04 key questions under the United Nations Convention against cybercrime (Hanoi Convention) that should be considered by enterprises developing and deploying AI

Artificial intelligence (“AI”) is helping enterprises accelerate growth, but it is also quietly opening new avenues of legal risk. When an AI system is exploited to generate fraudulent content, facilitate scams, automate cyberattacks, or fails to provide traceable data when requested by investigative authorities, can enterprises truly remain “outside” the scope of legal liability?

In recent years, the adoption of AI in business operations, internal governance, and service delivery has become a dominant trend among enterprises in Vietnam. AI enables process optimization, cost reduction, and expanded market reach. However, alongside these benefits is a significant increase in legal risks associated with cybercrime, particularly where AI is exploited as a tool or becomes a point of vulnerability within digital infrastructure.

Against this backdrop, the United Nations Convention against cybercrime, adopted in Hanoi (the “Hanoi Convention”), established an international legal framework to strengthen the prevention, investigation, and prosecution of cross-border cybercrime. Although the convention does not regulate AI specifically, its conduct based, infrastructure focused, and control based approach places AI systems squarely within its regulatory scope.

In this article, BLawyers Vietnam analyzes the key provisions of the Hanoi Convention that enterprises should carefully consider when researching, developing, deploying, and operating AI systems in Vietnam from 2026.

1. Could an enterprise’s AI system be considered “infrastructure capable of facilitating cybercrime”?

The Hanoi Convention adopts a technology neutral approach to cybercrime. Under this framework, any information system, digital platform, or technological tool capable of being exploited to facilitate criminal conduct may fall within its scope. In the context of AI:

1. AI systems may be exploited to automate cyberattacks, fraud schemes, or unauthorized system intrusions;
2. AI systems may generate synthetic or manipulated content (including deepfakes or other synthetic media), resulting in financial harm, reputational damage, or information security risks; and
3. AI systems may operate as “black boxes,” complicating the determination of causation and allocation of legal responsibility.

From the perspective of the Hanoi Convention, enterprises are no longer viewed as neutral intermediaries if they manage, operate, or deploy AI systems. Rather, enterprises are treated as entities exercising control over digital infrastructure and may bear certain obligations to prevent cybercrime risks arising from systems under their control.

2. What are an enterprise’s obligations when authorities request access to AI related data?

A central pillar of the Hanoi Convention is international cooperation in cybercrime investigation and enforcement. Accordingly, member states are obligated to establish mechanisms requiring:

1. Preservation of electronic data;
2. Disclosure of information and data necessary for investigative purposes; and
3. Assistance in tracing the origin of unlawful conduct.

For enterprises deploying AI systems, these obligations raise critical legal and technical considerations, including:

1. Whether the enterprise maintains complete operational logs, training datasets, and decision-making histories of its AI systems;
2. Whether the AI system has sufficient explainability and traceability capabilities to reconstruct relevant events upon request by competent authorities; and
3. Whether the enterprise has established internal procedures to respond to data disclosure requests from domestic and foreign investigative authorities.

In practice, many enterprises deploying AI in Vietnam currently do not have mechanisms in place to store logs, training data, or ensure the explainability of AI decisions. If enterprises fail to establish such mechanisms in advance, the inability to provide or preserve data may be considered a lack of cooperation, thereby increasing legal risks, even where the enterprise did not directly engage in any unlawful conduct.

3. How should enterprises balance cybercrime cooperation obligations with data protection and trade secret protections?

The Hanoi Convention affirms that cybercrime prevention and enforcement must be conducted in a manner consistent with human rights, privacy protections, and the legitimate interests of organizations and individuals. However, enterprises deploying AI face a complex balancing challenge:

1. On one hand, enterprises must cooperate and provide information to support the investigation; and
2. On the other hand, enterprises must comply with applicable laws governing personal data protection, intellectual property, and trade secret protection.

The absence of clear data classification policies, inadequate procedures for assessing permissible disclosure scope, or excessive disclosure beyond legally required limits may expose enterprises to claims from customers, business partners, or users.

Therefore, in the context of the Hanoi Convention, enterprises using AI should promptly establish data and AI governance mechanisms and clearly define:

1. What categories of data may be disclosed;
2. Which entity has the authority to make such decisions; and
3. The procedures and scope for providing information.

4. How does the Hanoi Convention affect legal liability allocation across the AI value chain?

Although the Hanoi Convention does not directly regulate civil liability, when viewed alongside Vietnam’s Law on AI 2025, a clear legal trend emerges: liability is increasingly linked to the entity that exercises control over, and exploits the risk. This means that:

1. Enterprises deploying AI systems may face legal exposure even if they did not directly commit any criminal acts;
2. Failure to implement adequate oversight, monitoring, or risk mitigation mechanisms may be treated as an adverse factor in determining liability; and
3. Contracts with developers, vendors, and technology partners become critical tools for allocating legal responsibility and risk within the AI value chain.

In practice, the Hanoi Convention is establishing a compliance standard (seemingly indirectly), requiring enterprises to recognize AI not merely as a technological tool, but also as a source of legal risk that must be proactively governed.

Legal Support from BLawyers Vietnam

BLawyers Vietnam can assist enterprises with:

1. Assessing the level of “risk exposure” and the impact of the Hanoi Convention and Vietnamese cybercrime laws on AI systems currently being deployed;
2. Advising on the development of AI governance, cybersecurity, and data management frameworks aligned with international legal standards and capable of withstanding cross-border investigative requests;
3. Advising on incident response, investigation cooperation obligations, and legal exposure arising from AI related cybercrime incidents; and
4. Reviewing and drafting contractual provisions to allocate responsibilities and risks across the AI development, supply, and deployment chain.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. BLawyers Vietnam would love to hear from you.

Date: 07 April 2026

Writer: Ha Le