Welcome to The Lawyers Talk, a podcast by BLawyers Vietnam. I am Dang Thi Kim Chau, and in today’s episode, we are discussing a topic that is becoming increasingly relevant for businesses: AI and the law. AI can help businesses work faster and more efficiently, but what legal risks come along with it?
Today, AI is being integrated into almost every aspect of business operations, from internal management and customer service to recruitment and data analytics. However, along with this rapid adoption come very real and practical legal questions that many businesses are still not fully prepared to address. That is also why the topic of AI and the law is becoming more and more important.
- If AI causes harm to customers, business partners, or users, who will ultimately be legally responsible?
- How far can a business go in using data to train AI, and where is the legal line it should not cross?
From the perspective of AI and the law, this is no longer just a technology story. It is also a story about legal responsibility, data ownership, personal data protection, and how businesses manage risk when they bring AI into their operations.
In particular, under the Law on Artificial Intelligence 2025 (“AI Law 2025”), together with the Law on Personal Data Protection 2025 (“PDP Law 2025”) and related regulations, businesses using AI are no longer seen merely as users of technology. They may also be treated as parties responsible for the risks created by AI systems.
So if your business is already using AI, or planning to do so, what legal risks should you be spotting early? That is what we are discussing today.
1. First question: If AI causes harm, how might a business be held legally responsible?
This is one of the questions we hear quite often from businesses: “If AI learns on its own, analyzes information on its own, and then makes the wrong decision, does the business still have to take responsibility?”
Legally speaking, at least for now, AI is not treated as an independent legal person that can stand on its own and bear liability by itself. So when an AI system causes damage, the real question is usually not whether “the AI was wrong,” but who developed it, supplied it, deployed it, controlled it, or used it.
Under the approach taken by the AI Law 2025, responsibility is allocated based on the role each party plays in the AI chain, including AI developers, AI providers, deployers, and users of AI systems.
More specifically, responsibility may be allocated in the following way:
- For AI developers, liability may arise if the problem comes from the algorithm, the training data, the system design, or technical features that do not adequately ensure safety.
- For AI providers, obligations may include risk assessment, transparency, user guidance, and coordination in handling incidents under the relevant requirements of the AI Law 2025.
- For deployers or users of AI systems, liability may arise during operation, supervision, incident logging, notification to relevant parties or competent authorities, and the handling of consequences caused by the AI system.
In practice, many businesses are currently using third-party AI tools, such as AI chatbots, data analytics tools, or AI recruitment systems. But using a third-party service does not automatically mean the business is off the hook.
For example, if a business uses AI to screen job applicants, but the system produces discriminatory outcomes or mishandles applicants’ personal data, it will be difficult for that business to simply say, “That was the AI’s fault.” In many cases, legal responsibility may still come back to the developer, the provider, or the business deploying the system.
Put simply, AI may support human decision-making, but legal responsibility usually does not stop with the AI. In the end, responsibility still tends to come back to the people or organizations behind the development, supply, and use of that tool.
2. Second question: How far can a business go in using data to train AI?
First, here is a very practical question many businesses are asking: “Can a business use emails, images, transaction data, or customer data to train its internal AI systems?”
In the AI era, data is almost the raw material that helps these systems perform better. But that does not mean a business is free to collect any data it wants, feed any data into AI, or reuse old data for any purpose it chooses.
This is especially important now that the PDP Law 2025 took effect on 1 January 2026, together with guiding regulations under Decree No. 365/2025/ND-CP and Decree No. 142/2026/ND-CP. In that legal context, the collection, processing, and use of personal data, especially in technology and AI environments, need to be approached much more carefully.
As a general principle, personal data processing must meet several basic requirements, including:
- There must be an appropriate legal basis for collecting and processing the data, such as valid consent from the data subject or a proper agreement between the data controller and the data processor.
- The data must be used for the purpose that the data subject agreed to.
- Consent must be obtained in an appropriate form and must meet the legal validity requirements under personal data protection law.
For data used to develop or train AI, Article 35 of Decree No. 142/2026/ND-CP also sets out an important principle: “organizations and individuals may only exploit and use data for AI development within the scope, purpose, and access conditions that have been publicly disclosed or contractually agreed.”
In other words, the issue is not just whether a business has the data. The more important question is whether the business has the legal right to use that data for AI training.
When it comes to sensitive personal data, businesses should generally take a strict approach and limit its use for AI training as much as possible. That kind of data should be used only when it is truly necessary, supported by a clear legal basis, backed by valid consent where required by law, assessed for risk in advance, and protected by appropriate security and control measures to reduce the risk of data leakage, reverse inference, or re-identification.
In practice, many businesses are now tending to:
- Collect data at large scale;
- Use publicly available data on the internet; and
- Upload customer data to third-party AI platforms.
That leads to another very common question: “if data is publicly available on the internet, does that mean a business is free to take it and use it to train AI?”
The short answer is: not necessarily.
Under the spirit of Decree No. 142/2026/ND-CP, the exploitation and use of data must not infringe:
- The data ownership rights of individuals;
- Intellectual property rights;
- Privacy rights; and
- The lawful rights and legitimate interests of relevant organizations and individuals.
That means even if data can be accessed publicly, businesses still need to review the source of the data, the access conditions, the platform’s terms of use, the rights of the data subjects, and the purpose for which the data is being fed into the AI system.
Another point worth noting is data anonymization. Under Article 36 of Decree No. 142/2026/ND-CP, a business may still face liability if an AI system can re-identify an individual from anonymized data, or if that data is combined with other sources in a way that reveals a person’s identity.
So the biggest risk is not always that AI is trained on too little data. Very often, the real risk is that a business does not yet clearly know which data it is allowed to use, which data it should not use, what purpose that data may be used for, and how the AI system is actually processing it.
3. 05 things businesses should do right away when using AI
Based on the issues we have just discussed, businesses can start by prioritizing these five areas if they want to use AI effectively while still keeping legal risk under control:
- Review contracts and responsibility allocation with AI providers, especially terms on service scope, safety standards, allocation of liability, limitation of liability, indemnity, and incident handling.
- Control data sources and the purpose for which data is used in AI, including identifying the type of data involved, the right to use it, the intended purpose, access conditions, and any relevant legal restrictions.
- Limit the use of sensitive personal data or confidential information in AI, unless there is a clear legal basis, valid consent where required by law, appropriate security measures, and effective controls to reduce the risk of re-identification.
- Maintain human review and oversight over AI outputs, especially in high-risk areas such as recruitment, finance, insurance, healthcare, education, customer service, or personal data processing.
- Build an internal policy or rulebook for AI use, clearly setting out which AI tools are allowed, what types of data may or may not be entered into AI systems, which cases require prior approval, what responsibilities staff members have, and what process applies when incidents arise.
In short, when businesses talk about AI and the law, the question is not only “What can AI do?” It is also “What is AI allowed to do, what data may legally be used, who is controlling the output, and who will be responsible if something goes wrong?”
At this point, we have walked through the core issues many businesses are now facing as they adopt AI, from legal responsibility when AI causes harm, to the limits on using data for AI training, and the practical steps businesses can take to manage risk from the start.
We hope today’s discussion gives you a more practical view of AI and the law when implementing AI in business operations, especially from the perspective of legal compliance, personal data, and risk management.
If you are interested in AI and the law, or if you are still considering how your business can use AI in a lawful and safer way, feel free to leave a comment so we can continue the discussion in future episodes. And if you would like to learn more about BLawyers Vietnam, you can find more information in the introduction section of The Lawyers Talk.
Thank you for listening, and see you again in the next episode of The Lawyers Talk.
The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.
Date: 29 May 2026
