From Compliance Burden to Organizational Resilience: A System Dynamics Model of AI Risk Governance in SMEs

Abstract

The paper provides a system dynamics model that would explain the way in which small and medium-sized enterprises (SMEs) can use AI compliance as an administrative burden, rather than an organizational resilience capacity. Based on the dynamic capabilities theory, organizational resilience studies, AI risk management principles, and system dynamics, the research designs feedback among AI experimentation, strength of deploying AI, compliance maturity, risk exposure, learning incidents, slack resources, and resilience capacity. The results section describes normal simulation behavior in three policy options: innovation-first, compliance-first, and balanced adaptive governance. The simulated findings suggest that innovation-first adoption creates high early growth in capabilities; on the other hand, compliance-first governments create less exposure but hides innovation throughput. The adaptive-governance with balance scenario works best within a 36-month horizon since it encompasses leveled controls, more adaptive learning loop, and even-tailed review. The debate suggests that AI risk governance in SMEs needs to be technologised as dynamic resourcefulness instead of an unchanging compliance audit. The paper also introduces a feedback based theory of AI governance among SMEs and where the policy leverage points are that managers can use to safeguard innovation whilst enhancing resiliency.