Using AI in enterprises: How should businesses prepare to comply with Decree No. 142/2026/ND-CP?

Does your business use AI chatbots, Copilot, ChatGPT Enterprise, Gemini, recruitment AI, customer scoring AI, OCR, or marketing content generation tools? If so, the question is no longer merely “how much time can AI save”, but rather “what compliance obligations does the business have when using AI”.

On 30 April 2026, the Government issued Decree No. 142/2026/ND-CP detailing certain articles and implementation measures of the Law on Artificial Intelligence (“Decree 142”). Accordingly, these AI tools may no longer be merely operational support solutions, but may also trigger new compliance obligations relating to risk classification, transparency, conformity assessment, vendor governance, and AI incident handling.

In this article, BLawyers Vietnam presents 03 practical questions that management teams and legal, human resources, marketing, and technology departments should immediately review: what role the business plays in the AI lifecycle, what risk level applies to the AI systems being used, and what preparations are required to mitigate legal risks when deploying AI in business operations.

1. What role should a business identify when using AI?

Decree 142 introduces new compliance obligations for various parties involved in the lifecycle of an AI system, including providers, developers, deployers, and users of artificial intelligence systems. Therefore, before identifying specific obligations, businesses should clarify their role in relation to each AI system they use. Specifically:

1. AI system developer: This role commonly arises for technology companies, software developers, or businesses that build, train, or fine-tune AI systems themselves for their own business operations or to provide them to others.
2. AI system provider: This role may arise when a business commercializes, distributes, or provides an AI system to customers, users, or third parties under its own name or brand.
3. AI system deployer: This is a role that many businesses should pay particular attention to. A business may not develop or provide AI itself, but if it introduces an AI system into its business processes, services, or commercial activities, it may be considered a deployer. Examples include using an AI chatbot on a website for customer service, using AI to screen candidate profiles, using AI to score customers, analyze files, or generate public marketing content.
4. AI system user: This role may arise when a business or its personnel use tools such as Copilot, ChatGPT Enterprise, Gemini, OCR, document summarization tools, drafting support tools, or content generation tools for day-to-day work.

In practice, the same business may have different roles depending on each AI system. For example, a business may be a deployer for a customer service chatbot integrated into its website, but only a user of an internal AI drafting support tool. Conversely, if a business launches an AI product to the market under its own brand, it may be considered a provider; if it designs, trains, or fine-tunes an AI system itself, it may also be a developer.

Accordingly, the first question a business should address is not “does the business develop AI”, but rather:

1. Where is the business using or deploying AI;
2. For what purpose is AI being used;
3. Does the business control how the AI system is used in its business operations;
4. Is the AI developed by the business, provided by the business under its own brand, supplied by a third-party vendor, or merely used by personnel as a support tool;
5. Do AI outputs affect customers, employees, candidates, or third parties

Correctly identifying the relevant role is important because each role may entail a different scope of responsibility. Businesses should not automatically assume that they are merely “AI users” if, in reality, they control and introduce AI systems into commercial activities or service provision. Conversely, businesses should not apply all obligations of developers or providers if they only use AI tools for internal support purposes.

From a compliance governance perspective, businesses should consider preparing an AI inventory to identify AI tools currently used or deployed in their business operations. On that basis, businesses can determine their corresponding role, the risk level of each AI system, vendor contracts, and obligations relating to personal data if the AI system processes personal data.

2. Low, medium and high-risk AI systems: What must businesses do?

After identifying the AI systems being used, businesses should determine the risk level of each AI system. Under Decree 142, AI systems are classified according to different risk levels, with particular attention required for medium-risk AI systems and high-risk AI systems. Specifically:

(i) For low-risk AI systems, meaning systems that do not fall into the high-risk or medium-risk categories:

1. Businesses using AI have the right to exploit and use the system for lawful purposes and are responsible before the law for their own use;
2. Providers and deployers are responsible for explaining, upon request by competent state authorities, their compliance with the lawful rights and interests of organizations and individuals.

Accordingly, for businesses using or deploying low-risk AI systems, the key focus should be using AI for lawful purposes, controlling its use, and ensuring that the lawful rights and interests of other organizations and individuals are not infringed.

(ii) For medium-risk AI systems, this category covers AI systems that may mislead, affect, or manipulate users because users do not recognize that they are interacting with an AI system or receiving AI-generated content. In such cases:

1. Businesses using AI are responsible for complying with regulations on notification and labeling of artificial intelligence systems;
2. Providers, deployers, and users should note responsibilities relating to transparency, notification, and labeling of AI systems under Decree 142.

In practice, this category may arise when businesses use or deploy chatbots, virtual assistants, tools that generate content, images, audio, or video, or other AI tools that may prevent recipients from clearly recognizing that they are interacting with an AI system or receiving AI-generated content. In these cases, businesses should check applicable notification, labeling, or AI content identification obligations.

(iii) For high-risk AI systems, this category covers AI systems included in the list of high-risk AI systems issued by the Prime Minister. For high-risk AI systems, Decree 142 sets out more specific responsibilities for each party, including providers, deployers, and users. Depending on their role, businesses should review the following main groups of responsibilities:

1. For providers: perform obligations relating to risk management, data, technical documentation, conformity assessment, transparency, instructions for use, log retention, and incident handling in accordance with applicable regulations.
2. For deployers: operate the system in accordance with its intended purpose, scope, and instructions; ensure human oversight; perform transparency obligations; record logs within their scope of control; notify relevant parties when detecting risks that may cause serious harm; and coordinate with providers or competent authorities during inspection, assessment, or incident handling.
3. For users: comply with technical instructions and safety measures; refrain from modifying, disabling, or unlawfully interfering with the system; promptly notify the provider or deployer when detecting that the system may cause serious harm; and be responsible for using the AI system in accordance with the law.

Therefore, for businesses deploying or using AI in their business operations, risk classification is the basis for determining corresponding responsibilities. Businesses should avoid assuming that all AI tools have the same risk level, and should also avoid assuming that all compliance obligations rest with the provider. In each specific case, businesses should clearly identify the AI system’s risk level and their own role in order to apply the correct responsibilities under Decree 142.

3. AI compliance checklist for businesses

Based on the responsibilities under Decree 142, businesses deploying or using AI should prepare the following basic governance steps:

1. Preparing an AI system inventory: Businesses should review and record the AI systems being used or deployed, including the tool name, provider, using department, purpose of use, type of data processed, affected groups, the business’s role, and preliminary risk level.
2. Identifying roles and risk levels: For each AI system, businesses should determine whether they are a developer, provider, deployer, or user, and whether the AI system falls into the low-risk, medium-risk, or high-risk category in order to apply the appropriate responsibilities.
3. Reviewing transparency, notification, and labeling: If an AI system interacts with users or generates content in a way that may prevent recipients from clearly recognizing that it is AI or AI-generated content, businesses should check transparency, notification, and labeling obligations under Decree 142.
4. Reviewing contracts with AI providers: If an AI system is provided by a third party, businesses should review contracts, terms of use, and technical documentation to clarify the parties’ roles, scope of use, risk level, operating instructions, transparency mechanisms, cooperation responsibilities in case of incidents, and obligations relating to personal data.
5. Establishing internal guidelines on AI use: Businesses should have internal guidelines on AI use, particularly regarding the types of data that may or may not be entered into AI systems, cases where human review is required before using AI outputs, and the focal point for receiving arising issues.
6. Preparing an AI incident handling mechanism: Businesses should have a mechanism to record, assess, and handle AI incidents, including notifying relevant providers or deployers and coordinating remediation in accordance with applicable regulations.
7. Reviewing personal data obligations: If an AI system processes personal data, businesses should also review personal data protection obligations, including the legal basis for processing, notices to data subjects, contracts with data processors, and impact assessments where applicable.

In summary, businesses should start by identifying where they are using AI, what role they play, the risk level of each AI system, and which issues concerning transparency, contracts, data, and incident handling need to be controlled.

Where should a business start if it does not yet have an internal AI governance framework?

If a business is already using AI but has not yet established an inventory of AI systems, classified their risks, reviewed contracts with AI vendors, or issued internal guidance for employees, this is an appropriate time to conduct an AI compliance review at the governance level. BLawyers Vietnam can assist businesses in identifying compliance gaps and developing a risk-control roadmap tailored to their business model, scope of AI use, and relevant personal data obligations.

• Advising on whether the business’s role is that of an AI developer, provider, deployer, or user;
• Advising on AI system risk classification and corresponding compliance responsibilities;
• Reviewing transparency, notification, labeling, and AI incident handling mechanisms;
• Reviewing contracts, terms of use, and technical documentation with AI providers; and
• Advising on matters relating to personal data, information security, and internal AI governance policies.

Suggested action: A business may begin with a 60–90-minute preliminary review to determine where AI is currently being used, the business’s legal role, which systems should be prioritized for control, and which internal documents should be prepared at the initial stage.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. BLawyers Vietnam would love to hear from you.

Date: 21 April 2026

Writer: Chau Dang