The question FDI enterprises developing artificial intelligence products in Vietnam ask most often is how the 2026 framework classifies risk and what must be complied with right now. The honest answer is that the Digital Technology Industry Law 71/2025/QH15 sets a risk-based management direction and user transparency principles, while the detailed classification criteria and specific labelling duties still await guiding documents. This article separates the framework already in force from the parts still pending, and shows how to prepare for sensitive fields such as recruitment, credit and healthcare, and how to localise a model imported from a foreign parent company.
What the 2026 framework already contains and what still awaits guidance
What already exists is Law 71/2025/QH15 itself: a risk-based direction for managing artificial intelligence according to the harm a system can cause to people and society, a principle of transparency toward users interacting with such systems, and baseline duties from personal data law covering training and operating data. What does not yet exist is a detailed criteria table for each risk tier, a catalogue of applications deemed high risk, and technical specifications for labelling content generated by artificial intelligence. Any advisory presenting a complete classification table as if already enacted in Vietnam is running ahead of the actual legal texts available today.
The sensible preparation during this waiting period is internal self-classification following the risk logic the law declares: the more directly a system decides people’s entitlements, such as jobs, loans, diagnoses or scores, the stronger the internal controls must be, even before an official label exists. Enterprises should keep an impact assessment file for each product recording its purpose, affected groups, input data and human oversight arrangements. That file is both evidence of good-faith compliance today and ready raw material when the guiding documents require formal classification on prescribed templates in the near future.
User transparency and oversight for sensitive applications
Transparency duties are clear at principle level: users must know when they are interacting with an artificial intelligence system rather than a person, must be able to recognise system-generated content in cases the law designates, and must have a channel to request explanations and complain about automated outcomes affecting them. For enterprises, transparency is more than one notice line buried in terms of use; display position, plain language drafting and whether users can actually find the complaint channel are exactly what regulators and courts will examine when a dispute arises over a harmful automated decision taken against a customer or an applicant.
In recruitment, credit and healthcare, the fields most often expected to sit in the high-risk group, oversight to apply immediately includes testing training data for bias, periodically checking accuracy and adverse outcome rates across user groups, keeping decision trails retrievable for complaints, and a mandatory human stop before an automated output becomes the final decision on a candidate, a borrower or a patient. An FDI enterprise importing a model from its parent must localise through Vietnamese-language validation data, Vietnamese labour and credit law context, and an accountable in-country owner, rather than merely translating the user interface into Vietnamese while leaving governance offshore.
Frequently Asked Questions
By what criteria are AI products classified by risk under the 2026 framework?
As at the date of writing, the accurate answer is that no detailed classification criteria table has been issued: the 2026 framework consists of Law 71/2025/QH15 with its risk-based direction and declared principles, while specific tier criteria and a high-risk application catalogue await guiding documents. Enterprises should not lift the classification table of the European Union or another jurisdiction and treat it as a Vietnamese duty. The right step now is internal assessment using the law’s own risk logic, covering how strongly the system affects people’s entitlements, the sensitivity of the sector and how reversible its decisions are, with the assessment kept on file for reconciliation once official guidance is issued.
What do transparency duties toward users interacting with AI comprise?
At principle level, users must be told when they are interacting with an artificial intelligence system, must be able to identify system-generated content in cases subject to transparency, and must have a channel to seek explanations and complain about automated outcomes affecting them. Enterprises should turn that principle into a real experience: notices shown at the interaction point instead of hidden in long terms, plain-language explanations of the main factors behind an outcome, and a complaint process with response deadlines. Detailed technical labelling specifications will come from the guiding documents, and product teams should be ready to update interfaces once those documents take effect.
What oversight requirements must high-risk AI in recruitment, credit and healthcare satisfy?
Although the official high-risk catalogue is still pending, these three fields directly affect livelihoods and health, so enterprises should self-apply high oversight now: bias testing of data and models, monitoring of adverse outcome rates by group, complete decision trails, and mandatory human approval of the final step before an automated output becomes a decision on recruitment, credit granting or diagnostic support. In healthcare the system should remain a professional support tool and never replace the judgement of licensed practitioners; in credit and recruitment, affected persons must have a complaint route that reaches an actual human reviewer.
How must an FDI enterprise importing an AI model from its parent localise compliance?
Compliance localisation has four parts: revalidate the model on Vietnamese data and scenarios instead of trusting test results from the home market; ensure Vietnamese user data is processed under domestic personal data law even where the model runs on group infrastructure; adapt transparency notices and complaint channels to Vietnamese language and local user habits; and appoint an accountable owner in Vietnam for post-deployment model monitoring. Intra-group agreements should allocate clearly what the parent answers for in the base model and what the subsidiary answers for in local operation and user relations within Vietnam.
Review your AI product before official classification lands, with FLAT Law Firm
FLAT Law Firm helps FDI enterprises build artificial intelligence compliance files matching the law as it stands: impact assessments and internal risk classification following the logic of Law 71/2025/QH15, transparency notices and complaint procedures for users, human stop points for recruitment, credit and healthcare applications, and intra-group contracts allocating responsibility for imported models. Contact FLAT Law Firm to prepare during the guidance-waiting period, instead of starting only when the documents are issued and being caught by short transition deadlines.
