Responsible AI Governance as an Organisational Capability: A Theory-Building Integrative Review for Sustainable Organisations

Abstract

Artificial intelligence (AI) is increasingly embedded in organisational decision-making, creating opportunities for innovation and sustainability while intensifying concerns about accountability, transparency, stakeholder responsibility and human oversight. This structured theory-building integrative review synthesises a purposively bounded corpus of 35 unique works on responsible AI, AI governance, responsible leadership and organisational sustainability. Responsible AI Governance (RAIG) is conceptualised as a multidimensional organisational capability: the repeatable, coordinated and adaptive capacity through which responsible AI principles are translated into governance structures, decision processes, accountability arrangements, stakeholder relationships, human oversight and assurance across the AI lifecycle. Six interdependent dimensions are specified: ethical-strategic alignment, accountability architecture, human oversight and agency, stakeholder inclusion, transparency and assurance and lifecycle governance and adaptability. Responsible leadership is positioned as an antecedent managerial microfoundation rather than a constitutive dimension of RAIG. The framework separates sustainability from the content of RAIG and theorises sustainable organisational and stakeholder outcomes as consequences of effective governance. Propositions and a staged research programme establish a foundation for construct operationalisation, cross-context validation and subsequent nomological testing.

1. Introduction

Artificial intelligence (AI) is becoming embedded in organisational processes that shape recruitment, people analytics, healthcare, education, public administration, strategic decision-making and innovation. This diffusion expands organisations’ capacity to process information, automate decisions and augment human judgement, but it also redistributes decision authority and creates new ethical, operational and stakeholder risks. Research on responsible AI addresses the principles that should guide AI use, while AI governance scholarship examines risk frameworks, control mechanisms, actors, lifecycle arrangements and sector-specific governance structures [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19]. Parallel work considers how AI changes leadership and organisational effectiveness, how responsible leadership shapes stakeholder relationships and accountability and how AI-enabled organising connects with sustainability and responsible innovation [1,2,3,4,5,13,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34]. Taken together, these streams establish that governing AI responsibly is an organisational responsibility rather than a purely technical design problem.

Despite this growth, literature remains conceptually dispersed. Some contributions focus on principles and ethical tools, including the movement from identifying what responsible AI should mean towards specifying how principles can be translated into practice [7]. Others focus on risk management and controls [6,8], integrated data and AI governance across the lifecycle [9] or themes and knowledge gaps in AI governance [10]. Sector-specific reviews examine healthcare and health systems [11,19], public governance [17] and educational management [26], while work on responsible AI governance differentiates actors, lifecycle stages and tools [16]. These contributions are important, but they operate with different units of analysis and often stop short of explaining the organisation-level capacity that coordinates responsibility across structures, decisions, stakeholders and time.

A second fragmentation concerns the human and relational side of governance. Responsible leadership scholarship extends responsibility beyond conventional leader–follower relations towards accountability for organisational consequences and multiple stakeholders [1,2,3,4,5,20,21,22]. Empirical studies connect responsible leadership with employee commitment, innovation and turnover-related outcomes [2,3,5,33], while work on stakeholder inclusion and exclusion demonstrates that stakeholder responsibility depends on whose interests are recognised, heard and balanced [21]. Recent studies explicitly connect AI with leadership, governance dynamics and organisational effectiveness [13,23,24,29,34]. Yet leadership frequently appears as an adjacent construct rather than as a lower-level mechanism explaining how responsible AI principles become durable organisation-level governance capacity.

A third challenge concerns sustainability. Research connects socially responsible AI with people analytics and sustainability [15], AI and sustainable human resource management with organisational sustainability [25], AI adoption maturity with ethical governance and open green innovation [28] and AI-responsive leadership with sustainable organisational outcomes [29,32,34]. These connections justify treating sustainability as an important criterion for evaluating responsible AI governance. They do not, however, require sustainability achievement to be built into the RAIG construct itself. Doing so would blur the distinction between the content of governance and the outcomes governance is intended to support.

This paper therefore develops RAIG as a multidimensional organisational capability. The capability claim is deliberately specific. RAIG is not equated with a policy bundle, a committee structure or a list of responsible AI practices. It is the repeatable, collective, integrated and adaptive organisational capacity to translate responsibility principles into coordinated governance across AI-related decisions and lifecycle stages. This capability perspective adds an enactment and coordination layer to existing governance frameworks: broad AI-governance reviews identify themes, actors, controls and lifecycle tools [10,16], while newer multi-layer risk-governance work foregrounds technical controls, institutional capacity and digital sovereignty [35]. RAIG differs by asking whether an organisation can repeatedly mobilise and coordinate these elements across decisions, actors and time, rather than whether governance mechanisms merely exist. ‘Higher-order’ is used here in a conceptual architecture sense: RAIG is represented by multiple first-order governance capacities whose coordination yields the organisation-level construct. It is not yet a validated higher-order measurement model, nor does the paper claim that RAIG is a dynamic capability in the technical sense of that separate theoretical tradition [36,37,38,39,40].

The review addresses three research questions. RQ1 asks: How should Responsible AI Governance be conceptualised and bounded as an organisational capability? RQ2 asks: What dimensions and governance mechanisms constitute Responsible AI Governance? RQ3 asks: What role does responsible leadership play in the development and enactment of Responsible AI Governance? This contribution is not the invention of the phrase ‘responsible AI governance’, which already appears in the corpus [10,16,18]. Instead, the contribution is a reconstruction of RAIG at the organisational level that specifies its capability properties, dimensional architecture, construct boundaries, managerial microfoundation and sustainability-oriented consequences.

The paper makes four contributions. First, it specifies why RAIG is appropriately understood as an organisational capability and distinguishes capability from installed governance systems, isolated routines and practice bundles. In contrast to framework inventories that primarily classify governance themes, actors, tools or layers [10,16,35], the capability lens focuses on coordinated enactment, repeatability and adaptation. Second, it establishes a six-dimensional architecture and clarifies that the dimensions are complementary but only partly compensatory. Third, it defines responsible leadership as an antecedent managerial microfoundation—lower-level interpretive, relational, structural and adaptive action that enables the emergence and renewal of an organisation-level capability—rather than as part of RAIG itself. Fourth, it resolves a key construct-boundary problem by locating sustainability outside RAIG’s constitutive content and treating sustainable organisational, stakeholder and environmental outcomes as consequences to be explained and tested. Figure 1 summarises the theory-building logic.

Figure 1. Theory-building integration of fragmented literature streams into Responsible AI Governance (RAIG) as an organisational capability. Source: Author’s conceptual synthesis.

2. Structured Review Design and Analytical Approach

2.1. Review Design and Methodological Rationale

This study adopts a structured theory-building integrative review rather than a systematic review or meta-analysis. The purpose is construct development: to connect conceptually related but differently framed streams, clarify the domain and boundaries of Responsible AI Governance (RAIG), identify its constituent dimensions and explain the role of responsible leadership. Integrative reviews are appropriate where a field is fragmented across theoretical, conceptual, review and empirical contributions and where the objective is synthesis and theory development rather than estimation of a pooled effect [41,42,43]. To strengthen methodological transparency, the review was organised as a pre-specified sequence of problem formulation, corpus construction, eligibility screening, data extraction and coding and theory-building synthesis.

The unit of review was scholarly or authoritative work rather than an individual empirical effect size. This was necessary because the relevant literature includes conceptual articles, systematic and scoping reviews, empirical studies, governance frameworks, standards and sector-specific analyses. The review therefore applies structured selection and coding rules while preserving the methodological breadth required for integrative theory building.

2.2. Corpus Construction and Eligibility Criteria

The candidate corpus was purposively constructed around four analytic domains derived directly from the research questions: (a) responsible AI, AI ethics, AI governance, risk, control and lifecycle governance; (b) responsible leadership, ethical responsibility and stakeholder governance; (c) organisational sustainability, responsible innovation and AI-enabled organisational outcomes; and (d) construct measurement and cross-context validation. The starting references were assembled iteratively through targeted scholarly discovery and backward/forward citation chaining rather than through one exhaustive database query. Discovery logic combined terms such as ‘responsible AI’ OR ‘AI governance’ with ‘risk’, ‘control’, ‘lifecycle’, ‘responsible leadership’, ‘stakeholder’, ‘sustainability’, ‘organisational capability’, ‘measurement’ and sector terms. The search horizon covered literature available up to September 2026. Because the original design was integrative rather than systematic, database-specific hit counts and a complete historical query log were not retained and are not retrospectively reconstructed. This limitation is reported explicitly to preserve methodological integrity. The initial reference set contained 39 bibliographic entries. Deduplication removed four repeated entries—two additional occurrences of Aarab et al. [17], one additional occurrence of Graca [24], and one additional occurrence of Nguyen [26]—leaving 35 unique works published between 2006 and 2026. The specific scholarly databases or discovery platforms used during the initial targeted literature discovery were not documented contemporaneously and cannot now be reconstructed with sufficient confidence; this limitation is acknowledged explicitly rather than retrospectively attributing the corpus to particular databases.

Eligibility was assessed against explicit conceptual criteria. A work was included when it made a direct contribution to at least one of the following: (1) the definition, domain or boundary of responsible AI or AI governance; (2) an organisation-level governance mechanism, control, actor, decision right or lifecycle process; (3) responsible leadership, stakeholder responsibility or accountability relevant to organisational governance; (4) organisational, innovation, resilience or sustainability consequences of AI-related governance; or (5) multidimensional construct development, measurement or cross-context validation relevant to future RAIG operationalisation. Works were excluded from analytic use when they referred to AI, leadership or sustainability only tangentially and did not inform any of these criteria.

Because the starting set had already been curated for close conceptual proximity to the research questions, all 35 unique works remaining after deduplication met at least one eligibility criterion and were retained in the analytic corpus. No record was removed simply to achieve a target corpus size. The 35 works constitute the theory-building corpus. References [41,42,43] support the integrative-review methodology and were not coded as substantive evidence. References [35,36,37,38,39,40,44] were added during revision as boundary-sensitivity and theoretical-grounding sources addressing digital sovereignty, adversarial AI security, organisational capabilities and microfoundations; they refine interpretation and boundary conditions but do not alter the reported 35-work derivation corpus. The review is therefore structured and auditable but purposively bounded; it does not claim bibliometric exhaustiveness or equivalence to a database-generated systematic review.

2.3. Screening and Selection Audit Trail

Screening proceeded in two passes. First, titles, abstracts and source descriptions were checked against the five eligibility criteria above to confirm direct relevance to the review questions. Second, the retained works were assessed at the level required for conceptual use: definitions, theoretical arguments, reported governance mechanisms, levels of analysis, stakeholder implications, lifecycle assumptions and outcome claims were examined before a source was assigned an analytic role. Where a work could inform more than one domain, it was coded to multiple routes rather than forced into a single category.

The numerical audit trail for the derivation corpus was therefore: 39 candidate bibliographic entries; 4 duplicate entries removed; 35 unique works screened for conceptual eligibility; and 35 works retained for synthesis. The audit trail is reported to make the corpus construction inspectable without implying a PRISMA-style systematic search that was not undertaken. To strengthen traceability, Supplementary Table S1 provides an evidence matrix linking each of the 35 included works to extracted concepts, higher-order categories, RAIG dimensions and relevant propositions.

2.4. Data Extraction and Conceptual Coding

A structured extraction matrix was used to organise each included work around the information required by the research questions. The coding fields were source type and context; focal construct or governance problem; level of analysis; definition or conceptual boundary; governance actor(s); decision authority and accountability mechanisms; human oversight requirements; stakeholder inclusion or remedy mechanisms; transparency, assurance or control mechanisms; lifecycle or adaptation mechanisms; leadership role; organisational or sustainability-related outcomes; and implications for future measurement. The purpose of extraction was not to quantify frequency as evidence of importance but to create a consistent basis for comparing conceptually heterogeneous contributions. Supplementary Table S1 makes this analytical pathway visible by connecting source-level concepts to higher-order categories, the six proposed dimensions and theory-building propositions.

Source claims were used only at the level supported by the source type. Conceptual and framework papers informed definitions and mechanisms; empirical studies informed observed relationships in their stated populations and contexts; systematic and scoping reviews informed broader patterns within their review domains; and standards or governance frameworks informed formal risk, control and accountability arrangements. This distinction reduced the risk of converting normative propositions into empirical claims.

2.5. Analytical Synthesis and Theory-Building Procedure

The synthesis proceeded in three stages. First, construct mapping identified what each literature stream treated as the object of responsibility, the locus of governance, the relevant actors, the temporal stage of AI use and the outcomes to be protected or created. This exposed recurring differences between principle-centred, control-centred, lifecycle-centred, leadership-centred and sustainability-centred accounts.

Second, axial conceptual grouping clustered recurrent governance requirements into candidate organisation-level capacities. A candidate dimension was retained when it was conceptually distinguishable from the others, organisationally actionable, relevant across more than one AI-use context and necessary to explain how responsible AI moves from principle to coordinated practice. Three boundary decisions were especially important. Accountability architecture was reserved for allocation of authority, decision rights, ownership, escalation and answerability; transparency and assurance captured the evidence, monitoring, testing and review through which governance claims can be examined; and lifecycle governance and adaptability captured the temporal capacity to reassess and redesign governance as systems, uses, threats and stakeholder consequences change. Redundancy was explicitly examined. Sustainability, for example, was initially considered alongside lifecycle governance but was separated from the constitutive architecture because achievement of sustainable outcomes is conceptually different from the governance processes that may enable them.

Third, theoretical integration specified the level and role of responsible leadership, the relationship among dimensions and the outcome mechanisms implied by the synthesis. Responsible leadership was positioned as an antecedent managerial microfoundation rather than as a RAIG dimension. The six dimensions were treated as complementary first-order capacities that jointly represent the higher-order RAIG construct. Propositions were then formulated to make mechanisms and boundary conditions explicit rather than treating all desirable outcomes as automatic consequences of ‘more governance’.

The analytic procedure was intentionally conservative. Detailed empirical claims were not inferred where the included sources did not support them. Instead, the synthesis used the explicit focus of the works—risk management [6], principle-to-practice translation [7], control mechanisms [8], lifecycle governance [9], governance themes and gaps [10], sector-specific frameworks [11,17,19,26], actor-stage governance tools [16], responsible leadership and stakeholder responsibility [1,2,3,4,5,20,21,22,23,33], cross-country measurement [45] and sustainability-oriented AI and leadership [14,15,25,28,29,32,34]—as the basis for conceptual integration.

2.6. Methodological Transparency and Scope

The structured protocol improves transparency in four ways. First, the inclusion logic is stated independently of the resulting framework. Second, the extraction fields separate construct content, antecedents, governance mechanisms and outcomes, which helps prevent circularity in the definition of RAIG. Third, the selection audit trail makes the purposive corpus boundary explicit rather than presenting it as exhaustive. Fourth, Supplementary Table S1 provides source-to-code-to-dimension traceability and identifies which works primarily support construct derivation, antecedents, outcomes or future validation. Table 1 summarises the five analytic routes used to connect the corpus to the synthesis.

Table 1. Corpus construction and analytic routes.

Analytic Route	Inclusion Logic	Primary Contribution to Synthesis	Indicative Sources
Responsible AI and ethics	Directly informs responsibility principles, ethical requirements or the principle-to-practice problem.	Defines normative content that governance must translate into organisational action.	Morley et al. [7]; Madanchian and Taherdoost [12]; Haidar [18]; Kim et al. [31].
AI governance, risk, control and lifecycle	Directly informs authority, risk treatment, control, governance mechanisms, actors or lifecycle arrangements.	Provides structural, assurance and adaptive governance mechanisms.	NIST [6]; Usmani et al. [8]; Duggireddy [9]; Birkstedt et al. [10]; Kuehnert et al. [16].
Responsible leadership and stakeholders	Directly informs ethical responsibility, stakeholder accountability, leader action or responsibility-related outcomes.	Provides lower-level managerial and relational mechanisms through which organisation-level governance is formed and enacted.	Haque et al. [1,3,5]; Dong and Zhong [2]; Voegtlin et al. [4]; Voegtlin [20]; Ellis and Dean [21]; Maak and Pless [22]; Pathak and Jha [33].
Sustainability, innovation and organisational outcomes	Directly links AI, governance or leadership with responsible innovation, sustainability, resilience or organisational outcomes.	Defines consequence domains without making those outcomes constitutive of RAIG.	Khozouie and Ghasemiyan [14]; Chang and Ke [15]; Ali et al. [25]; Al-Omoush [28]; Moosa and Pundhir [29]; Haque [34].
Measurement and cross-context validation	Directly informs multidimensional measurement, cross-country validation or contextual comparison.	Provides a methodological bridge to future RAIG scale development and invariance testing.	Jaturat et al. [45]; sectoral reviews [11,17,19,26].

2.7. Use of Generative AI Assistance

Generative AI assistance was used during manuscript preparation for drafting support, language refinement, figure layout and document formatting. It was not used to conduct an autonomous literature search, determine inclusion or exclusion, generate empirical data or replace author judgement in the conceptual synthesis. The author defined and verified the bounded corpus, applied the eligibility and coding logic, adjudicated construct boundaries and propositions, reviewed all generated text and figures and assumed full responsibility for the manuscript.

3. Theory-Building Synthesis

3.1. Why RAIG Is an Organisational Capability

The synthesis begins with a distinction between responsible AI as a normative aspiration and RAIG as an organisation-level capacity. Responsible AI can state desired qualities or responsibilities; AI governance specifies how authority and control are arranged; risk management specifies how uncertainty and harm are identified and treated; leadership shapes priorities and relationships; and sustainability provides a broader criterion concerning enduring stakeholders and organisational value. RAIG integrates these functions without collapsing them into one another.

A recurring problem in responsible AI is the distance between principles and enactment. Morley et al. frame this as moving from ‘what’ to ‘how’ by translating ethical principles into tools and practices [7]. Risk-management and control work similarly emphasise operational mechanisms [6,8]. Governance research expands the lens to frameworks, actors, stages, knowledge gaps and tools [10,16], while lifecycle approaches emphasise continuity from design or acquisition through deployment, monitoring and retirement [9]. Sectoral reviews demonstrate that these arrangements must be adapted to high-stakes organisational settings [11,17,19,26].

This literature implies more than the existence of isolated practices. An organisation may possess an AI policy, a risk register, a review committee, a human-in-the-loop rule or a model documentation template without possessing a coherent governance capacity. The capability claim is therefore based on four properties. First, RAIG is collective: it depends on coordinated action across business, technical, risk, leadership and stakeholder-facing roles. Second, it is repeatable: governance must operate across decisions and use cases rather than as a one-off response. Third, it is integrative: ethical, accountability, human, stakeholder and assurance requirements must be connected rather than managed as independent checklists. Fourth, it is adaptive: governance must be revised as systems, uses, risks and stakeholder consequences change over the AI lifecycle.

These properties distinguish RAIG from neighbouring organisational forms. A governance system describes installed structures, rules and decision rights; a practice configuration describes a bundle of activities; an organisational routine describes a recurring pattern of action. Each can be part of RAIG, but none is equivalent to capability. Capability research treats organisational capabilities as patterned capacities that are developed, maintained and modified over time rather than as one-off problem solving [36,39]. Microfoundations scholarship further explains that collective capabilities emerge from interacting individual actions, social processes and organisational structures [37], while managerial cognition and action can help shape capability development and renewal [38,40]. RAIG is therefore theorised as an enacted capacity evidenced when structures, practices and routines can be mobilised coherently and repeatedly to govern AI under changing conditions. The argument uses capability theory to explain coordinated organisational action, but it does not assume the specific sensing-seizing-reconfiguring architecture of dynamic capabilities.

The label ‘higher-order’ requires similar precision. At this stage, it denotes a higher-order conceptual architecture: six first-order governance capacities jointly define the organisation-level domain. It does not establish a reflective higher-order factor, formative composite or other measurement model. The dimensions are deliberately distinct, context-sensitive and potentially non-compensatory; those properties mean that several empirical specifications remain plausible. Scale-development research must therefore compare reflective, formative, composite and configurational representations rather than treating the conceptual architecture as evidence for any one measurement form.

The dimensions are expected to be complementary but only partly compensatory. Moderate weakness in one dimension may sometimes be offset by strength elsewhere; for example, extensive assurance may partially compensate for immature stakeholder processes in lower-risk settings. Severe deficiencies in accountability, meaningful human oversight or assurance, however, are theorised to create non-compensatory thresholds in high-impact contexts. An organisation should not be classified as possessing strong RAIG merely because several dimensions are mature while a foundational safeguard is absent. This is a theoretical assumption to be tested, not a settled empirical property.

3.2. Defining and Bounding Responsible AI Governance

Responsible AI Governance is defined here as the multidimensional organisational capability to translate responsible AI principles into coordinated structures, decision processes, accountability arrangements, stakeholder relationships, human oversight, assurance mechanisms and adaptive lifecycle governance that guide AI-related decisions and practices.

Several elements of the definition matter. First, the construct is organisational. Technical properties of an AI system remain important, but RAIG concerns the organisational arrangements that determine what is developed or acquired, who is accountable, when human judgement is required, how affected stakeholders are represented, what is monitored and how systems are changed or retired. Second, RAIG is a capability rather than a static policy bundle: it implies coordinated, repeatable and adaptive governance across AI applications. Third, responsibility is relational and consequential. Responsible leadership scholarship extends responsibility towards broader stakeholder obligations [20,22], and work on stakeholder inclusion and exclusion shows that governance must determine whose interests have standing [21]. Fourth, RAIG is lifecycle-oriented because risks and responsibilities can emerge before deployment, during use and after systems are updated or contexts change [9,16]. In digitally dependent settings, these responsibilities also include governance of infrastructure dependence, data location, cross-border data flows, vendor lock-in and decision autonomy. Digital sovereignty is therefore treated as a cross-cutting contextual and strategic governance concern—not a seventh RAIG dimension—because organisational control over data, infrastructure and vendors conditions the effective enactment of accountability, assurance and lifecycle governance [35].

Crucially, sustainable outcomes are not embedded in the definition as achieved states. Sustainability provides normative and evaluative criterion for responsible organisational AI use, but including sustainability achievement as part of RAIG would create predictor-criterion overlap when RAIG is later used to explain sustainable outcomes. The construct therefore contains governance processes that can support long-term responsibility, while sustainable organisational and stakeholder outcomes remain conceptually external consequences. Table 2 summarises the conceptual boundaries between RAIG and adjacent constructs.

Table 2. Conceptual boundaries between RAIG and adjacent constructs.

Adjacent Construct	Primary Focus	Why It Is Not Equivalent to RAIG	RAIG Distinction
Responsible AI	Desired qualities, principles or responsible use of AI.	Can remain normative or system-focused without specifying organisation-level coordination.	RAIG concerns the organisational capacity that translates responsible AI principles into repeatable governance.
AI ethics	Moral principles, values and ethical reasoning concerning AI.	Does not by itself allocate authority, oversight or lifecycle responsibilities.	RAIG embeds ethical standards in organisational decisions, accountability and assurance.
AI governance	Broad arrangements through which AI is directed and controlled.	Can describe governance structures without specifying a responsibility-oriented capability.	RAIG is the responsibility-oriented organisational capability within the broader AI-governance domain.
AI risk management	Identification, assessment, treatment and monitoring of AI-related risk.	Necessary but narrower than stakeholder inclusion, human agency, ethical alignment and broader accountability.	Risk management is one component of the wider RAIG capability.
AI control mechanisms	Specific technical or organisational interventions that constrain, verify or review AI.	Individual controls can exist without coherent organisation-wide governance.	RAIG coordinates controls with roles, decision processes, stakeholders and lifecycle adaptation.
Governance system/practice bundle	Installed structures, rules, routines or collections of practices.	May be present without being integrated, repeatable or adaptive across AI uses.	RAIG is the enacted capacity to mobilise and coordinate these elements towards responsible AI governance.
Responsible leadership	Leader-level orientation towards ethical responsibility, stakeholders and accountability.	A leadership construct does not itself constitute organisation-level AI governance.	Responsible leadership is an antecedent managerial microfoundation that helps form and renew RAIG.
Sustainability outcomes	Long-term organisational, stakeholder, social or environmental value.	Outcomes are criteria for evaluating governance, not governance content.	RAIG is theorised to contribute to sustainability outcomes without defining itself by their achievement.
Digital sovereignty/infrastructure dependence	Control over data, infrastructure, vendors and cross-border dependencies.	A contextual governance objective and risk condition rather than a complete organisation-level capability.	RAIG incorporates sovereignty-sensitive decisions across ethical-strategic alignment, accountability, assurance and lifecycle governance [35].

3.3. Six Dimensions of RAIG

The integrative synthesis identifies six interdependent first-order dimensions. They are analytically distinct but practically reinforcing. The final configuration resulted from grouping governance mechanisms by the organisational function they perform: purpose alignment, authority allocation, preservation of human agency, stakeholder representation, evidentiary assurance and temporal adaptation. Security, privacy, infrastructure dependence and digital sovereignty cut across these functions rather than forming stand-alone dimensions: for example, security ownership belongs to accountability architecture; threat testing and privacy-preserving controls to transparency and assurance; vendor and data-location choices to ethical-strategic alignment and accountability; and continuous monitoring and response triggers to lifecycle governance and adaptability [35,44]. The architecture deliberately separates lifecycle governance from sustainability achievement, thereby reducing criterion contamination. Table 3 defines each dimension, identifies indicative manifestations and summarises its conceptual grounding.

Table 3. Proposed multidimensional architecture of Responsible AI Governance.

RAIG Dimension	Definition	Indicative Organisational Manifestations	Conceptual Grounding
Ethical-strategic alignment	Capacity to align AI objectives and use cases with explicit responsibility principles and organisational purpose.	AI-use approval criteria; ethical impact framing; alignment of AI investment with stated responsibility commitments; data-location, vendor-dependence and digital-sovereignty considerations for material use cases.	Principle-to-practice translation [7]; responsible AI frameworks [12,18]; responsible AI in organisational applications [15,31,34]; sovereignty-sensitive governance [35].
Accountability architecture	Capacity to allocate decision rights, responsibility, escalation and answerability for AI-related decisions.	Named business and technical owners; escalation paths; governance committees; vendor accountability; decision logs; ownership of cybersecurity and privacy risk acceptance.	Risk management [6]; control mechanisms [8]; governance frameworks [10,11,19].
Human oversight and agency	Capacity to preserve meaningful human judgement, intervention, contestability and override authority.	Human review thresholds; override rights; escalation for consequential decisions; role competency and authority requirements.	Control and lifecycle governance [6,8,9]; AI-leadership and high-impact applications [13,30,31].
Stakeholder inclusion	Capacity to identify affected stakeholders and incorporate legitimate interests into AI governance, challenge and remedy.	Stakeholder mapping; consultation; employee/customer voice; complaint and remedy channels; representation in governance.	Responsible leadership and stakeholder responsibility [1,2,3,4,5,20,21,22,33].
Transparency and assurance	Capacity to make AI governance reviewable and to test whether governance arrangements work as intended.	Documentation; explainability requirements; audit/review; continuous monitoring; incident reporting; cybersecurity risk assessment; zero-trust/least-privilege access controls where appropriate; threat detection; testing for adversarial risks such as data poisoning and prompt injection; privacy-preserving data controls; assurance reporting.	Ethics tools [7]; risk/control [6,8]; actor-stage governance tools [16]; sectoral assurance [11,19]; adversarial-AI security and privacy risk [44].
Lifecycle governance and adaptability	Capacity to reassess and adapt governance as AI systems, uses, risks and stakeholder consequences change over time.	Periodic and event-driven reassessment; drift/use-change triggers; continuous-learning and real-time monitoring alerts; automated detection/escalation triggers with accountable human review; update and retirement governance; incident learning; governance redesign.	Lifecycle governance [9,16]; sectoral context [11,17,19,26]; adaptive AI and leadership perspectives [23,28,29,34]; continuous and cross-layer governance [35,44].

3.3.1. Ethical-Strategic Alignment

Ethical-strategic alignment is the organisation’s capacity to connect AI objectives and use cases with explicit responsibility principles and organisational purpose. The dimension responds directly to the principle-to-practice problem [7] and to frameworks that connect ethical theories, governance models and responsible AI adoption [12,18]. It asks whether responsibility enters decisions about where AI should and should not be used, what objectives are legitimate and what trade-offs are acceptable, rather than being appended after deployment as a compliance check. For AI that depends materially on external cloud, foundation-model or data-service providers, strategic alignment also requires explicit consideration of data location, cross-border obligations, vendor concentration, portability and decision autonomy. These sovereignty-related considerations affect whether the organisation can actually exercise the responsibilities it claims to hold [35]. Sustainability-relevant considerations may inform those judgements, but achieved sustainability is not part of the dimension itself.

3.3.2. Accountability Architecture

Accountability architecture is the capacity to allocate decision rights, responsibilities, escalation paths and answerability for AI-related decisions. Risk-management frameworks [6], AI control mechanisms [8] and governance frameworks across sectors [10,11,17,19] all point towards organised responsibility rather than diffuse ownership. The relevant question is not merely whether someone is ‘responsible for AI’, but whether authority and answerability are attached to specific decisions: approving a use case, accepting residual risk, authorising automated action, responding to a security or privacy incident, handling stakeholder challenge, approving vendor dependencies, changing a model or retiring a system. Accountability architecture is therefore the structural backbone that allows the other dimensions to operate. It differs from transparency and assurance because it specifies who has authority and answerability; assurance generates the evidence through which those actors can be challenged and held to account.

3.3.3. Human Oversight and Agency

Human oversight and agency refer to the capacity to preserve meaningful human judgement, intervention and contestability where AI influences consequential decisions. Work on AI control, risk and responsible implementation provides a basis for treating oversight as a governance concern [6,8,9]. Leadership and organisational research add the human dimension by examining how AI changes authority and effectiveness [13,23,24]. Meaningful oversight is more demanding than inserting a nominal human into an automated process. RAIG requires clarity about when humans can override, pause or escalate an AI-supported decision, whether they possess sufficient information and authority to do so and how accountability is preserved rather than displaced onto technology. This is especially salient in recruitment and healthcare [30,31].

3.3.4. Stakeholder Inclusion

Stakeholder inclusion is the organisational capacity to identify affected stakeholders, incorporate legitimate stakeholder interests and establish channels through which AI-related concerns can be heard, represented and addressed. Responsible leadership scholarship provides the conceptual basis [1,2,3,4,5,20,22], while the explicit study of stakeholder inclusion and exclusion prevents an idealised assumption that stakeholder orientation automatically means all relevant voices are considered [21]. In RAIG, stakeholder inclusion should affect governance design rather than operate only as post-deployment communication. Procedures for mapping, representation, consultation, challenge and remedy should therefore be proportionate to the impact of AI use.

3.3.5. Transparency and Assurance

Transparency and assurance describe the capacity to make AI governance sufficiently visible, reviewable, secure and evidence-based to support accountability. This dimension integrates the ‘how’ orientation of responsible AI tools [7], risk and control perspectives [6,8] and work that classifies governance tools by actors and lifecycle stages [16]. Transparency is not indiscriminate disclosure; the governance task is to determine what information is required by which actors to understand, challenge or assure a decision. Assurance complements transparency because disclosure has limited value if claims are not tested. In high-risk and shared environments, assurance must extend to technical security and privacy evidence, including cybersecurity risk assessment, zero-trust/least-privilege access and integrity controls where appropriate, threat detection, adversarial testing for data poisoning, evasion and prompt-injection risks, incident response and proportionate privacy-preserving techniques [44]. Depending on context, assurance can therefore include documentation, risk assessment, security testing, process review, monitoring, audit, incident reporting and periodic governance evaluation [11,19]. This dimension tests whether controls work; it does not replace specialist cybersecurity engineering.

3.3.6. Lifecycle Governance and Adaptability

Lifecycle governance and adaptability refer to the capacity to govern AI as a changing socio-technical system rather than a one-off implementation. Lifecycle governance is explicit in integrated data and AI governance work [9] and actor-stage approaches [16], while sectoral reviews demonstrate that arrangements vary with institutional and risk context [11,17,19,26]. AI systems and uses can change through retraining, vendor updates, data drift, new business purposes, evolving attack techniques and shifts in stakeholder expectations. Governance must therefore include triggers for reassessment, update, escalation, suspension and retirement. In real-time or continuous learning environments, those triggers may be supported by automated monitoring, streaming analytics, drift or threat detection and machine-generated alerts; however, automation of monitoring does not automate accountability. Organisations must predefine thresholds, decision rights and human escalation for consequential governance actions [35,44]. The dimension is process-based: it concerns continued governance and learning, not the achievement of sustainability outcomes.

3.4. Responsible Leadership as an Antecedent Managerial Microfoundation

The six dimensions explain what RAIG comprises, but they do not by themselves explain how organisation-level capability is formed and sustained. This review positions responsible leadership as an antecedent managerial microfoundation of RAIG. In capability research, microfoundations refer to the lower-level individuals, interactions and structures through which collective capabilities emerge [37]; managerial cognition and action can shape the formation and renewal of organisation-level capacities [38,40]. Here, responsible leadership supplies a responsibility-oriented managerial mechanism, while RAIG remains an organisation- or organisational-unit-level capability. The levels are therefore distinct: responsible leadership is neither synonymous with RAIG nor a constitutive dimension of a future RAIG measure.

Responsible leadership contributes through four mechanisms. The first is interpretive: leaders translate abstract responsibility principles into organisational priorities, decision criteria and acceptable trade-offs. The second is relational: leaders determine which stakeholder claims receive attention and how competing interests are balanced [21]. The third is structural: leaders allocate resources, authority and accountability, influencing whether governance bodies and assurance functions have sufficient standing. The fourth is adaptive: leaders sustain attention to incident learning, governance revision and changing stakeholder expectations. These mechanisms operate through distributed organisational actors rather than through an individual leader acting alone. Governance committees, risk and compliance specialists, cybersecurity and privacy functions, data and AI teams, procurement, HR, legal functions and business owners enact different parts of the capability. Responsible leadership matters insofar as it gives these actors mandate, resources, coordination mechanisms and permission to escalate or challenge AI-related decisions.

This positioning resolves an ambiguity that can arise when leadership is simultaneously described as part of capability and as its antecedent. Responsible leadership is not a constitutive RAIG dimension and should not be included in a future RAIG scale. It is theorised to enable capability formation and enactment. Once RAIG becomes institutionalised in roles and routines, feedback from governance experience can in turn reshape what responsible leadership requires. The relationship is therefore temporally reciprocal without being conceptually circular: leadership precedes and supports capability formation, while later governance experience can modify subsequent leadership behaviour [23,29,34].

Empirical responsible leadership studies reinforce the need to keep levels separate. Responsible leadership has been linked with employee commitment, affective commitment, turnover-related intentions and innovation [1,2,3,4,5,33], but these outcomes do not demonstrate organisation-level AI governance capability. The proposed model therefore specifies RAIG as the organisational pathway through which responsibility-oriented leadership may become repeatable AI governance practice.

3.5. Sustainability as an Outcome Domain Rather than Constitutive Content

The review corpus strongly supports a connection between AI, governance, leadership and sustainability [14,15,25,27,28,29,32,34]. The conceptual question is where that connection belongs. If ‘sustainability integration’ is built into a RAIG dimension and sustainable outcomes are then modelled as consequences, the predictor partly contains its criterion. The revised framework therefore treats sustainability as an external outcome domain and evaluative criterion.

This does not make sustainability peripheral. RAIG can influence sustainability through several mechanisms: ethical-strategic alignment can prevent efficiency goals from dominating legitimate stakeholder concerns; stakeholder inclusion can surface workforce and community consequences; transparency and assurance can identify persistent harms; and lifecycle adaptability can enable governance revision as long-term effects emerge. The relevant outcome domain should nevertheless be disaggregated. Organisational sustainability concerns resilience, continuity and responsible long-term value creation; stakeholder sustainability concerns durable effects on employees, customers, communities and other affected groups; and environmental sustainability concerns energy use, carbon intensity, water consumption, hardware and data-centre resource demands and associated ecological impacts. RAIG may improve decision quality and accountability across these domains, but it does not by itself guarantee lower environmental impact. In some applications, stronger governance may reveal that a resource-intensive AI system should be constrained, redesigned or not deployed; in others, responsible governance may coexist with substantial energy and material footprints.

Four consequences are therefore retained: responsible innovation and AI use; stakeholder trust and organisational legitimacy; organisational performance and resilience; and sustainability outcomes spanning organisational, stakeholder and environmental domains. They are distinct and need not improve simultaneously. Strong governance may impose coordination, assurance and delay costs in the short term while producing risk reduction, learning, legitimacy or resilience benefits over longer horizons. Environmental gains also depend on technical architecture, energy mix, model size, infrastructure and deployment choices that sit partly outside RAIG. The framework therefore rejects a simple assumption that ‘more governance’ automatically produces uniformly positive outcomes.

4. Integrative Conceptual Framework and Propositions

Figure 2 integrates theory-building synthesis. Organisational conditions and responsible leadership appear on the left as antecedent influences. Responsible leadership is explicitly labelled as a managerial microfoundation, not a RAIG dimension. RAIG occupies the centre as a six-dimensional organisational capability. Outcome domains appear on the right, while the feedback loop represents learning from incidents, assurance and stakeholder responses. The model is deliberately parsimonious, and the propositions are theory-derived claims for future testing rather than assertions of established causal effects.

Figure 2. Integrative conceptual framework positioning responsible leadership as an antecedent managerial microfoundation of RAIG and distinguishing sustainability outcomes from RAIG’s constitutive content. Source: Author’s conceptual synthesis.

Theoretical Propositions

Proposition 1 (P1). 

Responsible leadership is positively associated with the development and enactment of RAIG capability.

Responsible leadership combines ethical responsibility, stakeholder orientation and accountability [1,2,3,4,5,20,21,22,23,29,33,34]. Its influence on RAIG is expected to operate through interpretive, relational, structural and adaptive managerial actions that direct organisational attention, allocate resources and authority and give institutional standing to responsible AI governance.

Proposition 2 (P2). 

Greater organisational AI adoption maturity and AI-related risk exposure are positively associated with the formalisation and salience of RAIG arrangements but not necessarily with higher RAIG quality.

Research connecting AI adoption maturity with ethical AI governance [28], together with work on AI risk, control and governance frameworks [6,8,10], suggests that governance becomes increasingly salient as AI becomes more deeply embedded in organisational processes or its consequences become more significant. This relationship concerns the need for and formalisation of governance rather than assuming that greater AI maturity necessarily produces higher-quality governance.

Proposition 3 (P3). 

RAIG capability mediates the relationship between responsible leadership and responsible AI outcomes.

Responsible leadership alone is unlikely to generate consistent responsible AI outcomes unless its underlying values and intentions are institutionalised through organisation-level structures, decision processes and governance routines. RAIG therefore represents the organisational mechanism through which responsibility-oriented leadership is translated into repeatable and sustained governance practice.

Proposition 4 (P4). 

RAIG capability is positively associated with responsible innovation and organisational resilience when governance arrangements are supported by effective technical security, reliable data infrastructure and adaptive learning.

Coherent governance can establish legitimate pathways for AI adoption, clarify decision authority and strengthen organisational responses to emerging risks and incidents [12,14,28]. Governance alone, however, cannot compensate for insecure data, vulnerable models or fragile infrastructure. Resilience effects therefore depend on complementary technical controls, cybersecurity and privacy capabilities, infrastructure reliability and credible incident response [35,44]. Governance activities such as monitoring, assurance and stakeholder deliberation may also generate short-term coordination and compliance costs. Accordingly, the performance implications of RAIG are expected to depend on AI-risk exposure, implementation costs, technical-control effectiveness and the time horizon over which outcomes are assessed.

Proposition 5 (P5). 

RAIG capability is positively associated with stakeholder trust and organisational legitimacy when accountability, stakeholder voice and assurance are visible and credible to affected stakeholders.

Responsible leadership research emphasises stakeholder responsibility, accountability and inclusion [20,21,22], while RAIG embeds these principles within organisational governance arrangements. Transparent accountability, meaningful stakeholder participation and credible assurance can strengthen perceptions that organisational AI use is legitimate and responsible. Nevertheless, trust should not be assumed automatically, as stakeholder groups may differ in their expectations, awareness and perceptions of procedural fairness.

Proposition 6 (P6). 

RAIG capability is positively associated with sustainable organisational and stakeholder outcomes and with improved environmental decision quality when responsible AI use, stakeholder-sensitive decision-making and lifecycle adaptation are complemented by context-appropriate technical and infrastructure choices.

This relationship is consequential rather than definitional. Research on socially responsible AI, sustainable HRM, green innovation and sustainable organisational outcomes [15,25,28,29,32,34] suggests that governance can create conditions that support longer-term sustainable value. The expected outcomes include organisational resilience and continuity, workforce and stakeholder well-being, legitimate innovation and more explicit consideration of environmental resource impacts. RAIG is not assumed to reduce energy use or material footprints automatically; those effects depend on model, infrastructure and operational choices. Sustainability achievement is therefore treated as an outcome of RAIG rather than as a constitutive element of the capability itself, preserving conceptual separation between the predictor and its consequences.

Proposition 7 (P7). 

The relative salience of RAIG dimensions varies across sectors, national contexts and AI lifecycle stages, while the organisation-level RAIG capability remains conceptually stable.

Cross-country measurement research [45], actor-stage governance approaches [16] and sector-specific studies in healthcare, public governance and education [11,17,19,26] indicate that responsible AI governance is likely to have context-sensitive manifestations. The dimensions may therefore be partly compensatory in some settings. However, in high-impact AI, severe deficiencies in accountability, human oversight or assurance are expected to constitute non-compensatory thresholds below which responsible governance cannot be adequately maintained.

Proposition 8 (P8). 

Feedback from AI-related incidents, stakeholder responses and assurance findings strengthens RAIG over time when organisations possess adaptive leadership and lifecycle-learning routines.

Lifecycle and control research [8,9,16], together with work on AI-responsive leadership and sustainable organisational outcomes [23,29,34], supports a dynamic interpretation of RAIG. Governance capability can therefore be renewed through organisational learning, whereby incidents, assurance findings and stakeholder responses inform subsequent changes to leadership attention, governance routines and lifecycle controls.

5. Discussion

This review reframes responsible AI governance by shifting the analytical question from whether governance mechanisms exist to whether an organisation can coordinate and enact them repeatedly under changing conditions. That move complements actor-, tool- and layer-oriented frameworks [10,16,35] while preserving their insights as constituent mechanisms. The six-dimensional architecture is therefore a theory-building representation of coordinated organisational capacity rather than a claim that one universal checklist will fit every sector or technology.

The capability claim also needs to be separated from its future measurement. RAIG is ‘higher-order’ conceptually because six first-order capacities jointly define the organisation-level domain; the present review does not establish a higher-order statistical factor. The combination of distinct dimensions, contextual variation and possible non-compensatory thresholds makes reflective, formative, composite and configurational specifications empirically plausible. Future work should compare those alternatives rather than treating conceptual hierarchy as measurement evidence.

Third, the dimensional architecture is explicitly complementary but only partly compensatory. This improves on a simple additive checklist. In lower-risk contexts, strength in one dimension may offset moderate weakness elsewhere, but high-impact AI can make certain safeguards non-compensatory. An organisation with mature ethical alignment and stakeholder engagement but no meaningful accountability or override authority should not automatically be classified as having strong RAIG. The research agenda therefore needs both variable-centred and configurational tests.

Fourth, the paper resolves the levels-of-analysis problem surrounding responsible leadership. Earlier responsible leadership research links leader responsibility with employee outcomes, stakeholder orientation and sustainable development [1,2,3,4,5,20,22,33], while newer AI-focused work examines how AI capabilities influence responsible leadership and how leadership operates in AI-integrated environments [23,29,34]. The revised model specifies the pathway: lower-level responsible leadership actions can help produce an organisation-level governance capability, and that capability can mediate subsequent organisational and stakeholder outcomes. Later governance experience can feed back into leadership without making leadership a constitutive part of RAIG.

The separation of sustainability from RAIG’s constitutive content also improves construct validity. Sustainability remains central to the paper’s purpose, but as an outcome domain rather than a definitional component. This distinction reduces predictor-criterion contamination and creates a more meaningful empirical question: under what conditions does strong responsible AI governance actually contribute to sustainable organisational and stakeholder outcomes?

Finally, the framework helps organise sectoral fragmentation. Healthcare, public governance and education face distinctive governance requirements [11,17,19,26]. Rather than assuming an identical checklist across sectors, the capability perspective predicts a stable conceptual domain with context-sensitive manifestations. Human oversight and assurance may be especially salient in high-stakes settings, while lower-risk uses may rely more heavily on standardised accountability and monitoring. This combination of conceptual stability and contextual variation is essential for scale development.

6. Research Agenda: From Conceptual Domain to Measurement and Testing

The immediate priority is to operationalise RAIG without reintroducing the ambiguities resolved in the conceptual model. Figure 3 outlines a five-stage research programme. Each stage progressively tests content validity, construct validity, predictive validity and generalisability.

Figure 3. Staged research programme for operationalising and validating RAIG as a multidimensional organisational capability. Source: Author’s conceptual synthesis.

Stage 1 is domain specification. Expert review should assess the construct definition, the six dimensions, their boundaries and the assumed partial complementarity among them. Panels should include organisational leaders, AI governance specialists, risk and assurance professionals, employees and other affected stakeholders. A particular priority is to test whether lifecycle governance and adaptability is sufficiently distinct from transparency and assurance and whether ethical-strategic alignment can be measured without drifting into general ethical climate or sustainability outcomes.

Stage 2 is item generation. Items should be written at the organisational level and capture demonstrated governance rather than personal attitudes towards AI. Candidate items should assess whether decision rights and escalation are clear, whether affected stakeholders have recognised channels for voice and remedy, whether human override authority is meaningful, whether assurance is evidence-based and whether governance is revised when AI systems or uses change. Items that primarily measure leadership quality, AI adoption, ethical climate or sustainability achievement should be excluded from the RAIG scale.

Stage 3 is scale development and structural validation. Exploratory and confirmatory analyses should determine whether the six first-order dimensions support a higher-order RAIG representation and, crucially, what form that representation should take. Reflective-factor, formative/composite and configurational specifications should be compared rather than assuming that the conceptual architecture dictates the measurement model. Reliability, convergent validity, discriminant validity and criterion validity should be assessed against adjacent constructs such as responsible AI orientation, AI risk-management maturity, responsible leadership and general digital capability. Jaturat et al.’s cross-country validation of a multidimensional AI-responsibility framework [45] provides a relevant methodological signal, although responsibility and governance remain distinct constructs.

Stage 4 is cross-context validation. The corpus demonstrates the contextual breadth of AI governance, including healthcare [11,19], public governance [17], education [26], cities [27] and organisational settings more broadly [10,13,14]. Measurement invariance should be examined across countries, sectors, firm sizes and AI use cases. This stage should also test whether high-impact contexts produce non-compensatory thresholds in accountability, oversight or assurance.

Stage 5 is nomological and temporal testing. Once measurement validity is established, research should examine antecedents, mediation, outcomes and boundary conditions. Longitudinal designs are especially valuable because governance capability is theorised to develop through learning. Multilevel designs can distinguish leader-level responsible leadership from unit- or organisation-level RAIG. Comparative case studies and configurational methods can investigate whether different dimensional combinations produce acceptable governance under different risk conditions. Table 4 presents all theory-driven propositions alongside their corresponding empirical tests.

Table 4. Theory-derived propositions and illustrative empirical tests.

Proposition	Core Relationship/Mechanism	Illustrative Empirical Test
P1	Responsible leadership -> RAIG through interpretive, relational, structural and adaptive managerial action.	Multi-source or longitudinal design linking leader-level responsibility orientation with unit/organisation-level RAIG development.
P2	AI maturity and risk exposure -> greater RAIG formalisation and salience, but not necessarily higher governance quality.	Compare organisations by AI maturity, use-case criticality, governance formalisation and independently assessed governance quality.
P3	Responsible leadership -> RAIG -> responsible AI outcomes.	Multilevel mediation with leadership measured at managerial level and RAIG aggregated at unit/organisation level.
P4	RAIG -> responsible innovation and resilience conditional on secure technical infrastructure, effective controls and adaptive learning.	Longitudinal models including governance capability, cybersecurity/control maturity, incident resilience, time-to-approval and performance.
P5	RAIG -> stakeholder trust and legitimacy when accountability, voice and assurance are credible.	Link organisational RAIG to employee/customer/citizen trust using multi-stakeholder data and perceived governance visibility.
P6	RAIG -> organisational and stakeholder sustainability, plus environmental decision quality, subject to technical and infrastructure choices.	Examine workforce, stakeholder, resilience and environmental outcomes over time; model infrastructure/resource conditions as moderators.
P7	Context changes dimensional salience; high-impact contexts may create non-compensatory thresholds.	Measurement invariance, multigroup comparison and configurational analysis across sectors, countries and AI lifecycle stages.
P8	Feedback + adaptive leadership -> RAIG renewal over time.	Longitudinal/case tracking of incidents, assurance findings, governance revisions and subsequent capability maturity.

A further agenda concerns configuration rather than only net effects. The revised model predicts partial complementarity, not unrestricted substitution. Future research should identify whether equifinal configurations exist, whether different combinations are appropriate for different use cases and whether threshold dimensions emerge in high-impact contexts. This would provide a more realistic account of governance maturity than a simple summed score.

7. Implications for Practice

For organisations, the framework offers a diagnostic alternative to checklist-based responsible AI programmes. The central question is whether governance arrangements collectively create a repeatable and adaptive capacity. Leaders can use the six dimensions to identify imbalances: strong ethical principles but weak accountability; extensive controls but limited stakeholder voice; nominal human oversight without meaningful authority; substantial documentation without assurance; or robust deployment controls without lifecycle learning. The framework is intended to be used alongside, not instead of, specialist cybersecurity, privacy, legal and technical risk controls.

The revised framework also clarifies executive responsibility. Responsible leadership should not be interpreted as personal moral heroism or as a substitute for specialist governance. Its practical role is to create the conditions in which responsibility becomes institutionalised: objectives are aligned with legitimate purposes, resources are allocated, decision rights are clear, stakeholder concerns have standing, assurance findings trigger action and governance is revised as systems change. Once these routines are institutionalised, the capability should be less dependent on any individual leader and more embedded across governance committees, risk functions, technical teams and business owners.

Illustrative application 1—AI-supported recruitment. Ethical-strategic alignment asks whether automated screening is justified for the role; accountability architecture assigns ownership for vendor selection, model risk and adverse decisions; human oversight preserves meaningful review and override for consequential cases; stakeholder inclusion provides applicant and employee channels for challenge; transparency and assurance require documentation, bias/security testing and incident monitoring; and lifecycle governance triggers reassessment when the vendor model, labour market or use case changes. Responsible leadership connects these functions by allocating authority and ensuring that efficiency targets do not displace fairness, privacy or contestability.

Illustrative application 2—AI-supported employee management. Where AI is used for scheduling, productivity analytics or performance support, RAIG requires a legitimate purpose, clear decision rights, proportionate data collection, meaningful human review, employee voice, secure and privacy-preserving data handling and continuous monitoring for drift, misuse or unintended behavioural effects. If a third-party platform processes data offshore or changes its model, sovereignty, vendor-dependence and lifecycle triggers become governance issues rather than merely procurement details.

For sustainability-oriented organisations, the separation between governance processes and sustainability outcomes is useful. Organisations can evaluate whether RAIG is functioning without claiming that sustainability has already been achieved and can then examine whether stronger governance actually improves workforce, stakeholder, resilience or broader sustainability outcomes. This provides a more credible basis for accountability than treating sustainability language itself as evidence of responsible governance.

8. Limitations

This review has four principal limitations. First, although the revised method applies to a structured integrative-review protocol with explicit eligibility criteria, a documented selection audit trail and consistent extraction fields, the corpus remains purposively bounded rather than generated through an exhaustive database search. The 35 works should therefore not be interpreted as a complete map of responsible AI governance scholarship. The initial literature selection may have increased the salience of leadership, stakeholder and organisation-level governance mechanisms related to technical infrastructure, cybersecurity, privacy and sovereignty literatures. Revision-stage boundary-sensitivity sources [35,44] make that limitation more visible, but they do not eliminate it. A future systematic review should test the coverage and stability of the proposed dimensions using explicit multi-database search protocols and broader technical-governance terminology. In particular, the exact scholarly databases or discovery platforms used during the initial targeted literature discovery were not retained as a contemporaneous record. Although the review documents the discovery logic, eligibility criteria, citation-chaining process and analytical audit trail, this constrains full reproducibility of the initial identification stage.

Second, the capability framing is construct-theoretic rather than an attempt to extend formal dynamic-capabilities theory. The revision strengthens its theoretical foundation through organisational capability and microfoundations research [36,37,38,39,40], but RAIG is not assumed to be a dynamic capability. Future work should test whether its collective, repeatable, integrative and adaptive properties are empirically distinct from ordinary governance routines, general digital capability and dynamic managerial capability.

Third, the six dimensions, higher-order conceptual architecture and partial-compensation assumption require empirical validation. The present model does not establish a reflective, formative, composite or configurational measurement structure. Accountability, meaningful human oversight and assurance are treated as possible threshold dimensions in high-impact settings, but this remains a proposition rather than an established property.

Fourth, the framework is intentionally cross-sectoral and organisation-level. Sector-specific regulation, cloud and IoT architectures, detailed zero-trust implementations, privacy-enhancing technologies and technical threat models are not represented as separate dimensions. Instead, RAIG specifies the organisational capability that should require, coordinate and learn from those specialist controls. Sectoral and technical context will influence how the six dimensions are enacted, and future studies should test whether environments require additional subdimensions or non-compensatory safeguards.

9. Conclusions

Responsible AI governance is increasingly necessary as organisations embed AI in decisions that affect employees, customers, citizens, patients, communities and organisational futures. Governance cannot be reduced to an ethics statement, a risk framework, a technical control or a review committee. This structured theory-building integrative review conceptualises Responsible AI Governance as a multidimensional organisational capability: a repeatable, collective, integrated and adaptive capacity for translating responsibility principles into coordinated governance across the AI lifecycle. The revised boundary also makes clear that this organisational capability must connect with secure technical infrastructure, privacy controls and sovereignty-sensitive data and vendor decisions rather than substitute for them.

The revised capability comprises six interdependent dimensions: ethical-strategic alignment, accountability architecture, human oversight and agency, stakeholder inclusion, transparency and assurance, and lifecycle governance and adaptability. Responsible leadership is positioned as an antecedent managerial microfoundation that helps form and renew the capability through interpretive, relational, structural and adaptive action. Sustainability is deliberately kept outside the constitutive content of RAIG and treated as an outcome domain, thereby preserving discriminant logic for future empirical testing.

The central contribution is a construct that can be specified, challenged and tested empirically. The immediate priorities are to validate the six-dimensional domain using the source-to-dimension evidence trail provided in Supplementary Table S1, develop and compare alternative measurement specifications, test cross-country and cross-sector invariance and examine whether RAIG mediates the effects of responsible leadership on responsible innovation, stakeholder legitimacy, organisational resilience and differentiated sustainability outcomes. This programme can determine whether RAIG functions as a stable organisational capability across contexts while remaining sensitive to technical security, infrastructure dependence and evolving AI risk.