Accountability and Liability for Clinical AI in Viet Nam: What Healthcare Organizations Need to Know When AI Contributes to Harm
POLICY & REGULATORY INSIGHTS
Accountability and Liability for Clinical AI in Viet Nam: What Healthcare Organizations Need to Know When AI Contributes to Harm
POLICY & REGULATORY INSIGHT
Last reviewed: 2 October 2026
Clinical AI can contribute to patient harm in many different ways. A system may miss an abnormality, generate an incorrect recommendation, prioritize the wrong patient, summarize a record inaccurately or continue operating after its performance has changed. Sometimes an AI output directly influences a clinical decision. In other cases, the technology is only one part of a longer chain involving data, software integration, workflow design, a healthcare practitioner, a healthcare organization and one or more technology providers.
When something goes wrong, the natural question is: Who is responsible?
In Viet Nam, the answer now sits at the intersection of AI-specific rules, existing healthcare-law provisions on medical adverse events and professional technical error, general civil liability, contracts, insurance and other applicable legislation. The Law on Artificial Intelligence No. 134/2025/QH15, effective since 1 March 2026, assigns responsibilities to developers, providers, deployers and users and, importantly, creates a specific compensation rule for legally high-risk AI systems. Existing healthcare and civil-law frameworks continue to apply alongside it. [1,4–6]
Healthcare organizations therefore need to separate several questions that are often collapsed into one: Who had a legal or professional duty? Who controlled the AI system? Who made the clinical decision? What actually caused the harm? Who must compensate the person who suffered damage? And who ultimately bears the financial loss after compensation is paid?
Those questions are related, but they are not the same.
Accountability and liability are different questions
Accountability is broader than liability. It concerns who is expected to govern, explain, monitor, intervene, investigate and correct the use of AI. Liability concerns legal consequences arising from harm or violation, including compensation and, depending on the circumstances, administrative or criminal consequences.
Viet Nam’s AI Law deliberately distributes responsibilities across different actors. A developer designs, builds, trains, tests or fine-tunes all or part of an AI model, algorithm or system and controls relevant technical elements. A provider places an AI system on the market or puts it into use under its own name or brand. A deployer uses an AI system under its control in professional, commercial or service activities. A user directly interacts with the system or uses its output. [1]
In a typical hospital deployment, the healthcare organization may often be the deployer and healthcare practitioners may be users, but this should not be assumed automatically. The legal roles depend on how the system is supplied, controlled, configured and used. A company described commercially as “the vendor” may, depending on the arrangement, be acting as a developer, provider, integrator, cloud provider or another contractor.
A mature accountability model therefore begins by identifying the actual legal and operational roles rather than relying on commercial labels.
Viet Nam has a specific compensation rule for legally high-risk AI
Article 29 of the AI Law is central to the liability discussion.
Under Article 29(1), organizations or individuals that violate the AI Law or other relevant AI-related legislation may be subject to administrative sanctions or criminal liability depending on the nature, seriousness and consequences of the violation. Where the violation causes damage, compensation is governed by civil law. [1]
Article 29(2) creates a more specific rule. Where a high-risk AI system has been managed, operated and used in accordance with applicable requirements but nevertheless causes damage, the deployer is responsible for compensating the person who suffers that damage. After compensation, the deployer may seek reimbursement from the provider, developer or another relevant party where there is an agreement between the parties providing for that recourse. [1]
This is a significant allocation of responsibility. In the situation specifically covered by Article 29(2), saying that the organization complied with the rules or that no individual healthcare practitioner was negligent does not, by itself, remove the deployer’s statutory compensation responsibility.
For a healthcare organization acting as deployer, the provision therefore has direct governance, contractual and financial implications. Its scope, however, must be understood carefully.
Article 29 does not make every AI-related patient harm automatically the hospital’s liability
The special rule in Article 29(2) applies to legally high-risk AI systems and only where the other conditions in the provision are satisfied. It should not be expanded into a general rule that every healthcare organization must compensate whenever any clinical AI contributes to harm.
Decision No. 33/2026/QĐ-TTg, effective from 15 August 2026, establishes the current statutory high-risk list. Its healthcare entries are specific and currently focus on defined AI-supported surgical and surgical-robotic applications rather than clinical AI generally. [3]
A radiology support system, endoscopy AI, prediction model, clinical copilot or generative-AI application should therefore not be assumed to fall within Article 29(2) simply because the possible clinical consequence is serious.
For AI systems outside the statutory high-risk category, or where a high-risk system was not managed, operated or used in accordance with applicable requirements, the legal analysis may instead involve Article 29(1), general civil law, the Law on Medical Examination and Treatment, professional obligations, contracts, medical-device requirements or other applicable legislation.
The central point is:
Article 29 creates an important AI-specific compensation regime. It does not replace the rest of Vietnamese liability law.
The party that compensates first may not be the party that ultimately bears the loss
One of the most important practical consequences of Article 29(2) is the distinction between the immediate obligation to compensate and the ultimate allocation of financial responsibility among the parties.
Where Article 29(2) applies, the deployer compensates the injured person. The same provision expressly allows the deployer, after making compensation, to seek reimbursement from a provider, developer or another relevant party where there is an agreement between the parties. [1]
A healthcare organization’s contract with an AI supplier is therefore more than a procurement document. It may materially affect whether the organization has an agreed route to recover some or all of a loss after compensation has been paid.
Healthcare organizations should not wait for an incident to discover that their contract says little about liability allocation, evidence or incident cooperation. Issues that may deserve explicit contractual consideration include defects or incorrect system behavior, failures in validation or documentation, material changes, cybersecurity responsibilities, incident notification and cooperation, preservation of evidence, subcontractors, insurance, indemnification or reimbursement mechanisms, liability limits and the ability to restrict or suspend unsafe deployment.
The exact contractual language requires case-specific legal advice. Article 29(2)’s express reimbursement mechanism is tied to an agreement between the parties; whether another legal basis for recourse exists in a particular case would require separate analysis.
The governance principle is simpler: responsibility and recourse should be considered before deployment rather than after harm occurs.
The AI Law also addresses exemptions and unlawful third-party interference
Article 29(3) provides limited exemptions from the compensation responsibility under Article 29(2). These include cases where damage is caused entirely by the intentional fault of the person who suffered the damage, and cases involving force majeure or a state of emergency, unless another law provides otherwise. [1]
Article 29(4) separately addresses unlawful third-party interference. Where an AI system is unlawfully accessed, taken over or interfered with, the third party is responsible for the resulting damage. Where the provider or deployer was at fault in allowing the intrusion, takeover or unlawful interference to occur, joint liability may arise under civil law. [1]
This has a practical consequence for healthcare organizations:
Cybersecurity can become a liability issue, not merely an IT issue.
A healthcare organization cannot necessarily respond to a harmful cyber-compromise simply by saying that an attacker caused it. If deficiencies in the organization’s controls contributed to the compromise, its own legal responsibility may still need to be examined.
Existing healthcare-law responsibility remains relevant
Clinical AI operates within healthcare rather than outside it. The Law on Medical Examination and Treatment therefore remains important when harm occurs during medical examination or treatment.
Vietnamese healthcare law uses the concepts of medical adverse events (tai biến y khoa) and professional technical error (sai sót chuyên môn kỹ thuật) rather than relying on “medical malpractice” as the primary statutory framework.
Article 100 provides a framework for determining whether a healthcare practitioner committed a professional technical error. It also identifies circumstances in which an adverse medical event may occur without such an error, including where the practitioner properly fulfilled care and treatment responsibilities and complied with applicable professional technical requirements but the event nevertheless occurred, as well as other circumstances specified by law. [4]
Where a medical adverse event is disputed, Article 101 provides for a professional council to determine whether professional technical error occurred. Article 102 provides that where a medical adverse event occurs, the healthcare establishment is responsible for compensating the patient according to law, except in the circumstances specified in Article 100(2). These provisions remain reflected in the current 2026 consolidated text of the Law on Medical Examination and Treatment. [4]
AI therefore does not displace the existing healthcare-law framework.
At the same time, healthcare law and the AI Law address partly different legal questions. Imagine that a healthcare practitioner appropriately uses a legally high-risk AI system, complies with professional requirements and is determined not to have committed a professional technical error, but the AI system nevertheless contributes to patient harm. The absence of professional technical error is relevant under the healthcare-law framework. Separately, Article 29(2) of the AI Law addresses the situation in which a properly managed, operated and used high-risk AI system nevertheless causes damage. [1,4]
Where these regimes overlap, their interaction in a particular case may require legal interpretation based on the parties’ roles, the nature of the adverse event, causation and other applicable law. As of this review, the legislation should not be reduced to a single rule that answers every clinical-AI scenario.
For governance purposes, one conclusion is nevertheless clear:
“The doctor was not at fault” does not automatically mean “there is no liability.”
Human oversight does not transfer every responsibility to the clinician
Human oversight is essential to patient safety, but it should not be treated as a universal liability solution.
A contract, policy or user interface may state that “the clinician remains responsible for clinical decisions.” That can be appropriate as a professional principle, but it does not erase statutory or organizational responsibilities belonging to providers or deployers.
The AI Law imposes independent duties on those actors, particularly for high-risk systems, including responsibilities related to risk management, human intervention, monitoring, transparency, incident management and accountability. Article 14 also encourages providers and deployers of high-risk AI systems to participate in civil-liability insurance or use another appropriate form of financial security to support incident remediation and compensation. [1]
Similarly, healthcare law assesses professional technical error against patient-care responsibilities and professional technical requirements, rather than simply asking whether AI was involved.
A practitioner being “in the loop” is therefore a patient-safety control. It should not become an organizational shortcut for transferring every consequence of AI use to the individual practitioner.
Civil liability and causation still need to be analyzed
The Civil Code remains a foundational source of compensation law.
Article 584 provides the general basis for non-contractual compensation where an infringement of life, health, property or another lawful right or interest causes damage, subject to the applicable rules and exceptions. Article 585 establishes general principles governing compensation. Article 597 is also relevant to organizational responsibility where personnel of a juridical person cause damage while performing duties assigned by that juridical person. [5]
Resolution No. 02/2022/NQ-HĐTP of the Judicial Council of the Supreme People’s Court further guides the application of Civil Code provisions on non-contractual damage compensation, including the relationship between conduct, actual damage and causation. [6]
These rules matter because many clinical-AI events will not fit neatly inside one AI-specific provision. An incident may involve a healthcare practitioner, healthcare establishment, AI provider, software developer, integration vendor or several actors at once.
In patient-safety investigation, it is useful to ask whether AI contributed to an event. Legal causation is a more specific question.
Consider a missed diagnosis. The AI may have produced a false-negative result, but the practitioner may also have had independent clinical evidence pointing toward the diagnosis. Alternatively, the underlying AI may have worked correctly but an interface displayed the result incorrectly. The wrong patient’s data may have been sent to the model. The practitioner may have relied on the AI exactly as the approved workflow encouraged. Or several technical and organizational failures may have occurred together.
All of these scenarios involve AI, but their causal structures are different.
A liability analysis may therefore need to reconstruct the system version, input data, output, clinical information available at the time, how the result was displayed, how the practitioner interpreted it, which actions followed, whether meaningful human intervention was possible, whether the workflow matched the approved use and whether a technical, clinical or organizational control failed.
That is why “the AI made the error” is rarely a sufficient legal explanation.
The more useful question is:
Which failure or combination of failures caused the harmful outcome, and which party had responsibility for controlling those failures?
Evidence, contracts and insurance should be ready before an incident
AI-related events can be difficult to investigate if relevant evidence disappears. A cloud model may be updated, thresholds or prompts may change, an integration may be reconfigured, logs may be overwritten or a practitioner may later remember only the final recommendation rather than exactly what was displayed at the time.
Healthcare organizations should therefore establish a process for preserving relevant evidence when a serious AI-related event is suspected. Depending on the system and event, that may include the AI system and version, configuration, timestamps, relevant inputs and outputs, clinical record, user actions, approvals or overrides, monitoring information, integration logs, vendor notifications, recent changes and relevant cybersecurity evidence.
This should not mean indiscriminately retaining every patient record, log or proprietary artifact. Evidence preservation remains subject to personal-data protection, confidentiality, cybersecurity, intellectual-property and other applicable requirements.
Article 28 of the AI Law itself reflects the importance of traceability. During inspection or examination, relevant organizations and individuals may be required to provide technical files, trace logs, training data and other information necessary to identify the cause of a violation or incident or to allocate responsibility, subject to legal protections for state secrets, data, personal data and intellectual property. [1]
Vendor arrangements matter for the same reason. A healthcare organization may not control model-version information, release histories, vendor-side logs or other evidence needed to investigate a failure. Contracts should therefore support appropriate incident notification, preservation of relevant information, identification of system versions, access to information needed for investigation, regulatory cooperation and corrective action.
Article 29(2) makes contractual arrangements particularly important because its express mechanism for recourse by a deployer against providers, developers or other relevant parties is tied to an agreement between those parties. [1]
Insurance should also be examined before deployment. The AI Law encourages providers and deployers of high-risk AI systems to participate in civil-liability insurance or use another appropriate form of financial security. Healthcare law separately provides for professional-liability insurance in medical examination and treatment, including compensation for damage arising from medical adverse events within the insurance period and related legal costs, subject to applicable law and the insurance contract. [1,4]
Healthcare organizations should therefore not assume that an existing professional-liability, cyber or general-liability policy automatically covers every AI-related event. Coverage will depend on policy wording, exclusions, applicable insurance law and the factual circumstances of the claim.
Accountability should follow the whole AI lifecycle
Liability is often discussed only after a patient has been harmed. By then, many decisions that shaped responsibility have already been made.
The organization selected the product, decided what evidence was sufficient, determined which patients would be exposed, approved the workflow, defined the practitioner’s role, established, or failed to establish, monitoring, and accepted contractual terms governing the technology-provider relationship.
Accountability should therefore be considered across the entire lifecycle:
selection → procurement → validation → deployment → human oversight → monitoring → change control → incident response → compensation and remediation
Those earlier governance decisions may become highly relevant when an incident is later investigated.
A healthcare organization that treats liability solely as a legal-department problem after an event has already lost much of its opportunity to manage the underlying risk.
A practical Clinical AI Accountability & Liability Readiness Gate
Before deploying a clinically significant AI system, a healthcare organization can ask:
Legal roles: Who is the developer, provider, deployer and user under the AI Law, and do contractual arrangements reflect the actual roles?
Statutory classification: What is the system’s current legal AI risk classification, and could the Article 29 high-risk compensation regime potentially apply?
Clinical responsibility: Which decisions remain with licensed healthcare practitioners, and how is meaningful professional judgment preserved?
Organizational responsibility: Who approved the system, intended use, patient population, workflow and level of human oversight?
Causation evidence: Could the organization reconstruct how the AI system may have contributed to a harmful outcome?
Traceability: Can the relevant system version, configuration, inputs, outputs, user actions and material changes be identified after an incident?
Vendor cooperation: Does the organization have contractual access to the information and assistance needed for investigation and regulatory response?
Recourse: If the organization compensates an injured person, what contractual or other legally available rights exist to seek recovery from a provider, developer or another relevant party?
Cybersecurity responsibility: How would responsibility be examined if harm followed unauthorized access, takeover or interference with the system?
Insurance: Have professional-liability, civil-liability, cybersecurity and other relevant insurance arrangements been reviewed for the actual use case?
Incident response: Who leads the investigation, preserves evidence, communicates appropriately with the patient, engages relevant external parties and decides whether use should continue?
Corrective action: Can the system be restricted, suspended, reassessed or removed rapidly if an investigation identifies unacceptable risk?
This Clinical AI Accountability & Liability Readiness Gate is a practical organizational framework. It is not a legal test for determining liability, fault, causation or compensation in an individual case.
Do not wait for harm to decide who is responsible
The most difficult time to clarify accountability is after a serious incident.
If the healthcare organization, practitioners, AI provider and other technology partners are only then asking who owns the risk, who has the evidence, who must notify whom and who pays first, the governance problem existed before the patient was harmed.
A stronger approach defines roles before deployment, documents decision authority, preserves meaningful human oversight, establishes traceability and monitoring, sets contractual responsibilities and creates a clear incident-response pathway.
That does not guarantee that AI will never contribute to harm. It does make it more likely that the organization can respond fairly, promptly and transparently when harm occurs.
What this means for healthcare organizations in Viet Nam
Viet Nam has already enacted an AI-specific compensation rule at a time when liability standards for AI in health remain uncommon in many health systems. WHO/Europe reported in July 2026 that only 8% of countries in the WHO European Region had liability standards defining responsibility when an AI system fails. That figure describes the WHO European Region and should not be interpreted as a global prevalence estimate.
That does not make liability in Viet Nam simple.
Article 29 provides an important AI-specific framework, but clinical AI sits at the intersection of AI law, healthcare law, civil law, professional responsibility, contracts, cybersecurity, insurance and, depending on the system, other specialized regulation. Determining responsibility also remains a factual exercise: what did the system do, how was it used, what failed and what actually caused the harm?
Recent international legal analysis reaches a similar conclusion. A September 2026 Nature Health analysis examined 31 U.S. legal cases and reported harms involving healthcare AI and argued for moving beyond physician-centred approaches toward accountability models that reflect the wider network of healthcare organizations, technology systems and other stakeholders shaping patient care. [8]
For healthcare leaders, the useful question is therefore not simply “Who will be blamed if the AI is wrong?”
It is:
“Have we defined responsibility clearly enough that, if AI contributes to harm, we can protect the patient, determine what happened, meet our legal obligations and allocate responsibility among the parties on a defensible basis?”
Responsible AI governance is not primarily about finding someone to blame after an incident. It is about making responsibility visible before the incident occurs.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, insurance, contractual, medical-device, cybersecurity or compensation advice.
Terms such as accountability, liability readiness and the Clinical AI Accountability & Liability Readiness Gate are used here as practical governance concepts. The legal responsibility of a healthcare organization, practitioner, provider, developer or another party in a specific event depends on applicable law, the AI system’s legal classification, the facts of the case, causation, contractual arrangements and other relevant evidence.
Article 29(2) of the Law on Artificial Intelligence should not be interpreted as a general compensation rule for every healthcare AI system. It addresses legally high-risk AI systems that have been managed, operated and used in accordance with applicable requirements but nevertheless cause damage, subject to the other provisions of Article 29.
The relationship between Article 29 of the AI Law and the provisions on professional technical error and medical adverse events in the Law on Medical Examination and Treatment may require case-specific legal interpretation where both frameworks are relevant. This article does not suggest that one automatically overrides the other.
Human oversight also does not, by itself, determine liability. The involvement of a healthcare practitioner should not be treated as automatically transferring all legal responsibility away from providers, deployers or healthcare organizations.
Healthcare organizations should obtain qualified legal and insurance advice for specific systems, contracts, incidents and claims.
References
[1] National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
[2] Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
[3] Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
[4] National Assembly of Viet Nam. Law No. 15/2023/QH15 on Medical Examination and Treatment, as currently consolidated in Consolidated Document No. 26/VBHN-VPQH, Office of the National Assembly, 26 February 2026.
[5] National Assembly of Viet Nam. Civil Code No. 91/2015/QH13. Adopted 24 November 2015; effective 1 January 2017.
[6] Judicial Council of the Supreme People’s Court. Resolution No. 02/2022/NQ-HĐTP Guiding the Application of Certain Provisions of the Civil Code on Non-Contractual Damage Compensation. 6 September 2022.
[7] WHO Regional Office for Europe. WHO brings 37 countries together in Lisbon to get AI governance right and make it work for every patient. 15 July 2026.
[8] Mansi G, Riedl M. Implications of current litigation on the design of AI tools for healthcare delivery and related legal frameworks. Nature Health. Published 21 September 2026.