生成式人工智慧（Generative Artificial Intelligence, GAI）逐漸成為組織日常工作中的重要工具。因GAI 具有高度易用性與跨任務應用特性，員工能夠快速將其運用於文件撰寫、資料整理、內容生成與決策輔助等工作。然而，這也使治理風險更容易發生在日常使用過程中，例如使用者可能在提示詞中輸入敏感或機密資訊，或在未充分查證的情況下採用看似合理但實際錯誤的生成內容。因此，GAI 治理不應只依賴由上而下的規範或系統端限制，也需要建立能夠配合實際工作流程的風險管理作法。
本研究以 Buy-In 理論與任務科技配適觀點為基礎，探討使用者參與如何影響 GAI 治理績效。研究模型將「與業務契合之幻覺風險管理」與「與業務契合之隱私風險管理」作為中介機制，並進一步納入 GAI 任務類型，包括效率導向與創新導向任務，作為調節變數，以檢驗不同使用任務情境是否會影響治理關係。
本研究採問卷調查法，以具有 GAI 工作使用經驗之職場工作者為研究對象，最終取得 149 份有效樣本。研究結果顯示，使用者參與對 GAI 治理績效具有顯著總效果，且能顯著促進兩類與業務契合之風險管理機制。同時，與業務契合之幻覺風險管理與隱私風險管理皆能顯著提升 GAI 治理績效。中介分析結果進一步指出，使用者參與主要是透過上述風險管理機制間接影響治理績效；相較之下，GAI 任務類型的調節效果未獲統計支持。
本研究的主要貢獻在於將 Buy-In 理論應用於 GAI 治理情境，說明使用者參與的價值不僅在於提升使用者對治理規範的理解與接受度，更在於協助組織把抽象的治理原則轉化為可執行、且能融入工作流程的風險管理機制。實務上，組織在制定 GAI 使用規範時，應納入使用者的實際經驗，進一步設計可落實的輸出驗證流程與資料保護作法。

As Generative Artificial Intelligence (GAI) becomes embedded in organizational work, governance risks increasingly arise from everyday user–model interactions. Employees may disclose sensitive information in prompts or use fluent but inaccurate outputs in work processes. Therefore, GAI governance requires not only top-down rules, but also risk management mechanisms aligned with actual workflows.
Drawing on Buy-In Theory and Task-Technology Fit (TTF), this study examines how User Participation influences GAI Governance Performance through Business-Aligned Hallucination Risk Management and Business-Aligned Privacy Risk Management. It also tests whether GAI Activity Type, including efficiency-oriented and innovation-oriented activities, moderates these relationships. Based on 149 valid survey responses from workforce members with GAI usage experience, the results show that User Participation significantly enhances both risk management mechanisms, which in turn improve GAI Governance Performance. The mediation analysis indicates an indirect-only mediation pattern, while the moderating effects of GAI Activity Type are not statistically supported.
This study extends Buy-In Theory to the GAI governance context by showing that user participation contributes to governance not only through users’ understanding of governance requirements, but also through the development of practical, workflow-aligned risk management mechanisms. The findings also suggest that organizations should incorporate user experience when designing GAI usage guidelines, verification procedures, and data protection practices.

1. Barki, H., & Hartwick, J. (1989). Rethinking the concept of user involvement. MIS Quarterly, 13(1), 53–63.
2. Baroudi, J. J., Olson, M. H., & Ives, B. (1986). An empirical study of the impact of user involvement on system usage and information satisfaction. Communications of the ACM, 29(3), 232–238.
3. Bryman, A. (2016). Social research methods (5th ed.). Oxford University Press.
4. Choi, T. M., Cheng, T. C. E., & Zhao, X. (2016). Multi-methodological research in operations management. Production and Operations Management, 25(3), 379–389.
5. Crossler, R. E., Johnston, A. C., Lowry, P. B., Hu, Q., Warkentin, M., & Baskerville, R. (2013). Future directions for behavioral information security research. Computers & Security, 32, 90–101.
6. D’Arcy, J., Hovav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research, 20(1), 79–98.
7. Dhillon, G., Oliveira, T., Susarapu, S., & Caldeira, M. (2016). Deciding between information security and usability: Developing value-based objectives. Computers in Human Behavior, 61, 656–666.
8. Dwivedi, Y. K., Kshetri, N., Hughes, L., Slade, E. L., Jeyaraj, A., Kar, A. K., Baabdullah, A. M., Koohang, A., Raghavan, V., Ahuja, M., Albanna, H., Albashrawi, M. A., Al-Busaidi, A. S., Balakrishnan, J., Barlette, Y., Basu, S., Bose, I., Brooks, L., Buhalis, D., ... Wright, R. (2023). Opinion paper: “So what if ChatGPT wrote it?” Multidisciplinary perspectives on opportunities, challenges and implications of generative conversational AI for research, practice and policy. International Journal of Information Management, 71, Article 102642.
9. Etikan, I., Musa, S. A., & Alkassim, R. S. (2016). Comparison of convenience sampling and purposive sampling. American Journal of Theoretical and Applied Statistics, 5(1), 1–4.
10. Feuerriegel, S., Hartmann, J., Janiesch, C., & Zschech, P. (2024). Generative AI. Business & Information Systems Engineering, 66(1), 111–126.
11. Floridi, L., & Chiriatti, M. (2020). GPT-3: Its nature, scope, limits, and consequences. Minds and Machines, 30(4), 681–694.
12. Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39–50.
13. Goodhue, D. L., & Thompson, R. L. (1995). Task-technology fit and individual performance. MIS Quarterly, 19(2), 213–236.
14. Hair, J. F., Black, W. C., Babin, B. J., & Anderson, R. E. (2010). Multivariate data analysis (7th ed.). Pearson.
15. Hartwick, J., & Barki, H. (1994). Explaining the role of user participation in information system use. Management Science, 40(4), 440–465.
16. International Organization for Standardization, & International Electrotechnical Commission. (2023). ISO/IEC 42001:2023 Information technology—Artificial intelligence—Management system (1st ed.). International Organization for Standardization.
17. Ives, B., & Olson, M. H. (1984). User involvement and MIS success: A review of research. Management Science, 30(5), 586–603.
18. Janssen, M. (2025). Responsible governance of generative AI: Conceptualizing GenAI as complex adaptive systems. Policy and Society, 44(1), 38–51.
19. Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y. J., Madotto, A., & Fung, P. (2023). Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12), 1–38.
20. March, J. G. (1991). Exploration and exploitation in organizational learning. Organization Science, 2(1), 71–87.
21. Markus, M. L., & Mao, J.-Y. (2004). Participation in development and implementation: Updating an old, tired concept for today’s IS contexts. Journal of the Association for Information Systems, 5(11), 514–544.
22. Naderifar, M., Goli, H., & Ghaljaie, F. (2017). Snowball sampling: A purposeful method of sampling in qualitative research. Strides in Development of Medical Education, 14(3), 1–6.
23. Nah, F.-H., Zheng, R., Cai, J., Siau, K., & Chen, L. (2023). Generative AI and ChatGPT: Applications, challenges, and AI-human collaboration. Journal of Information Technology Case and Application Research, 25(3), 277–304.
24. Nunnally, J. C. (1978). Psychometric theory (2nd ed.). McGraw-Hill.
25. Parker, C., Scott, S., & Geddes, A. (2019). Snowball sampling. In P. Atkinson, S. Delamont, A. Cernat, J. W. Sakshaug, & R. A. Williams (Eds.), SAGE research methods foundations. SAGE Publications.
26. Podsakoff, P. M., MacKenzie, S. B., Lee, J.-Y., & Podsakoff, N. P. (2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879–903.
27. Preacher, K. J., & Hayes, A. F. (2008). Asymptotic and resampling strategies for assessing and comparing indirect effects in multiple mediator models. Behavior Research Methods, 40(3), 879–891.
28. Puhakainen, P., & Siponen, M. (2010). Improving employees’ compliance through information systems security training: An action research study. MIS Quarterly, 34(4), 757–778.
29. Raisch, S., & Krakowski, S. (2021). Artificial intelligence and management: The automation–augmentation paradox. Academy of Management Review, 46(1), 192–210.
30. Schneier, B. (2009). Schneier on security. John Wiley & Sons.
31. Siponen, M., Mahmood, M. A., & Pahnila, S. (2014). Employees’ adherence to information security policies: An exploratory field study. Information & Management, 51(2), 217–224.
32. Spears, J. L., & Barki, H. (2010). User participation in information systems security risk management. MIS Quarterly, 34(3), 503–522.
33. Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). National Institute of Standards and Technology.
34. Wang, J., Xiao, N., & Rao, H. R. (2015). Research note—An exploration of risk characteristics of information security threats and related public information search behavior. Information Systems Research, 26(3), 619–633.
35. Xue, L., Ray, G., & Sambamurthy, V. (2012). Efficiency or innovation: How do industry environments moderate the effects of firms’ IT asset portfolios? MIS Quarterly, 36(2), 509–528.
36. Zhao, X., Lynch, J. G., Jr., & Chen, Q. (2010). Reconsidering Baron and Kenny: Myths and truths about mediation analysis. Journal of Consumer Research, 37(2), 197–206.
37. Zigurs, I., & Buckland, B. K. (1998). A theory of task/technology fit and group support systems effectiveness. MIS Quarterly, 22(3), 313–334.