Clinical AI Governance Readiness in Viet Nam: A Practical Framework for Assessing Organizational Readiness to Govern AI at Scale
PRACTICAL FRAMEWORKS & TOOLS
Clinical AI Governance Readiness in Viet Nam: A Practical Framework for Assessing Organizational Readiness to Govern AI at Scale
PRACTICAL FRAMEWORKS & TOOLS
Last reviewed: 5 October 2026
Healthcare organizations often begin their AI journey by asking whether a particular system works. Is the evidence credible? Is the model accurate enough? Can it integrate with the current workflow? Those are necessary questions, but they become insufficient once AI begins spreading across departments, clinical pathways, vendors and sites. At that point, the more important question is no longer simply “Is this AI system ready for us?” It becomes “Are we ready to govern this AI system — and the next ten systems that may follow?”
That distinction matters because AI risk does not scale only with the number of algorithms. It also scales with organizational complexity. One AI system may require clinical validation, user training and monitoring. Ten systems may involve different vendors, patient populations, data flows, cloud services, software updates, human-oversight arrangements, safety signals and contractual responsibilities. AI may also enter an organization indirectly through medical equipment, enterprise software, documentation platforms, vendor upgrades or staff use of general-purpose tools. Without an institutional governance capability, controls that seem adequate for individual systems can become fragmented as adoption expands.
In September 2026, WHO/Europe published the findings of its Knowledge Community on responsible AI in health, which framed governance readiness, rather than speed of deployment, as an important measure of responsible progress. Participants identified governance, data, validation, workforce capacity and participation by patients, communities and frontline professionals as priority areas, while highlighting governance gaps, unclear accountability, fragmented or biased data and inadequate AI literacy as persistent barriers [7]. The report reflects the perspectives of Knowledge Community participants and should not be interpreted as a formal normative position of WHO, but its findings are highly relevant to healthcare organizations moving from individual AI projects toward broader institutional capability.
For healthcare organizations in Viet Nam, governance readiness can therefore be understood as the organizational ability to identify AI, assign responsibility, assess risk and evidence, implement systems safely, monitor what happens in real-world care, respond when conditions change and learn across the organization. The practical question is not simply whether an organization has an AI committee. It is whether it can consistently make safe, evidence-informed and accountable decisions about AI throughout its lifecycle.
Governance readiness is not the same as legal compliance
Clinical AI governance readiness and regulatory compliance overlap, but they are not the same thing. Viet Nam's Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026, while Decree No. 142/2026/NĐ-CP has been effective since 1 May 2026 [1,2]. Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, established the current List of High-Risk Artificial Intelligence Systems [3].
As of this review, the health section of Decision No. 33 contains two listed categories of AI systems supporting surgery or robotic surgery, each subject to specified conditions. This does not mean that every other clinical AI system is clinically low-risk simply because it is not currently included in the legal high-risk list. A diagnostic support tool, generative clinical assistant, ambient documentation system or deterioration alert may still create meaningful patient-safety, privacy, workflow or quality risks depending on how it is used. Regulatory classification and organizational clinical-risk assessment therefore serve related but different purposes.
Decision No. 33 also establishes an important principle: using an AI system does not change, transfer or eliminate the authority and responsibilities of competent organizations or individuals under applicable law, and human supervision, control and the ability to intervene must be maintained. For AI systems on the List that were already in operation before the Decision took effect, providers and deployers in the health, education and finance sectors must complete the applicable obligations under AI law before 1 September 2027. Listed systems put into operation during the six-month period from the Decision's effective date must complete the applicable obligations before 1 March 2027 [3].
For high-risk AI systems, Article 15 of Decree No. 142 is particularly relevant. Providers must establish and maintain a risk-management system appropriate to the intended use, deployment scope and level of risk. Deployers, meanwhile, must organize risk management during implementation and operation in a manner appropriate to the system's intended use, deployment scope, risk level and the provider's technical guidance. Their responsibilities include operating the system within its intended conditions and limits, monitoring for deviations, risks or incidents, maintaining mechanisms for human supervision and intervention, applying controls within their authority when problems arise and cooperating with the provider when significant changes or incidents occur [2].
Compliance therefore matters, but an organization can meet individual legal requirements and still be poorly prepared to govern AI as a health-system capability. Conversely, many of the practices discussed in this article may be valuable on a proportionate basis even where a particular AI system does not fall within the statutory high-risk category.
Governance readiness is also not a maturity score
A healthcare organization does not need to describe itself as “AI mature” before it can govern AI responsibly. Nor should a single numerical score create false confidence by hiding significant weaknesses inside an overall average.
The Joint Commission's 2026 Responsible Use of AI in Healthcare certification provides a useful international reference point. It is a voluntary U.S. organizational certification rather than a Vietnamese requirement, and it evaluates whether healthcare organizations have appropriate governance, safeguards, monitoring processes and education in place rather than certifying individual AI products. Its standards are organized around governance, effective data management, risk and bias reduction, monitoring, evaluation and validation, and transparency, education and training [9].
Similarly, the Coalition for Health AI's 2026 Governance Playbooks address eight areas: AI policy, organizational structures, organizational resources, responsible AI lifecycle management and use, risk and impact assessments, responsible data management and use, third-party management, and education, training and feedback. CHAI describes these as baseline controls designed to be integrated into existing organizational processes while remaining adaptable to the circumstances of individual healthcare organizations [10].
The framework proposed in this article therefore uses readiness rather than a formal maturity model. Its purpose is not to award a prestigious score. It is to help leaders determine whether the capabilities required for safe AI expansion actually exist and, importantly, whether there is evidence that they function in practice.
Domain 1: Leadership, mandate and accountability
Governance readiness begins with ownership. An organization should be able to explain who has authority to approve an AI system, who is accountable for managing its clinical safety risks, who is responsible for technical operations, who reviews privacy and cybersecurity implications, who monitors real-world performance, who can restrict or suspend use, and who ensures that governance decisions are actually carried through.
An AI committee can help coordinate this work, but a committee alone is not governance. An organization may have meetings, terms of reference and presentation slides while responsibility remains unclear when a safety concern appears. Readiness requires defined decision rights and escalation pathways connecting leadership, clinical governance, quality and patient safety, IT, data, privacy, cybersecurity, procurement, legal or compliance functions and operational teams according to the use case and level of risk.
The strongest evidence of readiness is therefore not the existence of a committee. It is the organization's ability to demonstrate who decides what, on what evidence, within what authority, and what happens when people disagree or a risk exceeds the organization's tolerance.
Domain 2: Visibility, knowing where AI is actually being used
An organization cannot govern AI that it does not know exists. A reliable AI inventory is therefore one of the foundations of readiness, and it should extend beyond products formally purchased and labeled as “AI.”
AI capabilities may be embedded in imaging equipment, clinical software, administrative platforms, patient communication systems, analytics tools, cloud services or vendor updates. Staff may also use externally available generative AI tools without formal organizational approval. Governance visibility therefore needs to include both approved systems and the pathways through which unapproved or previously unknown AI may enter organizational work.
The inventory does not need to contain every technical detail on day one, but the organization should be able to identify the system or capability, intended use, clinical or operational owner, provider or developer, affected patient population, users, sites, relevant data, major integrations, deployment status and risk-review history. Higher-risk systems should carry correspondingly more detailed governance documentation.
An organization that cannot confidently answer “Which AI systems are currently affecting patient care or healthcare operations?” is not ready to govern AI at scale. In that situation, the first readiness intervention is not another policy. It is visibility.
Domain 3: Risk classification and regulatory mapping
The next capability is determining what kind of governance each system requires. Legal classification under Viet Nam's AI framework should be addressed where applicable, including whether a system falls within the current high-risk list and what responsibilities attach to the organization's role as provider, deployer or another relevant actor under the law. Depending on the technology and use case, other legal frameworks may also apply, including personal-data protection, cybersecurity, medical-device regulation, professional obligations and other health-sector requirements.
Responsible healthcare governance should nevertheless go beyond statutory classification. Organizations should consider the severity of potential patient harm, degree of autonomy, proximity of AI output to a clinical decision, reversibility of error, vulnerability of the affected population, scale of use, detectability of failure, strength of human review, data sensitivity and dependence on external vendors or infrastructure.
This matters because “not legally high-risk” and “low clinical risk” are not interchangeable concepts. Governance should be proportionate to the real-world consequences of failure as well as to the legal classification of the system.
Domain 4: Evidence, validation and fit for the intended use
A governance-ready organization knows what evidence it needs before allowing AI to influence care. Vendor performance claims are only one part of that evidence. Leaders should understand what the system was designed to do, the populations on which it was evaluated, the comparator used, whether relevant subgroups were assessed, which outcomes were measured, how uncertainty was handled and whether the available evidence is relevant to the organization's intended use.
This becomes especially important when a system moves into the Vietnamese clinical environment. Differences in disease prevalence, patient characteristics, imaging equipment, language, documentation practices, coding, workflows and referral patterns may affect real-world performance. Local validation does not necessarily require a major research study for every AI system, but the rigor and depth of validation should be proportionate to the potential consequence of failure and the uncertainty surrounding local use.
WHO/Europe's June 2026 implementation report similarly focuses on the gap between AI principles and implementation in real healthcare settings, emphasizing practical conditions for responsible implementation rather than technology alone [8]. Readiness therefore means being able to distinguish evidence that an AI system works somewhere from evidence sufficient to justify its intended use here.
Domain 5: Data governance, privacy and cybersecurity
Clinical AI depends on data, and governance readiness requires understanding where those data come from, where they go and what happens to them. Viet Nam's Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/NĐ-CP have both been effective since 1 January 2026 [4,5]. Under the current framework, health-status information is included in the list of sensitive personal data.
Decree No. 356 also addresses personal data in AI systems more specifically. Data produced through AI inference must receive personal-data protection where they can be used to identify or help identify a particular person [5]. This is particularly relevant because an AI system may generate information about an individual that was not directly collected as an original data field but may still become personal data through inference.
Healthcare organizations should therefore understand the applicable legal conditions and requirements for processing personal data, access arrangements, data flows, retention, third-party involvement, security measures and, where relevant, cross-border data-processing requirements before scaling AI use. This becomes especially important with cloud-based AI, externally hosted foundation models, ambient technologies involving audio, vendor analytics environments and systems that continuously exchange information through APIs.
A governance-ready organization should not discover its data architecture only after an incident occurs. Privacy and cybersecurity also need to connect with patient safety. If an AI service becomes unavailable because of a cyber incident, corrupted data alter system behavior, or unauthorized access affects information required for care, the consequences may extend beyond information security and become a care-delivery problem.
Domain 6: Clinical safety, human oversight and safe fallback
Human oversight should be designed, not assumed. Writing “the clinician makes the final decision” in a policy is not enough. Meaningful oversight depends on whether the clinician actually sees the AI output, understands what it means and what its limitations are, has enough time and information to challenge it, knows when it should not be trusted and has the authority to override or escalate. Poor interface design, excessive alerts, time pressure or automation bias can weaken oversight even when a human formally remains “in the loop.”
Governance readiness therefore requires organizations to map AI into the actual clinical workflow. What happens before the AI output appears? Who receives it? What action is expected, and within what timeframe? What happens when clinicians disagree with the system? What happens when AI produces no answer, an uncertain answer or an implausible output? What happens when the AI service is unavailable?
For clinically consequential systems, safe fallback should be defined before go-live. A healthcare organization should not be designing its fallback process for the first time during an outage or patient-safety event.
Domain 7: Procurement, vendors and third-party dependencies
AI governance can fail even when an organization manages its internal processes well because many important risks sit outside its direct control. A healthcare organization may depend on a vendor for model updates, cloud hosting, APIs, cybersecurity patches, monitoring data, technical investigation or access to system documentation. The product itself may depend on an external foundation model, subcontractor, cloud provider or other data-processing service, and changes elsewhere in that chain can alter what clinicians experience locally.
Readiness therefore requires procurement to move beyond price, functionality and implementation timelines. Due diligence and contracts should address, where relevant, intended use, performance evidence, data handling, cybersecurity, incident cooperation, access to monitoring information, versioning, material changes, service availability, subcontractors or subprocessors, termination, data return or deletion and responsibilities when the system behaves unexpectedly.
CHAI's inclusion of Third Party Management as one of its eight governance domains reflects this broader reality: responsible AI governance does not stop at the healthcare organization's boundary [10].
Domain 8: Workforce competency and implementation capability
Organizations do not become ready simply because a small group of AI specialists understands the technology. The people who use, supervise, procure, manage and respond to AI need competencies appropriate to their roles.
A clinician may need to understand intended use, limitations, uncertainty and override processes. Quality staff may need to recognize AI-related patient-safety signals. Procurement teams need to know what evidence and contractual protections to request. IT and data teams need to understand operational dependencies. Leaders need enough AI literacy to ask meaningful questions rather than relying entirely on vendor assurances.
The WHO/Europe Knowledge Community identified workforce capacity among the priority areas discussed for responsible AI and highlighted gaps in AI literacy as an important barrier [7]. Training should therefore be connected to actual work. Completion of a generic AI course is weak evidence of readiness if users cannot explain how a particular system should be used, when it may fail, what must be reviewed, how concerns should be escalated or what to do when the system is unavailable.
The same principle applies to organizational resources. Governance takes time. Someone must review evidence, maintain inventories, investigate signals, reassess changes and follow corrective actions. A governance structure that exists only because a few enthusiastic individuals perform this work informally may not remain reliable when AI use expands.
Domain 9: Monitoring, incidents, assurance and change control
Pre-deployment approval is only the beginning. A governance-ready organization should know what it intends to monitor before an AI system goes live. Relevant signals may include technical performance, clinical outcomes, overrides, subgroup differences, data quality, workflow delays, complaints, near misses, incidents, downtime, user feedback and unintended consequences. The appropriate combination will vary by system.
For high-risk AI systems, Article 15 of Decree No. 142 reinforces lifecycle risk management by requiring deployers to monitor operation for deviations, risks or incidents and to maintain appropriate risk controls within their authority [2]. Organizations should not, however, restrict monitoring only to systems that meet the statutory high-risk classification. A system outside that category may still warrant close monitoring if its local clinical use creates meaningful patient-safety or quality risk.
Readiness also requires an incident pathway. Staff should know where to report an AI-related concern, how it reaches the appropriate clinical governance or patient-safety function, when the vendor should be involved and under what circumstances use should be restricted or suspended. Article 19 of Decree No. 142 separately establishes reporting and handling requirements for events that meet the statutory definition of a serious AI incident [2]. That threshold should not be confused with internal quality and patient-safety learning. Healthcare organizations should be able to investigate weaker signals, errors and near misses well before an event reaches the threshold for formal serious-incident reporting.
Finally, AI systems change. Vendor updates, new model versions, different data sources, altered interfaces, new sites and modified workflows may all affect previous assumptions. Change control should therefore return repeatedly to a simple question: does the evidence that justified yesterday's approval still support today's system?
Domain 10: Patient transparency, equity and meaningful participation
Governance readiness is incomplete if the people affected by AI are absent from consideration. Not every AI use requires the same form of patient communication or participation, but organizations should assess whether AI materially affects a patient's care, information, choices, privacy or experience and determine which transparency, consent or other communication requirements apply in the particular context.
Equity also requires more than a statement of principle. If performance or benefit differs across relevant patient groups, the organization needs a way to detect, interpret and manage those differences. A system may perform acceptably overall while providing lower benefit or creating higher risk for a smaller group.
The WHO/Europe Knowledge Community identified codesign with patients and clinicians among the enablers discussed by participants and included participation by patients, communities and frontline professionals among its priority areas [7]. This should not be interpreted as a universal Vietnamese legal requirement to place patient representatives on AI governance committees. Rather, it supports the broader governance principle that organizations should have proportionate ways to understand how AI affects those who receive care and those who deliver it.
Domain 11: Integration with healthcare quality and patient-safety systems
One of the strongest indicators of governance readiness is whether AI governance remains a separate technology initiative or becomes connected to routine healthcare governance. Viet Nam already has quality-management structures within hospitals that can support this integration. Circular No. 19/2013/TT-BYT remains recorded as in force and provides a framework for hospital quality management, including quality indicators, organizational responsibilities and continuous quality-improvement activities [6].
Clinical AI should increasingly connect with these existing systems. An AI-related safety concern should not disappear into an IT helpdesk simply because technology is involved. Recurrent overrides may warrant quality review. Complaints may expose problems that model metrics miss. A new AI workflow may create delays visible in operational or quality indicators. Corrective actions should be followed by effectiveness checks.
The goal is not to create a second quality-management system called “AI governance.” It is to ensure that AI becomes governable within the healthcare organization's existing structures for quality, safety, accountability and improvement.
Domain 12: Organizational learning and the capacity to scale
Readiness to govern one AI system is different from readiness to govern AI at scale. Scaling introduces variation. The same system may behave differently across departments because workflows differ, and a multi-site healthcare group may have different equipment, patient populations, staffing patterns, clinical practices or information systems. A governance process that works when one motivated team manages a pilot may fail when many departments are simultaneously using different AI products.
The organization therefore needs institutional memory and repeatable processes. Lessons from validation, incidents, monitoring and corrective actions should be retained. Important decisions should have a documented rationale. Changes should be traceable. A problem identified at one site should become visible to other relevant sites without assuming that every local finding automatically applies everywhere.
At this stage, governance begins to function as a learning system rather than merely an approval process. The September 2026 WHO/Europe Knowledge Community report is particularly relevant here because it frames responsible progress around governance capability rather than speed of deployment [7]. Scale should follow institutional capability, not simply technological availability.
What evidence should a readiness assessment actually look for?
A readiness assessment should not be completed by asking leaders whether they believe the organization is ready. It should look for evidence. Leadership readiness may be demonstrated through defined decision authority and documented escalation pathways. Visibility can be demonstrated through a functioning AI inventory. Regulatory readiness can be shown through classification records and legal mapping where applicable. Evidence readiness can be demonstrated through evaluation and validation files, while data readiness may be visible in documented data flows, access arrangements and applicable privacy assessments.
Clinical-safety readiness can be demonstrated through workflow analysis, human-oversight design and fallback procedures. Workforce readiness should be visible in role-specific competency arrangements rather than generic training attendance. Monitoring readiness should appear in actual indicators, thresholds, review records and corrective actions. Vendor readiness should be reflected in due-diligence records and contracts. Organizational learning should be visible in the way incidents, changes and performance findings alter policy, training or practice.
A useful principle is that if a control exists only in a policy but cannot be demonstrated in practice, it should not yet be treated as fully established. That distinction becomes increasingly important as deployment expands.
A practical three-state readiness approach
Healthcare organizations do not necessarily need a complex numerical score. For each domain, a simpler evidence-based judgment can often be more useful. A capability may be considered established when clear ownership, documented processes and evidence of functioning practice exist; partially established when policies or responsibilities exist but implementation is incomplete, inconsistent or untested; or not established when no reliable process or evidence exists.
These states should not be added mechanically into a single score. A serious weakness in clinical safety, data protection or incident response cannot necessarily be offset by strong performance elsewhere. Readiness decisions should remain risk-based.
The practical organizational conclusion may therefore be ready for the proposed scale, ready with defined conditions or remediation, or not yet ready to scale. These are governance judgments for organizational decision-making, not certifications.
Readiness should be proportionate to the organization
A smaller specialty clinic should not be expected to reproduce the governance infrastructure of a large tertiary hospital group. Proportionality matters. A healthcare organization using one relatively contained AI system may appropriately rely on a small multidisciplinary governance structure and straightforward documentation, whereas a large multi-site system using dozens of AI tools may need more formal processes, deeper expertise, stronger data infrastructure, structured assurance and clearer central-local governance arrangements.
CHAI's 2026 playbooks apply a similar principle: baseline controls are intended to be interpreted within the context of each organization and adapted to differences in mission, workflows, resources, maturity and risk environment [10].
Proportionality, however, should not become an excuse for removing essential safeguards. Smaller organizations may simplify the mechanism, but they still need to know what AI they use, who is responsible, what evidence supports it, how patient information is protected, whether users are appropriately trained and competent, what happens when the system fails and who will act if a safety concern emerges.
Do not wait until AI has already scaled to assess readiness
One of the hardest times to build governance is after uncontrolled adoption has already occurred. By then, different departments may have negotiated separate vendor relationships, staff may rely on tools that were never formally reviewed, data may be flowing to third parties through arrangements that are poorly understood, monitoring may differ between sites and nobody may know with confidence which version of a system is currently running. Leadership is then forced to construct governance retrospectively around a fragmented environment.
A readiness assessment is therefore most useful before expansion, when it can reveal where organizational capability is weaker than organizational ambition. This does not mean innovation must stop until every domain is perfect. Responsible governance should allow experimentation within appropriate boundaries, with the level of control increasing as clinical consequence, autonomy, patient exposure, uncertainty and deployment scale increase.
The objective is neither governance before innovation nor innovation before governance. It is innovation that can be governed.
A Clinical AI Governance Readiness Framework for Viet Nam
Taken together, the domains in this article form a practical Clinical AI Governance Readiness Framework for healthcare organizations considering broader AI deployment in Viet Nam. The framework asks whether the organization has sufficient capability across leadership and accountability; AI visibility; risk and regulatory assessment; evidence and validation; data governance, privacy and cybersecurity; clinical safety and human oversight; procurement and third-party management; workforce and implementation capability; monitoring, incident management and change control; patient transparency and equity; integration with quality and patient-safety systems; and organizational learning and scale.
The framework is intentionally broader than statutory compliance. It draws on current Vietnamese regulatory requirements, existing healthcare quality structures and emerging international approaches to responsible AI governance, while translating them into an organizational-readiness perspective.
It is not a Vietnamese legal standard, accreditation requirement, certification program or validated maturity model. It should not be presented as equivalent to WHO guidance, Joint Commission certification or CHAI's Governance Playbooks. Those sources inform aspects of the underlying principles, but the framework proposed here is a practical synthesis for healthcare governance, implementation and self-assessment.
What this means for healthcare leaders in Viet Nam
The most important readiness question is not whether an organization has adopted AI. It is whether the organization can still understand, govern and improve what happens after adoption accelerates.
Can leadership see material AI use across the organization? Is responsibility clear? Can the organization distinguish vendor evidence from evidence relevant to its own population and workflow? Can it recognize when performance changes? Can clinicians challenge or override AI safely? Can staff report an AI-related concern without wondering whether it belongs to IT, quality management or patient safety? Can the organization respond appropriately to a vendor update? Can it continue care safely when an AI service fails? Does it understand what personal data are moving outside its direct environment? Can a lesson from one site reach another before the same problem is repeated?
If the answer to several of these questions is uncertain, that does not mean the organization should abandon AI. It means that the next investment may need to be in governance capability rather than another AI product.
This becomes increasingly important as healthcare organizations move from isolated pilots toward portfolios of AI systems. The risks of scale are not solved simply by choosing better algorithms. They are managed by building organizations capable of making consistent decisions, integrating AI into quality and patient-safety systems, detecting problems early and learning from real-world use.
The future of responsible healthcare AI in Viet Nam will therefore depend not only on which technologies become available, but on whether healthcare organizations build the capability to select, govern, implement, monitor, evaluate and improve them safely over time. That is what clinical AI governance readiness should ultimately mean.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, cybersecurity, data-protection, medical-device, accreditation or quality-management advice.
The Clinical AI Governance Readiness Framework described in this article is a practical organizational framework proposed for healthcare AI governance and implementation. It is not a statutory framework under Vietnamese law, an official Vietnamese government readiness assessment, a validated maturity instrument or a certification standard.
The applicability of Law No. 134/2025/QH15, Decree No. 142/2026/NĐ-CP, Decision No. 33/2026/QĐ-TTg, personal-data protection requirements, medical-device requirements and other sector-specific obligations depends on the characteristics, role, intended use and deployment context of the particular AI system. Healthcare organizations should assess applicable requirements individually and obtain appropriate professional advice where necessary. WHO, Joint Commission and CHAI materials discussed in this article are used as international reference points and do not replace applicable Vietnamese law.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.
Ministry of Health of Viet Nam. Circular No. 19/2013/TT-BYT Providing Guidance on Management of Quality of Medical Examination and Treatment Services in Hospitals. Issued 12 July 2013; effective 15 September 2013; currently recorded as in force.
World Health Organization Regional Office for Europe. Report of the Knowledge Community on Responsible Artificial Intelligence in Health. Published 1 September 2026.
World Health Organization Regional Office for Europe. Bridging Theory and Practice – Implementation Insights on Artificial Intelligence in Health Care: Report of Working Group 1 of the Strategic Partners’ Initiative for Data and Digital Health. Published 26 June 2026.
Joint Commission. Responsible Use of AI in Healthcare Certification. Launched 1 June 2026.
Coalition for Health AI. Governance Playbooks. Released 27 May 2026.