Topic starter
10/07/2026 9:17 pm
TL;DR: Vietnam’s AI Law took effect on March 1, 2026, introducing risk-based oversight, role-based accountability across the AI lifecycle, mandatory safeguards for high-risk systems, and reporting obligations for serious incidents, according to OneTrust’s analysis. The law turns AI governance into an operational control problem, not just a policy exercise.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Vietnam AI Law Explained: What the New Rules Mean for AI Development and Deployment”.
Key questions
Q: What breaks when high-risk AI systems are not governed with ongoing risk management?
A: Without continuous risk management, high-risk AI can produce biased, unsafe, or opaque outcomes that fail legal expectations and damage trust.
Q: Why does lifecycle accountability matter in AI governance?
A: Lifecycle accountability matters because AI risk is shared across developers, providers, deployers, and users.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Risk-classify every AI system before deployment Create a mandatory intake step that assigns low, medium, or high risk using business impact, public safety, and rights impact criteria.
- Map accountability across the AI lifecycle Record the developer, provider, deployer, user, and business owner for each system so governance does not stop at procurement.
- Require pre-deployment conformity evidence For high-risk systems, keep the assessment outcome, reviewer, and supporting documentation attached to the release record.
Bottom line: Vietnam’s AI Law moves AI oversight from general policy into a risk-tiered control model with explicit obligations for high-impact systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Risk tiering is the right governance primitive for AI, but only if organisations can evidence it. The Vietnam AI Law aligns obligations to the likely impact of a system, which is far more workable than a one-size-fits-all rule set. That also means governance teams need reliable classification criteria, documented review decisions, and a repeatable approval path. If those records do not exist, the risk-based model becomes symbolic rather than enforceable.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations handle serious AI incidents under a risk-based regime?
A: They should predefine the conditions that trigger escalation, preserve the evidence needed to explain what happened, and route the case through legal, security, and compliance owners. A serious incident process is effective only when it can move from detection to reporting without reconstruction.
👉 Read our full editorial: Vietnam AI law sets a risk-based model for AI governance