AI Governance and SME Performance: The Roles of Governance Quality, Risk Management, And Employee AI Literacy in Vietnam

Abstract

This study investigates the links among AI risk management capability, internal AI governance quality, and organizational performance in SMEs while also assessing the moderating role of employee AI literacy. Building on Dynamic Capabilities Theory and Sociotechnical Systems Theory, it frames organizational performance as the product of capabilities that allow SMEs to detect and reduce AI related risks, put in place effective governance arrangements, and match technological systems with human knowledge and responsibility. Employee AI literacy operates as a boundary condition that influences whether internal AI governance can convert into improved organizational outcomes. A quantitative cross sectional design gathered responses via a five point Likert scale questionnaire from 385 Vietnamese professionals familiar with AI adoption, organizational governance, risk management, information technology, data analytics, or AI supported business activities. IBM SPSS version 26 handled reliability assessment, exploratory factor analysis, and multiple linear regression, while Hayes’ Process Macro Model 1 tested the moderating effect. The results reveal that AI risk management capability (β = 0.565) and internal AI governance quality (β = 0.618) both significantly enhance organizational performance in SMEs. Internal AI governance quality yields the larger direct effect, underscoring the value of clear accountability, transparent procedures, human oversight, and enforceable controls. Employee AI literacy further intensifies the positive association between internal AI governance quality and organizational performance through a significant interaction coefficient of 0.446. The findings show that formal governance structures by themselves cannot ensure performance gains. SMEs need to combine systematic AI risk management and substantive governance arrangements with employees’ capacity to grasp AI principles, assess algorithmic outputs, acknowledge limitations, and handle ethical and compliance issues.