AI governance is fragmented and often stuck at high-level ethics or compliance checklists rather than operational controls; synthesizing 95 studies, this paper proposes a policy-ready risk-tiering model that maps ethical principles to auditable technical safeguards for public services and critical infrastructure.

Main Finding

The study finds that AI governance for public services and critical infrastructure is fragmented: dominated by separate ethics/privacy-centric and compliance/risk-focused approaches, with few integrated frameworks that translate ethical principles into auditable technical controls. It delivers a policy-ready integrated governance risk framework and a risk-tiering matrix designed to align governance practice with Sustainable Development Goal 9 (industry, innovation and infrastructure) and reduce the gap between values and operational controls.

Key Points

• Rapid AI adoption in public services increases risks around privacy, bias, transparency and accountability that current frameworks inadequately address.
• Systematic review identifies two prevailing paradigms in governance literature: (1) ethics/privacy-centric (values-first) and (2) compliance/risk-focused (controls-first). Few works bridge these paradigms.
• There is an observable tension between privacy and security in governance recommendations, complicating unified policy approaches.
• The study produces empirical artefacts: a heat map of governance frameworks, a co-occurrence thematic network, a cluster analysis of framework coverage, and an integrated governance risk framework with a risk-tiering matrix linking ethical principles to auditable technical controls.
• The proposed model is intended to be policy-ready—enabling proportionate, auditable, and sustainable governance for AI in infrastructure and public services.

Data & Methods

• Literature search: 450 records retrieved from major academic and policy databases following PRISMA 2020 guidelines.
• Screening and selection: 95 high-quality studies were included for analysis.
• Quantitative analysis: principal component analysis (PCA) to reduce dimensionality of framework attributes; k-means clustering to identify distinct clusters (types) of governance frameworks.
• Outputs: heat map visualizing framework coverage across dimensions; co-occurrence network mapping thematic linkages; cluster analysis highlighting dominant schools of thought; integrated governance risk framework and risk-tiering matrix that operationalize ethics into auditable technical controls.
• Limitations noted by the study: reliance on published frameworks and literature (possible selection/publication bias); synthesis rather than field validation—implementation and economic impacts require empirical testing.

Implications for AI Economics

• Compliance and adoption costs: Fragmented governance raises regulatory uncertainty and potentially higher compliance costs—especially for smaller firms—affecting entry, competition, and rates of innovation in AI markets for public services.
• Investment and infrastructure financing: Clear, integrated and auditable governance (like the risk-tiering model) can lower information and transaction costs for investors, enabling more targeted public and private investment aligned with SDG9 goals.
• Regulatory design and market structure: A tiered, risk-proportionate approach can reduce over-compliance for low-risk applications while concentrating resources on high-risk systems—improving allocative efficiency and reducing barriers to entry.
• Security/privacy trade-offs and welfare: Tension between privacy and security implies policymakers face trade-offs that have distributional effects (e.g., marginalized groups may bear disproportionate harms from biased systems). Economists should quantify welfare impacts of different governance choices.
• Standardization and externalities: Translating ethical principles into auditable technical controls creates standards that reduce informational asymmetries and negative externalities (e.g., biased outputs), facilitating safer market expansion and cross-jurisdictional interoperability.
• Research and measurement agenda for AI economics:
  • Estimate direct compliance costs and dynamic effects on startup formation and R&D.
  • Model diffusion of AI in public services under alternative governance regimes (risk-tiered vs. one-size-fits-all).
  • Quantify welfare trade-offs from privacy–security tensions and from bias mitigation measures.
  • Assess the value of auditable controls in lowering insurance premiums, liability costs, or public procurement risk premia.
  • Evaluate how integrated governance frameworks affect productivity gains in public services and infrastructure investment multipliers.
• Policy recommendations with economic rationale:
  • Adopt risk-tiered regulation to balance safety and innovation, minimizing unnecessary compliance costs.
  • Prioritize development of auditable controls and measurable standards to reduce uncertainty and transaction costs.
  • Provide targeted support (grants, shared compliance tooling, certification bodies) for smaller firms to avoid consolidation and preserve competition.
  • Use pilot implementations in public procurement to generate data on costs/benefits and guide scaled policy adoption.

If you want, I can convert this into a short policy brief for public finance teams or outline specific empirical models to estimate the compliance-cost and diffusion effects described above.