The National AI Governance Playbook · Part IV · Chapter 12
Measuring governance programs
Governance programs must evidence progress years before outcomes can show. This chapter builds the scorecard: leading indicators that attach to the chain, milestones with dates, outcomes read at the top, publication used selectively, and the named-document rule that keeps activity from passing as progress.
By Myriam Ayada · MindXO · July 2026
In brief
A governance program takes years to build, and the events it exists to prevent are rare, so outcomes alone cannot evidence progress for some time. The working instrument is a scorecard with three layers: leading indicators that signal the system is being built, milestones that either happened by their date or did not, and outcomes that describe how the governed system behaves once it runs. The discipline holds across all three: measure the chain, count what closed, and give every indicator an owner and a cadence.
Evidence before results
The measurement problem in governance is structural. Institutions take time to build: a regulator staffs over years, an assurance market forms only after binding rules create demand for it, and the capabilities of Part IV carry hiring and procurement cycles of their own. The events the program exists to prevent are rare even where governance is absent, so the early years produce almost no outcome data. The absence of incidents proves little in either direction: a quiet year is consistent with controls that work, with systems deployed too narrowly to matter, and with incidents that occurred and went unreported.
This is why Chapter 2 placed a measurement baseline among the five artefacts of the design stage. Indicators and milestones defined before delivery begins make progress observable from the first year, when the only material available is evidence of assembly: documents brought into force, entities staffed, capabilities funded. A program that waits for outcome data reports nothing defensible for years, and reporting that cannot rest on evidence tends to rest on announcement.
Three layers
The scorecard has three layers, separated by what they measure, by who reads them and by how often. The layers mature in sequence: leading indicators move within months, milestones accumulate through the middle years, and outcomes become readable once the governed system operates at scale. Binding instruments already carry this structure internally: Regulation (EU) 2024/1689 staggers its obligations through 2027 on published dates, a milestone schedule any observer can check against the calendar.
Layer 1. Leading indicators: is the system being built
What it measures: signals that the system is being built. Each attaches to a link of the chain from Chapter 5 and moves months or years before any outcome can. Examples: links closed per principle, functions with exactly one owner (Chapter 6), assessors accredited, standards cited by rulebooks, capability staff in post, decision records current. Reads at: monthly, by the program owner.
Layer 2. Milestones: did the dated event happen
What it measures: dated events that either happened or did not. Each carries a date set in advance, so slippage is visible without interpretation. Examples: the instrument adopted (Chapter 8), the first rulebook published, the first accredited audit delivered, the first evaluation report issued, wave one live (Chapter 7). Reads at: quarterly, by the design authority or its successor.
Layer 3. Outcomes: how the governed system behaves
What it measures: the behaviour of the governed system once it runs. The layer matures last and moves slowest, and it is the only one that shows whether the program changed anything. Examples: share of in-scope deployed systems under assurance, median time from application to approval, incident reporting rates and their trend (the single path of Chapter 11 makes them countable), evidence freshness at link six. Reads at: twice a year, at the ministerial or cabinet level.
Sheet 12 of 13, three layers, the owners who read them, and the evidence that feeds them: outcomes at the top, read twice a year at the ministerial level; milestones in the middle, read quarterly by the design authority; leading indicators at the base, read monthly by the program owner. Evidence from link six of the chain feeds the scorecard from below, and a selected statement of milestones and outcome trends is published annually from the top.
Measuring the chain, and only the chain
Every indicator on the scorecard names the link it observes and the owner accountable for moving it. Links closed per principle reads the whole chain at once. Standards cited by rulebooks reads the joint between links four and five, where the two regimes meet. Evidence freshness reads link six and its return path, the flow whose reader and cadence Chapter 5 assigned to this chapter. An indicator that cannot name its link is measuring something other than the program, and it leaves the scorecard at the first review.
Sentiment and activity are excluded by construction. What is counted is what the chain is made of: documents in force, entities staffed, citations made, and evidence produced and read, which is the return path of Chapter 5 in operation. Nothing else registers, whatever its volume, because nothing else carries an owner, a date and a link. The same construction keeps the set small. A short set survives its readings, and twenty indicators with owners and cadences steer more than eighty without them.
Publication, selectively
Chapter 3 described evaluation as the function that creates pressure by making performance visible. The same logic applies to the governance program itself. A public annual statement of milestones reached and outcome trends gives the program standing: dates become checkable by parliaments, firms and peer governments, and a missed milestone becomes a matter of record. The comparison is already organised, since the OECD.AI Policy Observatory tracks national AI policies and their instruments across jurisdictions and makes visible practice comparable; a program that publishes its milestones enters that comparison on its own record.
Leading indicators stay internal. They are steering instruments, and they perform poorly as communication: partial counts invite comparison before the system exists, and a published indicator tends to become a target managed for its own sake. The split is itself a recorded design decision with an owner: milestones and outcome trends outward, once a year; leading indicators inward, at the monthly reading where they can still change the next quarter of work.
The scorecard as the handover's spine
Governance programs outlast the teams that design them. The design authority hands over to permanent entities, ministers and mandates change, and the waves of Chapter 7 spread delivery across political cycles. The scorecard is the artefact built to survive those transitions, because it is the one document a successor needs on the first day: what was promised, what closed, what is due next, and who owns each line.
Its lifecycle runs the length of the playbook. It is designed at the measurement baseline of Chapter 2, before delivery begins. It transfers at the handover of Chapter 9, where it hands the receiving entities their first-year targets. It is read against the sequencing record of Chapter 7, so slippage is visible wave by wave rather than in aggregate. And it feeds the readiness self-assessment of Chapter 13, where the same questions are asked of a jurisdiction before design begins.
Common failure mode. Activity theatre. The scorecard fills with what is easy to count: workshops held, strategies cited, memoranda signed, committees convened. Every such number can rise for years while no link of the chain closes. The named-document rule holds the line: an indicator counts only what exists in force, with an owner and a date, on the chain. An entry that cannot point to a document, a staffing record or a citation is activity, and the scorecard carries no row for it.
The scorecard closes Part IV. The architecture, the design phase and the build now report to a single instrument, and the playbook's argument is complete. What remains is the toolbox: Chapter 13 turns the twelve chapters into a readiness self-assessment and the templates a design team can run, starting from whichever state a jurisdiction is in.
Three questions for every government
- Which indicators attach to which links of the chain, and who owns each at which cadence?
- Which milestones have dates, and which dates have passed without the milestone?
- What is published, what is internal, and who decided?
Selected public sources
- OECD.AI Policy Observatory, OECD
- Regulation (EU) 2024/1689 (AI Act), European Union, 2024
- AI Risk Management Framework and Generative AI Profile, NIST, 2023 and 2024
- ISO/IEC 42001, AI management systems, ISO/IEC, 2023