial | Yes |
| ITS specificity | No | No | No | Yes |
| Traceability | Per-fw | Partial | Partial | Bidirect. |
Table 12: Governance approaches for multi-framework ITS compliance.
| Phase | Activity | Timeline | Key Output |
|---|---|---|---|
| 1. Architecture mapping | Map deployed AI components to vehicle, edge, and cloud tiers; identify ownership boundaries | Weeks 1–2 | Tier map and stakeholder RACI |
| 2. Gap assessment | Assess current artifacts against the 12 unified controls (Table 4 ) | Weeks 3–4 | Gap register per tier |
| 3. Evidence infrastructure | Establish the Technical File as shared infrastructure with version control and trace links | Weeks 5–8 | Technical File skeleton and trace map |
| 4. Priority closure | Close gaps for high-risk AI components and cross-tier incident pathways | Weeks 9–16 | Populated evidence backbone |
| 5. Audit readiness | Conduct an internal walkthrough simulating framework-specific audit questions | Week 17+ | Validated audit package |
Table 13: Phased UGAF-ITS adoption roadmap for ITS programs approaching the EU AI Act August 2026 deadline.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
| ID | Document | Source | Tiers | Evidences |
| ISO/IEC 42001 (15 documents) | ||||
| ISO-D01 | AI policy | Cl. 5.2 | T3 | UC-01 |
| ISO-D02 | AIMS scope statement | Cl. 4.3 | T3 | UC-01 |
| ISO-D03 | Roles and responsibilities record | Cl. 5.3 | T3 | UC-01 |
| ISO-D04 | AI risk assessment results | Cl. 6.1, 8.2 | T1–T3 | UC-01 |
| ISO-D05 | Risk treatment plan and Statement of Applicability | Cl. 6.1, 8.3 | T3 | UC-02 |
Table 14: Siloed baseline register. Thirty-seven documents across the three frameworks, with source clause, producing tiers, and evidenced unified controls.