Short answer: An AI system wrongly rejecting batches of job applicants or scoring credit in a discriminatory way creates no liability vacuum. Current Vietnamese law allocates responsibility to the people and organisations behind the system: the deployer answers for decisions of the tool it uses, the developer answers under contract and for product faults, and no decision is excused merely because an algorithm made it.
Civil liability follows roles, not algorithms
When AI causes harm, legal analysis returns to classical questions: who owed a duty of care, where was it breached, what is the damage and causation. A business using AI in recruitment, credit or insurance pricing is the subject making the final decision toward the affected person: it chose the system, configured decision thresholds and decided whether humans review — so it is the first liability point for victims and regulators. The developer and solution provider answer under the supply contract (warranties on accuracy, training data, known-limitation warnings) and under defective product and service responsibility where the fault lies in the model. An operator misconfiguring the system or using AI outside its design scope carries the corresponding share. Where automated decisions touch personal data, the Personal Data Protection Law 91/2025/QH15 adds a duty layer: impact assessment, information for data subjects and human-intervention mechanisms.
Supervision duties, insurance and contract layers
A deployer’s AI diligence and supervision duties include: testing the system before operation on its own real data (not only trusting vendor test results), periodic bias testing across user groups, decision logs sufficient to explain each complained case, and a kill switch when the system shows mass-error signs. Insurance for AI risk — technology and professional liability — is a forming market tool transferring part of the financial risk, most valuable for the governance discipline insurers demand before issuing a policy. In AI purchase contracts, the deciding clauses are: commitments on training data and accuracy for the application domain, duties to notify known model faults, audit and log-access rights, liability limits proportionate to decision risk, and explanation support when regulators or affected persons demand it.
Minimum governance for decision-making AI
- Never let high-impact decisions about individuals run fully automatically without human review.
- Run scheduled bias testing on real operating data and keep the evidence.
- Keep decision logs retrievable per case within the complaint window.
- Vendor contracts with training-data commitments, fault notice and explanation support.
Frequently asked questions
Who bears civil liability when AI causes harm?
By role on the base of current civil liability: the deployer is the first point toward the victim because it chose and operates the system; the developer answers under contract and product fault where harm originates in the model; misconfiguration and out-of-design use fall to the operator. A court or regulator allocates by each party’s fault contribution.
What AI diligence and supervision duties does a business have?
Pre-operation testing on the business’s own real data, periodic bias checks, abnormal-output monitoring, human review of important decisions and the ability to halt the system on mass errors. These are both governance duties in the direction of Law 71/2025 for high-risk systems and evidence of care when liability is examined.
Is there insurance for AI risk?
The market is forming technology and professional liability products that can cover part of AI-system risk, subject to each policy’s terms and exclusions. Insurance transfers financial risk, not legal responsibility toward victims and regulators — and insurers usually require a standard-grade AI governance file before accepting the risk.
Which clauses does an AI solution contract need?
Commitments on training-data origin and lawfulness; model accuracy and known limits in the application domain; duties to notify faults and model updates; decision-log access and explanation support on complaints and inspections; and liability limits proportionate to the impact of decisions the system makes.
This article has been quality-reviewed by the FLAW AI Legal Council