When an artificial intelligence incident occurs (for example, an AI system makes an incorrect decision, data is leaked, or the AI system is unlawfully interfered with), what are the enterprise’s legal responsibilities and what should they do?
The adoption of artificial intelligence (“AI”) in Vietnam is entering a phase of widespread deployment, spanning manufacturing, finance, healthcare, logistics, internal governance, and public services. Alongside this expansion, AI related incidents, including algorithmic errors, inaccurate automated decisions, data breaches, and unauthorized system interference, are increasingly creating significant legal risks for enterprises.
The Law on Artificial Intelligence 2025 (“AI Law 2025”) establishes, for the first time, a dedicated legal framework governing AI incident management, regulatory inspection, liability allocation, and compensation for damages. This development demonstrates that AI is no longer viewed solely as a technological tool but has become a direct subject of legal regulation.
In this article, BLawyers Vietnam analyzes 04 key issues that enterprises should carefully consider when responding to AI incidents from 2026 onward.
1. How does the AI Law 2025 define an “AI incident”?
The AI Law 2025 does not provide a single, explicit definition of an “AI incident”. Instead, through provisions relating to transparency, risk management, incident response obligations, and conformity assessment, the Law approaches “AI incidents” from the perspective of consequences and risks arising during the operation of AI systems. Based on the provisions set out in Articles 11, 12, 14, and 15 of the AI Law 2025, an AI incident may be understood as situations in which::
- The AI system operates outside its intended parameters, causing or threatening to cause damage;
- The AI system infringes upon the lawful rights and interests of organizations or individuals;
- The AI system gives rise to risks relating to data protection, cybersecurity, or public safety; and/or
- The AI system is subject to unauthorized interference, takeover, or unlawful use.
This approach demonstrates that lawmakers do not limit AI incidents to technical malfunctions but extend the concept to include he legal and societal consequences arising from the real world deployment of AI.
2. How may Government authorities intervene in AI incidents?
Under the AI Law 2025, the level of regulatory oversight and intervention by Government authorities depends on the nature and severity of the risk posed by the AI system, particularly in relation to high-risk AI systems.
In practice, AI incidents may be categorized into the following groups:
- Internal technical incidents that have not caused external harm;
- Incidents causing harm to users, customers, or third parties;
- Incidents causing significant harm to life, health, lawful rights and interests of organizations or individuals, national interests, public interests, or national security; and
- Serious incidents that may affect public safety or public order.
For incidents falling under categories (iii) and (iv), the AI Law 2025 authorizes Government authorities to require suspension, withdrawal, or reassessment of the AI system, and to conduct investigations to determine the root cause and allocate liability among relevant parties.
However, the AI Law 2025 does not yet provide clear quantitative criteria for determining what constitutes a “serious incident,” nor does it specify mandatory reporting timelines or mechanisms for mitigation or exemption of liability where enterprises proactively detect and remediate incidents. These areas will require further clarification through implementing decrees and circulars during the transitional period.
3. Who bears legal responsibility when an AI incident occurs?
A fundamental principle under the AI Law 2025 is that AI itself is not recognized as a legally liable entity. Instead, liability is allocated based on the roles of human actors and organizations within the AI value chain, including:
- AI developers: AI developers are organizations or individuals responsible for designing, developing, training, testing, or fine-tuning all or part of an AI model, algorithm, or system, and who exercise direct control over technical methodologies, training data, or model parameters. Legal liability may arise where incidents originate from unsafe system design, defective algorithms, or inadequate training data.
- AI providers: AI providers are organizations or individuals that place AI systems on the market or into operation under their own name, trademark, or brand, regardless of whether the system was developed internally or by a third party. Their obligations include conducting risk assessments, ensuring transparency, and cooperating in incident response and remediation.
- Deployers and users: Deployers and users are responsible for recording incidents, promptly reporting incidents, and cooperating in the remediation process.
In practice, many AI incidents result from combined failures involving multiple parties, raising complex issues relating to joint liability, fault-based liability, and contractual risk allocation. Accordingly, reviewing and structuring contractual provisions relating to risk allocation, indemnification, and incident response mechanisms in AI development, supply, and deployment agreements is critically important.
4. What are the obligations for incident response, reporting, and cooperation?
Under the AI Law 2025, in the event of a serious incident, developers and providers must promptly implement technical measures to remediate, suspend, or withdraw the AI system, and notify competent authorities. Deployers and users are obligated to record and timely report incidents and cooperate throughout the handling and remediation process.
At the same time, the AI Law 2025 grants competent State authorities the power to receive, verify, and guide the handling of incidents, including the authority to request the provision of technical documentation, operation logs, training data, and other necessary information to determine the root cause and allocate responsibility.
However, the scope and extent of such information disclosure must be carefully considered in parallel with applicable regulations on personal data protection, trade secrets, technological secrets, and intellectual property rights. Further guidance is still required on the mechanisms for access, storage, and use of such information by regulatory authorities to ensure an appropriate balance between AI risk management requirements and the legitimate rights and interests of enterprises.
From a practical perspective, enterprises should prioritize the following measures:
- Establish internal mechanisms for detecting, assessing, and responding to AI incidents;
- Prepare technical documentation and ensure readiness to provide explanations and accountability;
- Clearly designate responsible personnel for regulatory reporting and coordination; and
- Control the provision of information to ensure compliance with regulations on data protection, state secrets, and intellectual property rights.
Legal Support from BLawyers Vietnam
BLawyers Vietnam can assist enterprises with:
- Reviewing and drafting contracts relating to AI development, supply, and deployment;
- Advising on liability for damages and dispute resolution strategies relating to AI incidents;
- Supporting enterprises in working with State authorities during AI inspections and examinations; and
- Providing comprehensive legal advice on AI, data protection, and cybersecurity compliance.
The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. BLawyers Vietnam would love to hear from you.
Date: 14 April 2026
Writer: Ha Le
