Documenting Healthcare AI Governance Decisions in Viet Nam: Approval Conditions, Exceptions, Residual-Risk Acceptance, Change Decisions and Governance Decision Records
PRACTICAL FRAMEWORKS & TOOLS
Documenting Healthcare AI Governance Decisions in Viet Nam: Approval Conditions, Exceptions, Residual-Risk Acceptance, Change Decisions and Governance Decision Records
PRACTICAL FRAMEWORKS & TOOLS
Last reviewed: 7 October 2026
Healthcare organizations can spend considerable effort reviewing an AI system and still leave behind surprisingly little evidence of the decision that was actually made.
A multidisciplinary group may discuss clinical evidence, cybersecurity, privacy, workflow, human oversight and vendor risk. A pilot may be authorized with several conditions. An unresolved limitation may be tolerated because additional safeguards are in place. Months later, the vendor changes the model, the original reviewers have moved on, and nobody can readily answer a basic question: What exactly did we approve, why did we approve it, under what conditions, and what would have caused us to reconsider that decision?
That is not merely a documentation problem. It is a governance problem.
Responsible healthcare AI requires organizations to make sound decisions, but it also requires them to preserve enough evidence to reconstruct those decisions later. This matters for implementation, monitoring, assurance, leadership oversight, incident investigation, change control, regulatory response and organizational learning.
The practical goal is not to document every conversation. It is to create a reliable record of who decided what, about which AI use, based on what evidence, under what authority, with what conditions, what uncertainty remained, and when the decision should be reconsidered.
This article refers to that record as a Healthcare AI Governance Decision Record. The term is used here as a practical organizational concept. It is not a statutory Vietnamese form, a Joint Commission template or a CHAI-defined document.
Unless otherwise stated, “approval” in this article means internal organizational authorization. It does not mean regulatory approval, conformity certification, medical-device authorization or another approval by a competent authority.
Governance decisions need their own record
Healthcare AI generates many forms of documentation, and they should not be confused.
An AI inventory tells the organization which systems and material use cases exist. Technical documentation describes the system, model, architecture, configuration, versions or operating characteristics. Operational logs record system activity or relevant technical events. A clinical record documents what occurred in the care of an individual patient where applicable. A risk assessment identifies hazards, uncertainty and controls, while committee minutes may show that a discussion and formal action occurred.
A governance decision record answers a different question:
What did the organization decide to do?
The decision might be to proceed with local validation, authorize a controlled pilot, permit limited or routine deployment, require additional safeguards, expand use to another site, authorize a temporary internal governance exception, accept a defined residual risk, require revalidation after a change, restrict use, suspend deployment or retire the system.
A healthcare organization can therefore possess extensive technical and regulatory documentation and still lack a clear record of its own governance decision.
The Vietnamese legal environment makes disciplined documentation increasingly important
Viet Nam's Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026. The Law establishes AI risk classification and differentiated responsibilities for providers and deployers. The regulatory framework applies different requirements and oversight according to risk classification, with the most extensive obligations applying to high-risk AI [1].
Decree No. 142/2026/NĐ-CP, effective since 1 May 2026, further operationalizes these requirements. It requires risk-classification dossiers for high- and medium-risk AI and requires providers and deployers to retain the relevant classification dossiers throughout the period in which the system operates [2].
For high-risk AI, change documentation can become particularly important. Under Article 13 of Decree No. 142, the provider must reassess conformity during use where a significant change affects the results of the initial conformity assessment. Relevant changes may involve key functions, intended use or scope of application; system architecture, AI model or important technical configurations; major data sources, input-data types or processing methods; integration with another system or a new operating environment; or other changes materially affecting compliance with applicable high-risk requirements [2].
The Decree also distinguishes significant changes from ordinary activities such as periodic data updates, routine technical error correction, performance optimization or version upgrades that remain within the relevant compliance requirements [2].
Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, separately establishes Viet Nam's current List of High-Risk Artificial Intelligence Systems [3].
These statutory records and obligations are important, but they should not be confused with the organizational governance record proposed here.
Current Vietnamese law does not prescribe a universal standardized “Healthcare AI Governance Decision Record” that every healthcare organization must complete for every AI system.
The practical record described in this article sits alongside statutory documentation. Where legally required documentation already exists, the governance decision record should reference or link to it rather than unnecessarily reproduce it.
Healthcare quality management provides an important foundation
Healthcare AI governance should not become detached from existing healthcare quality-management principles.
Circular No. 19/2013/TT-BYT remains recorded as in force. It establishes patient-centred hospital quality management, continuous improvement and leadership responsibility. Importantly, it provides that decisions relating to hospital quality management should be based on law, scientific grounds with specific evidence, and the practical needs of improving hospital quality [4].
That principle translates naturally into healthcare AI.
Where an AI system may affect diagnosis, prioritization, clinical communication, documentation, workflow or other aspects of care, the organization should be able to show what evidence informed its decision and how important unresolved concerns were handled.
Documentation therefore supports healthcare quality rather than existing only for future regulatory or accreditation review.
International healthcare AI governance is also moving toward demonstrable organizational accountability
Joint Commission's Responsible Use of AI in Healthcare (RUAIH) Certification, launched on 1 June 2026, treats responsible AI as an organizational governance, quality and patient-safety issue rather than simply a technology question. Its current certification areas include governance, effective data management, risk and bias reduction, monitoring and evaluation of safety and effectiveness, and transparency, education and training [5].
CHAI's Governance Playbooks, released on 27 May 2026, similarly provide baseline governance controls spanning organizational policy, structures and resources, responsible AI lifecycle management, risk and impact assessment, data management, third-party management and education [6].
CHAI's AI Intake Playbook and AI Intake Controls and Evidence Workbook, released on 1 October 2026 as a draft framework entering pilot testing, connect intake controls with the evidence that can support organizational review. The draft includes 57 controls across 11 domains and is intended to support risk-proportionate intake rather than function as a universal approval decision [7].
Neither Joint Commission RUAIH nor the CHAI materials establish a universal standardized governance decision-record form of the kind proposed in this article.
Their relevance is more fundamental: responsible AI governance increasingly depends on organizations being able to demonstrate that appropriate review, authorization, monitoring and accountability actually occurred.
Approval should describe boundaries, not simply say “yes”
One of the weakest words in AI governance can be “approved.” The immediate question should be: approved for what?
A technology may be approved for procurement but not for clinical use. It may be authorized for retrospective validation but not prospective patient-facing deployment. A pilot may be approved at one site but not across an entire hospital group. A generative AI platform may be permitted for administrative drafting but not for entering identifiable patient information. A clinical AI system may be authorized for one population, specialty or workflow but not another.
A governance decision record should therefore document the scope of authorization.
That scope may include the use case, intended users, department, site, relevant patient population, system or model version, data environment, workflow position, permitted actions, human-oversight requirements and any limitations on autonomous or patient-facing use.
The meaningful governance question is therefore not simply “Can we use this AI?” It is “For which purpose, by whom, where, under which conditions and within which boundaries may this AI be used?”
This becomes particularly important when one platform provides multiple AI functions. Organizational authorization should follow the material use case rather than assuming that approving a commercial product automatically authorizes every feature the product can provide.
Approval conditions should be explicit, and temporary conditions need an end point
Many healthcare AI systems are appropriately authorized only if certain safeguards remain in place.
Clinicians may need to review outputs before action. Staff training may need to be completed before deployment. A vendor may have to provide additional evidence. Performance may need to be reviewed more frequently during early use. Particular populations may be excluded until additional validation becomes available. A reliable fallback process may need to remain operational.
If these requirements exist only in meeting notes or people's memories, they are difficult to govern.
The decision record should therefore state the conditions on which authorization depends and identify who owns each condition. A requirement such as “monitor performance closely” is difficult to verify. A requirement such as “review the defined local performance indicators monthly for the first six months and escalate when a predefined threshold is exceeded” can actually be governed.
Conditional approval also needs a defined end point. Where authorization is temporary or depends on unresolved actions, the record should specify a review date, evidence requirement, completion condition or other trigger for reconsideration.
A controlled deployment might, for example, remain authorized for three months, until a specified number of cases has been evaluated, or until a defined monitoring package has been reviewed. At that point, the organization should make another decision: continue, modify, expand, restrict, suspend or stop the use.
Temporary authorization should not become permanent deployment simply because nobody revisited it.
Internal governance exceptions must be distinguished from legal non-compliance
Healthcare organizations will occasionally encounter situations in which an internal governance requirement cannot be followed exactly.
An organizational policy may request a particular document that a specialized vendor does not produce. A monitoring requirement may temporarily need modification during a migration. An urgent operational situation may justify an accelerated internal review pathway.
Organizations may therefore need an internal governance exception process.
The boundary must be clear. An authorized organizational body may permit a deviation from an internal policy, procedure or control within its authority. It cannot waive Vietnamese law, professional obligations, mandatory regulatory requirements or requirements imposed by a competent authority.
A governance decision record should identify which internal requirement is being excepted, why the exception is justified, who authorized it, what compensating controls apply, when the exception expires and what must happen before normal requirements resume.
The safest internal exception is usually specific, narrow and time-limited.
A single exception may be reasonable, but a recurring pattern of similar exceptions is itself a governance signal. It may indicate that the control is unrealistic, implementation capability is insufficient, vendors repeatedly cannot meet the requirement, or organizational behaviour is gradually normalizing deviation from its own rules.
Structured decision records allow those patterns to become visible.
Residual-risk acceptance is not a waiver of responsibility
No meaningful healthcare AI implementation is completely risk-free.
After hazards have been identified and reasonable controls applied, some risk may remain. This is residual risk.
A system may remain less certain in a particular subgroup despite validation and monitoring. A generative AI tool may retain some possibility of hallucination despite grounding and human review. A workflow may remain partially dependent on an external cloud service despite fallback arrangements.
The organization may eventually need to determine whether that remaining risk is acceptable in light of expected benefit, available alternatives, uncertainty and existing safeguards.
Residual-risk acceptance, as used in this article, is an internal organizational governance concept. It is not a statutory exemption under Vietnamese law.
Acceptance should not mean, “We know there is a problem, but we will ignore it.” It should mean that the remaining risk has been understood after reasonable mitigation, relevant uncertainty remains visible, an appropriately authorized person or body has determined that the risk can be accepted within defined limits, and monitoring and escalation remain in place.
Organizational acceptance of residual risk cannot make unlawful or non-compliant conduct acceptable, remove statutory duties, override professional obligations or eliminate potential legal liability.
Risk-acceptance authority should match the consequence
Not every remaining risk should be escalated to the CEO or governing body. Requiring executive approval for every minor operational risk would make governance slow and ceremonial.
At the same time, a project manager should not be able to accept a substantial unresolved clinical or patient-safety risk merely because implementation is behind schedule.
Healthcare organizations should therefore define risk-acceptance authority proportionate to consequence.
Lower-consequence operational risks may fall within delegated governance limits. Material clinical, patient-safety, legal, data, financial or organizational exposure may require escalation to a more senior level.
The decision record should identify who accepted the defined residual risk and the basis of that person's or body's authority.
Clear authority prevents a common governance failure: many people participate in the discussion, but nobody can later identify who was actually empowered to make the decision.
Good documentation preserves uncertainty rather than polishing it away
Governance records should not become polished narratives that explain why an organization proceeded while removing the uncertainty that made the decision difficult.
Important evidence gaps, limited vendor evidence, uncertainty in particular patient groups and material clinical or workflow concerns should remain visible when they affected the decision.
Good documentation does not pretend uncertainty disappeared. It demonstrates that uncertainty was recognized, considered and managed deliberately.
This becomes particularly important when new evidence later changes the balance between benefit and risk.
Capture the evidence that mattered, not every document that existed
Healthcare AI review may generate a large volume of material: scientific literature, vendor documentation, model cards, validation reports, risk assessments, privacy reviews, cybersecurity assessments, contractual documents, workflow evaluations, frontline feedback and meeting papers.
The governance decision record should not reproduce all of them.
Instead, it should identify the material evidence that influenced the decision, with references or links to underlying records where appropriate.
That evidence might include external clinical evidence, local validation findings, risk assessments, workflow testing, privacy or cybersecurity findings, vendor evidence, patient or frontline input and relevant incident history.
Important evidence gaps should also be documented.
A statement such as “approved based on evidence reviewed” provides little useful traceability because a future reviewer cannot tell which evidence actually drove the conclusion.
The objective is to preserve the rationale and traceability of the decision, not to accumulate documents.
Material disagreement can be recorded without turning the record into a transcript
Multidisciplinary healthcare AI governance will not always produce unanimous opinions.
Clinicians may consider performance evidence insufficient. Technical teams may believe an integration is acceptable while frontline users identify workflow problems. Privacy, quality and innovation functions may reach different views about a proposed use.
A governance decision record does not need to reproduce the entire debate.
It should, however, preserve material unresolved disagreement when that disagreement affected the final decision.
For example:
“The pilot was supported, but clinicians raised concern about false-negative performance in population X. Deployment was therefore limited to population Y pending further evaluation.”
That short statement preserves the governance logic without requiring a verbatim meeting transcript.
Change decisions deserve the same discipline as initial authorization
Healthcare AI does not remain static after go-live.
Software is updated. Models change. Thresholds are adjusted. New data sources are introduced. User interfaces evolve. Workflows are redesigned. A platform may replace an upstream foundation model. Use may expand to new facilities or patient populations.
A governance decision that was reasonable six months ago may therefore no longer describe the AI system now in use.
For high-risk AI, Decree No. 142/2026/NĐ-CP makes this particularly important. During use, the provider must reassess conformity where a significant change affects the results of the initial conformity assessment. Depending on the circumstances, relevant changes may involve key functions, intended use or scope of application; model or system architecture; important data sources or processing methods; integration; operating environment; or other matters materially affecting compliance [2].
The AI regulatory framework also requires review of risk classification in defined circumstances. Where a deployer modifies, integrates or changes functions or purposes of use in a way that creates new or higher risk, the deployer must cooperate with the provider in reviewing and reclassifying the system [1,2].
An internal governance change decision should therefore record not only what changed, but also what the organization concluded that the change means.
The organization may need to determine whether local revalidation is required, monitoring should intensify, staff training or workflow should change, the existing authorization remains appropriate, human oversight or fallback arrangements have been affected, or data flows and dependencies have materially changed. It should also determine whether statutory classification or conformity obligations need to be addressed by the relevant provider or deployer.
The rationale for those conclusions should be preserved.
“No further review required” can itself be a governance decision
Not every software or vendor update should trigger full multidisciplinary reassessment.
That would be impractical.
Organizations can define thresholds for routing changes through streamlined, enhanced or comprehensive internal review. A routine technical fix may need no clinical revalidation. A user-interface change may require limited workflow assessment. A model update that could materially alter diagnostic performance may require much deeper review.
Decree No. 142 likewise distinguishes significant changes for high-risk conformity reassessment from periodic data updates, routine technical error correction, performance optimization or version upgrades that do not affect the relevant compliance requirements [2].
The important organizational principle is that materiality should be considered deliberately rather than assumed.
For changes close to the review threshold, a concise record explaining why further review was not considered necessary can be valuable. Otherwise, if a problem later occurs, the organization may know that a change happened but have no evidence that anyone considered its governance implications.
Governance decisions should form a lifecycle history
Initial authorization should be the beginning of a governance history, not its end.
Over time, the record may accumulate linked decisions about completion of a pilot, wider deployment, significant changes, new monitoring findings, temporary restrictions, revised residual risk, incidents, suspension or retirement.
Earlier decisions should generally be preserved rather than overwritten.
This creates a chronological governance history:
what we knew → what we decided → what changed → what we learned → what we decided next
That sequence supports assurance and organizational learning. It also reduces the risk of hindsight rewriting the history of a decision.
A later decision may legitimately differ from the original decision because the evidence changed. Good governance documentation should make that evolution visible.
Safety incidents and monitoring findings should be able to reopen earlier decisions
An AI-related safety event or near miss should not remain isolated within incident management if it changes the evidence supporting the original authorization.
An incident may reveal an unexpected hazard, a weak human-oversight mechanism, a previously unrecognized subgroup problem or a failure of fallback arrangements. The organization should then consider whether the existing approval conditions, residual-risk assessment, monitoring approach or deployment scope remain appropriate.
Possible responses may include continuing without change, intensifying monitoring, adding controls, restricting a use case, performing additional validation, suspending deployment or withdrawing the system.
This creates a direct connection between patient-safety learning and governance authority.
The same principle applies to routine monitoring. A dashboard is not governance by itself. Governance occurs when meaningful monitoring signals are interpreted and converted into decisions.
Performance deterioration, increasing override rates, unexpected workload or an emerging equity concern should have an identified review pathway and decision owner. Depending on the evidence, the organizational response may be to continue, investigate, mitigate, restrict, revalidate, suspend or retire.
An organization can monitor AI extensively and still have weak governance if nobody is accountable for deciding what the findings mean.
Multi-site and expedited decisions require traceability
Healthcare groups may centralize AI procurement or governance while implementation remains local. A central body may determine that a system is eligible for deployment, but individual hospitals or clinics can differ in patient population, staffing, data, infrastructure and workflow.
Decision documentation should therefore distinguish central organizational authorization from site-level readiness or site-specific authorization where required.
A central decision may authorize deployment subject to defined local requirements, while each site documents whether those requirements have been met. This prevents an enterprise-level decision from being interpreted as evidence that every local environment has been evaluated identically.
Healthcare organizations may also occasionally need an expedited internal governance pathway because of an urgent operational or safety need. Where organizational policy permits such a route, speed should not eliminate accountability. The record should still identify who made the decision, why the expedited process was used, its temporary scope, minimum safeguards, any deferred review and when the ordinary governance pathway must resume.
An expedited pathway is an alternative form of internal governance. It is not permission to bypass mandatory legal or regulatory requirements.
Governance decision records themselves need governance
A governance decision record may contain sensitive information.
It might refer to a safety event, contain commercially confidential vendor information, identify staff involved in an incident or summarize cybersecurity vulnerabilities.
The record therefore needs appropriate access control, retention, version management and confidentiality protection.
A governance decision record does not sit outside the personal-data framework simply because it was created for governance purposes. Where it contains personal data, Law No. 91/2025/QH15 and other applicable requirements continue to apply [8].
Health information should not be copied into a governance record merely because it exists elsewhere. Organizations should document enough information to support the decision while avoiding unnecessary duplication of identifiable patient information.
This illustrates an important principle: more documentation is not automatically better governance.
The objective is documentation that is sufficient, purposeful and retrievable.
Committee minutes and governance decision records serve different purposes
Meeting minutes remain useful. They can record attendance, discussion and formal actions.
But minutes are usually organized around meetings rather than around an AI system or use case. A decision may develop across several meetings, making its boundaries, conditions and later changes difficult to reconstruct.
A structured decision record can therefore complement committee minutes.
The minutes show what occurred during the meeting. The decision record shows the documented governance position for the relevant AI use case, together with its scope, conditions and subsequent changes.
The two can reference each other where useful rather than duplicate the same information.
Documentation should be proportionate to consequence
A Healthcare AI Governance Decision Record does not need to become a forty-page dossier for every AI use.
That would increase administrative burden without necessarily increasing safety.
A low-consequence internal administrative application may need only a concise record covering the use case, accountable owner, principal restrictions and review status.
A higher-consequence clinical AI system affecting diagnosis, treatment or prioritization may require considerably stronger documentation of evidence, local validation, safety controls, remaining uncertainty, residual risk, monitoring and decision authority.
A useful principle is:
the more consequential, uncertain, autonomous or difficult to monitor the AI use, the stronger the documentation of the governance decision should be.
This is an organizational risk-proportionate approach and should not be confused with Viet Nam's statutory high-, medium- or low-risk AI classification.
Decision records should support assurance, not merely future inspection
Documentation is sometimes produced primarily because someone may ask to inspect it later.
That is too narrow.
A governance decision record should help the organization itself determine whether its AI governance system is functioning.
Governance assurance should be able to sample decision records and determine whether appropriate authority was used, material evidence was available, approval conditions were completed, defined residual risks were accepted at the appropriate level, internal governance exceptions expired as intended, monitoring obligations were implemented, and significant changes or incidents triggered reconsideration where required.
This is how documentation becomes an assurance mechanism rather than administrative paperwork.
A practical Healthcare AI Governance Decision Record
A useful record does not need to be complicated. It should allow a future reviewer to reconstruct the decision without having to locate everyone who participated in the original discussion.
A risk-proportionate record may capture the AI system and material use case; decision date and status; scope of authorization; sites, users and populations covered; relevant system or model version; material evidence reviewed; important uncertainties and evidence gaps; identified material risks; required controls; approval conditions; approved internal governance exceptions; defined residual risks; person or body authorized to accept those risks; decision-making authority; monitoring obligations; responsible owners; review or expiry date; triggers for reconsideration; subsequent material decisions or changes; and links to supporting records.
Not every field needs the same depth for every AI system.
The purpose is to preserve the logic and boundaries of the decision.
A practical Healthcare AI Governance Decision Documentation Framework
Healthcare organizations in Viet Nam can structure decision documentation around the following cycle:
define the decision → confirm authority → identify the evidence → document uncertainty → define the approval scope → specify conditions and controls → document internal exceptions → identify residual risk → confirm risk-acceptance authority → set monitoring and review triggers → record subsequent decisions → reconsider when evidence changes
Define the decision means stating clearly what is being authorized, rejected, restricted or changed.
Confirm authority means establishing that the person or body making the decision has the appropriate organizational authority.
Identify the evidence means recording which information materially influenced the decision rather than merely noting that documents existed.
Document uncertainty means preserving important evidence gaps, limitations and unresolved concerns.
Define the approval scope means identifying permitted uses, users, sites, populations, versions and other relevant boundaries.
Specify conditions and controls means translating governance expectations into requirements that can be implemented and verified.
Document internal exceptions means recording authorized deviations from internal organizational controls together with rationale, compensating measures and expiry.
Identify residual risk means describing important risk that remains after relevant mitigation.
Confirm risk-acceptance authority means establishing who is authorized to determine whether that remaining risk can be accepted.
Set monitoring and review triggers means defining the circumstances in which the decision should be reconsidered.
Record subsequent decisions means preserving how the organization's governance position changes across the AI lifecycle.
Reconsider when evidence changes means connecting monitoring findings, safety events, vendor changes and new evidence back to organizational decision-making authority.
This Healthcare AI Governance Decision Documentation Framework is proposed here as a practical organizational approach. It is not a statutory Vietnamese framework, a mandatory Ministry of Health form, a Joint Commission template or a CHAI template.
What healthcare organizations should avoid
One failure mode is approval without scope, where an AI system is simply marked “approved” and subsequently used beyond the use case that was actually reviewed. Another is conditions without owners, where monitoring, validation or training is required but nobody is accountable for completing it. A third is permanent exceptions, where a temporary deviation from internal governance requirements gradually becomes routine practice because it was never revisited.
Organizations should also avoid informal risk acceptance, where significant unresolved risk is tolerated without an identifiable authorized decision-maker; over-simplified decision records, where important uncertainty or disagreement disappears from the final documentation; change without reconsideration, where successive updates gradually make the deployed system different from the system originally authorized; and documentation overload, where governance teams create extensive records that nobody can practically use.
Another failure is documentation without implementation: the record appears complete, but the controls, conditions and monitoring obligations described in it never actually occur.
Good decision documentation should make governance more real, not simply more documented.
What this means for healthcare organizations in Viet Nam
As AI use expands, healthcare organizations will repeatedly need to decide whether a system may enter validation, whether a pilot can go live, whether another site can adopt it, whether a limitation can be tolerated, whether an internal governance exception is justified, whether an update requires revalidation, whether a new safety signal changes the previous authorization, and who has authority to accept remaining risk.
Together, those decisions form the operational history of responsible healthcare AI.
If that history remains distributed across emails, meeting memories and fragmented documents, governance becomes difficult to reconstruct and even harder to assure.
The practical transition is therefore:
from “the committee discussed it” → to “the organization can show what it decided, why, under what authority, with what conditions, and what would make that decision change.”
Good governance documentation should not slow healthcare AI unnecessarily. It should create enough institutional memory for decisions to remain understandable when staff change, systems evolve and new evidence appears.
That is especially important in healthcare because AI governance is ultimately not about proving that a committee existed.
It is about ensuring that clinical, safety and organizational decisions remain visible, accountable and revisable throughout the AI lifecycle.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, corporate-governance, personal-data protection, cybersecurity, procurement, medical-device, accreditation or quality-management advice.
The terms Healthcare AI Governance Decision Record, residual-risk acceptance and related decision-documentation concepts are used in this article as practical organizational governance concepts. They should not be interpreted as defined statutory Vietnamese mechanisms unless expressly stated otherwise.
The Healthcare AI Governance Decision Documentation Framework proposed here is not a mandatory Vietnamese framework, Ministry of Health template, Joint Commission standard or CHAI template.
Vietnamese law imposes specific documentation, classification, conformity-assessment, transparency, logging, incident-management and other obligations in defined circumstances. Organizations should determine which requirements apply according to the AI system, statutory risk classification, legal role of the organization and other parties, intended use and deployment context.
An internal governance exception cannot waive applicable law or mandatory regulatory requirements. Similarly, organizational acceptance of residual risk does not remove statutory obligations, professional responsibilities or potential legal liability.
Decision records should also be managed in accordance with applicable requirements concerning personal data, medical records, confidential information, cybersecurity, intellectual property, retention and other protected information.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
Ministry of Health of Viet Nam. Circular No. 19/2013/TT-BYT Providing Guidance on Management of Quality of Medical Examination and Treatment Services in Hospitals. Issued 12 July 2013; effective 15 September 2013; currently recorded as in force.
Joint Commission. Responsible Use of AI in Healthcare Certification. Launched 1 June 2026.
Coalition for Health AI. AI Governance Playbooks. Released 27 May 2026.
Coalition for Health AI. AI Intake Playbook and AI Intake Controls and Evidence Workbook. Released as a draft framework on 1 October 2026; pilot phase underway.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.