Governing Clinical AI Use Boundaries in Viet Nam: Intended Use, Exclusions and Use-Case Expansion
PRACTICAL FRAMEWORKS & TOOLS
Governing Clinical AI Use Boundaries in Viet Nam: Intended Use, Exclusions and Use-Case Expansion
PRACTICAL FRAMEWORKS & TOOLS
Last reviewed: 8 October 2026
A healthcare organization may introduce a clinical AI system for a clearly defined purpose, review the available evidence, train its staff and authorize routine use. Over time, however, clinicians may begin using the same system in ways that were not considered during the original assessment.
Consider an AI system introduced to help detect colorectal polyps during colonoscopy. Its role may be limited to highlighting suspected lesions for the endoscopist. After gaining experience with the technology, clinicians may become interested in using its outputs to assess whether a lesion is malignant, support treatment decisions or assist with examinations involving patient groups not covered by its intended use.
The software may not have changed, but the clinical purpose has. A system originally used to assist detection may gradually become a source of information for decisions it was never intended or adequately evaluated to support.
This raises an important question for healthcare organizations: How can they keep clinical AI within appropriate boundaries while allowing its use to expand when new evidence, capabilities and clinical needs justify doing so?
The answer requires more than checking whether a system functions correctly. Healthcare organizations need to understand what the technology was intended to do, what the evidence supports, what applicable regulations permit and what their own organization has authorized. These distinctions should remain clear throughout routine clinical use, not only during procurement or initial implementation.
Intended use is more than a product description
In healthcare, intended use describes the purpose for which a technology is designed and presented for use. For regulated medical devices, intended use or intended purpose has a specific regulatory significance and is generally established through the manufacturer's documentation.
The International Medical Device Regulators Forum (IMDRF) emphasizes the importance of understanding medical device software in its clinical context, including its medical purpose, functions, operating environment and potential risks. Its 2025 document on medical device software characterization provides a structured approach to these considerations [8]. The IMDRF's 2025 Good Machine Learning Practice principles also emphasize the importance of intended use, clinical workflow, expected benefits and patient risks throughout medical device development [9].
For clinical AI, intended use often involves considerably more than identifying a disease or describing a general function. It may specify the relevant patient population, clinical condition, care setting, required input data, intended users, expected outputs and the role of those outputs in clinical decision-making.
An AI system designed to prioritize potentially abnormal chest radiographs is not necessarily intended to establish a diagnosis. An algorithm developed to detect suspected polyps during colonoscopy is not automatically suitable for predicting histology. A model estimating deterioration risk over a defined period should not be assumed suitable for unrelated treatment decisions.
These distinctions matter because an AI output can have very different clinical implications depending on how it is used. A technically correct output does not necessarily provide appropriate evidence for every decision a clinician might wish to make.
WHO's 2021 framework on generating evidence for AI-based medical devices emphasizes the importance of understanding the intended application and context when evaluating clinical evidence [10]. The IMDRF's clinical evaluation framework similarly connects evidence of clinical safety, effectiveness and performance to a medical device software product's intended purpose [11].
For AI applications that are not regulated as medical devices, the provider's description of intended use may not carry the same regulatory meaning. Nevertheless, understanding the system's stated purpose, functions and limitations remains important for responsible organizational implementation.
Four boundaries that healthcare organizations should distinguish
A practical way to approach clinical AI use is to distinguish four related boundaries: the manufacturer's intended use, applicable regulatory conditions, the scope supported by clinical evidence and the healthcare organization's own authorization.
The manufacturer-defined intended-use boundary describes what the manufacturer or relevant provider identifies as the system's intended purpose, including its functions, operating conditions and limitations. For regulated medical devices, the organization should examine the applicable product documentation rather than relying only on marketing materials or sales presentations.
The regulatory boundary concerns the conditions under which the relevant system and its proposed use are legally permissible in Viet Nam. Depending on the technology, this may involve artificial intelligence legislation, medical-device regulation, professional practice requirements, personal-data protection and other applicable laws. Internal hospital authorization cannot replace a regulatory permission that is legally required.
The clinical evidence boundary concerns what the available evidence can reasonably support. A system may have convincing evidence for one patient population, examination technique or clinical setting but insufficient evidence for another. A manufacturer's general statement about a product's capabilities should not be mistaken for proof that every proposed clinical application is safe and effective.
The organizationally authorized use boundary describes how the healthcare organization has decided the system may be used within its own services. This may be narrower than the manufacturer's intended use because of local patient characteristics, workforce capabilities, equipment, infrastructure or patient-safety considerations.
These boundaries are connected, but they do not necessarily coincide. A manufacturer may offer several AI functions while a hospital authorizes only one. A product may be legally available for a particular purpose but lack sufficient evidence for a proposed new patient group. An organization may also identify a promising clinical application that requires additional assessment or regulatory consideration before routine use.
The practical objective is to ensure that actual clinical use remains legally permissible, supported by appropriate evidence and consistent with the organization's approved conditions of use.
What Viet Nam's current legal framework means
Viet Nam's Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026. Article 4 establishes human-centred principles, including that AI should serve people rather than replace human authority and responsibility. It also emphasizes maintaining human control and the capacity to intervene in AI-supported decisions and activities [1].
Article 6 is particularly relevant to healthcare. It requires stricter risk management, appropriate to the characteristics of essential sectors that directly affect life, health and other protected interests. For healthcare applications, the Law specifically refers to patient safety, reliability under real-world conditions and protection of health data [1].
Decree No. 142/2026/NĐ-CP, effective since 1 May 2026, provides more specific requirements concerning AI risk classification and management. Article 5 requires providers to classify AI systems before they are put into use. It also requires deployers to coordinate with providers to review and reclassify systems when deployment, modification, integration or changes in functions or intended purpose create new or higher risks compared with the original classification [2].
This provision is particularly relevant to clinical use expansion. A change in how an organization uses an AI system may be important even if the underlying software has not been modified. However, not every minor operational adjustment automatically requires statutory reclassification. Article 11 further identifies circumstances requiring risk reclassification and excludes ordinary upgrades, performance optimization, routine technical corrections or data updates that do not change the nature of the system's risk [2].
Article 15 establishes specific risk-management obligations for systems legally classified as high-risk. Providers must supply deployers with relevant information about intended use, safe operating conditions, identified risks and corresponding controls. Deployers of high-risk AI systems must manage their use consistently with the purpose, conditions and limitations established by the provider, monitor for emerging risks and apply appropriate risk-control measures [2].
Article 16 also addresses transparency and accountability, including the provision of information about an AI system's intended purpose, scope, conditions of use and limitations, in accordance with applicable requirements [2].
These provisions are relevant to responsible clinical AI governance, but their different scopes must be respected. The specific obligations for legally classified high-risk AI systems should not automatically be presented as identical legal obligations for every AI application used in healthcare.
Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, establishes Viet Nam's current list of high-risk AI systems. Its healthcare-specific entries focus on defined AI-assisted surgical and robotic-surgery systems meeting particular conditions [3].
The Decision also establishes transitional arrangements. For listed high-risk AI systems in healthcare that were already operating before 15 August 2026, providers and deployers must complete the applicable AI-law compliance obligations before 1 September 2027. Systems first put into operation during the six months following the Decision's effective date are subject to a separate compliance deadline of 1 March 2027. These transitional provisions must be considered according to the system's circumstances and do not remove other applicable legal or patient-safety responsibilities [3].
Other clinical AI applications may fall outside the healthcare entries in the high-risk list. This does not necessarily mean they present little clinical risk or that healthcare organizations can disregard patient-safety responsibilities. The applicable classification should be assessed against the actual system and relevant legal criteria rather than inferred from a general label such as “clinical AI.”
Medical-device regulation must also be considered separately where applicable. Viet Nam's medical-device framework continues to be based on Decree No. 98/2021/NĐ-CP, as amended, including by Decree No. 07/2023/NĐ-CP and Decree No. 04/2025/NĐ-CP. Circular No. 24/2026/TT-BYT, effective since 1 July 2026, addresses risk determination and management measures for medical-device products and amends parts of the implementing framework [4, 5].
AI risk classification and medical-device classification are different regulatory questions. However, they should not necessarily result in duplicative assessments. Article 5 of Decree No. 142 recognizes that valid, sufficiently comprehensive and legally effective assessments conducted under applicable specialized legislation may be used to demonstrate corresponding AI requirements within the scope already assessed. Additional assessment may be needed for requirements not adequately covered [2].
This principle helps avoid unnecessary duplication in regulatory assessments. It should not be interpreted as automatically removing the healthcare organization's need to consider whether a system is suitable for its actual clinical use.
The Law on Medical Examination and Treatment also remains relevant, particularly the professional responsibilities associated with clinical care and the prevention of medical incidents [6]. Where clinical use involves the processing of personal data, organizations must also consider the Law on Personal Data Protection No. 91/2025/QH15, effective since 1 January 2026, and applicable implementing requirements [7].
Taken together, these instruments provide an important legal foundation for responsible clinical AI use in Viet Nam. They do not, however, prescribe a universal clinical AI use-boundary framework or a standardized Ministry of Health document for every AI application.
When clinical use expands without formal authorization
One of the more difficult governance problems is that clinical use can expand gradually without anyone formally proposing a change.
A clinician may discover that an AI-generated output appears useful for another clinical question. A department may begin applying an existing system to additional patient groups because demand has increased. An AI result initially intended to support one decision may become part of another decision-making process.
Consider an AI application introduced to prioritize radiographs for radiologist review. Over time, some staff may begin interpreting the absence of an AI alert as reassurance that no important abnormality exists. What began as a prioritization function is now influencing the perceived need or urgency for further clinical assessment.
The system may still operate exactly as designed, yet the organization has begun relying on it for a different clinical purpose.
A similar situation can arise with AI-assisted documentation. An ambient AI tool may be authorized to prepare draft notes for clinician verification. If its generated summaries subsequently become the basis for diagnostic or treatment decisions without appropriate review, the organization may be placing greater clinical reliance on the tool than originally intended.
Not every proposed new use is inappropriate. Experience with a technology can reveal genuine opportunities to improve care. The concern is when an additional clinical purpose becomes routine practice without anyone checking whether the evidence, permissions and safeguards remain adequate.
For practical discussion, this can be understood as clinical use drift: a change in how an AI system is actually used or relied upon in clinical care. It is not a separate statutory category under Vietnamese law.
Unlike model-performance drift, clinical use drift can occur while the AI model, software version and measured technical performance remain unchanged. For healthcare leaders, the challenge is to recognize when growing familiarity with a technology is changing its clinical role.
Define authorized use, excluded use and use requiring further assessment
A useful clinical AI authorization should explain not only what a system can do, but also what clinicians may reasonably rely on it to do.
Descriptions such as “AI supports diagnosis” or “AI assists clinical decisions” may be too broad to guide safe practice. They do not necessarily identify which decisions the system supports, which patients are covered or what its outputs should mean to clinicians.
Consider an AI application used during gastrointestinal endoscopy. A healthcare organization may authorize it to highlight suspected colorectal polyps during specified colonoscopy procedures performed by trained clinicians. The authorization should also clarify whether the system has been evaluated for optical characterization, histological prediction or other functions that go beyond detection.
If those additional functions are not supported or authorized, clinicians should not infer them merely from the presence or appearance of an AI-generated visual signal.
A practical authorization should distinguish three situations.
Authorized use refers to a clinical application that is consistent with applicable legal and product conditions, supported by sufficient evidence for its intended purpose and approved by the healthcare organization.
Excluded use refers to an application that is expressly prohibited or excluded under applicable legal requirements, product conditions or organizational authorization. An organization may also exclude a use because identified risks are unacceptable or cannot be adequately controlled.
Use requiring further assessment refers to a proposed application that has not yet been sufficiently evaluated or authorized for routine care. It may be clinically promising, but the available evidence may be incomplete, the patient population may differ, or clarification may be required from the manufacturer or relevant authorities.
These distinctions are important. An application that has not yet been assessed should not automatically be treated as permanently prohibited. Equally, the absence of an explicit prohibition does not establish that routine clinical use is appropriate or authorized. Until the necessary assessment and authorization have been completed, a proposed new use should not simply become routine practice.
Patient groups, clinical settings and technical conditions deserve particular attention. A system evaluated primarily in adults should not automatically be assumed suitable for pediatric patients. Evidence from one type of imaging equipment may not support all equipment configurations. An AI tool intended for a particular setting may not be appropriate where the available workforce, data quality or clinical response capability differs substantially.
Where these factors materially affect safe use, they should be made clear to the professionals responsible for clinical care.
Manufacturer claims and clinical permissions are not the same thing
Healthcare organizations may encounter AI products whose capabilities are described in broad commercial terms. A brochure may advertise diagnostic support, intelligent detection or automated clinical analysis without clearly specifying the boundaries of those functions. A demonstration may also show features that are not fully explained in the formal product documentation.
This can create uncertainty, particularly when AI is embedded within medical equipment or an existing digital platform. A healthcare organization should not assume that every demonstrated capability is suitable or authorized for every possible clinical application.
Where information is unclear, the organization should request appropriate clarification from the provider or manufacturer. Depending on the technology, this may concern the intended clinical purpose, patient population, compatible equipment, required inputs, known limitations, failure conditions, interpretation of outputs and available supporting evidence.
For regulated medical devices, the organization should also consider the applicable regulatory documentation and product status in Viet Nam. A vendor's commercial assurance should not be treated as equivalent to appropriate clinical evidence, product documentation or legally required authorization.
Where important uncertainties remain unresolved, limiting the system to clearly supported applications may be more appropriate than allowing broader use based on assumptions. This does not prevent innovation. It helps distinguish an available technical capability from a clinically justified and appropriately authorized application.
A practical Clinical AI Use Boundary Record
Healthcare organizations can make these distinctions easier to manage by maintaining a concise Clinical AI Use Boundary Record for applications that materially influence clinical care.
This record is proposed as a practical organizational tool. It is not a statutory Vietnamese form, a Ministry of Health requirement or an international certification instrument.
The purpose is to provide a clear account of where an AI system may be used, under what conditions and for which clinical decisions. The record should be understandable to the professionals who use the system rather than functioning only as a technical or compliance document.
It should identify the AI system, relevant version or configuration, provider, responsible clinical service and organizational role accountable for the approved use. It should also summarize the manufacturer's stated intended purpose, relevant regulatory conditions and the organization's specific clinical authorization.
Most importantly, the record should define the permitted clinical task, patient population, setting, intended users, required inputs and expected outputs. It should explain how those outputs may contribute to clinical decisions and identify material limitations, exclusions or situations requiring further assessment.
A short statement distinguishing authorized and non-authorized uses can often be more useful to frontline staff than several pages of general AI policy.
For example, a record for an AI-assisted colonoscopy system could state that the organization has authorized its use for real-time assistance in detecting suspected colorectal polyps during specified examinations, subject to the system's documented conditions and supporting evidence. It could also state that the system has not been authorized to provide independent histological diagnoses or determine treatment solely from its detection output.
If expansion to another patient group or clinical purpose is being considered, the record should indicate that further evaluation and authorization are required before the proposed use becomes routine practice.
The record should also identify who may approve changes, what evidence is needed, where decisions are documented and when the authorized scope should be reviewed. Material changes should be recorded in a way that allows staff to distinguish the current authorization from previous versions.
Where an organization already maintains an AI inventory, clinical risk register or approved-use documentation, this information can be incorporated into those existing systems. A separate document is not necessary if the essential details remain accessible, current and properly governed.
The aim is to make authorized clinical use clear, not to create another administrative process without practical value.
Making use boundaries work during routine care
A documented use boundary has limited value if it is not understood or followed in clinical practice. Healthcare organizations should consider how authorized use and material limitations are communicated during training, incorporated into clinical protocols and reflected in the design and configuration of the system.
For example, where particular patient groups are outside the approved scope, technical eligibility checks may help prevent inappropriate application if reliable information is available. Where certain AI functions have not been authorized for a department, suitable access controls may reduce accidental use.
Technical restrictions will not always be possible, especially when AI features are embedded within existing equipment or commercial software. In these situations, clear clinical instructions, supervision and practical methods for identifying inappropriate use may be necessary.
The organization should also consider whether clinicians can readily distinguish between an AI result that supports a particular decision and one that should not be relied on for that purpose.
Restrictions should be explained in clinically meaningful terms. Staff are more likely to understand a limitation when they know how using AI outside that boundary could affect patient care.
At the same time, use boundaries should not unnecessarily interfere with independent professional judgment. Clinicians remain responsible for evaluating patients and making decisions within their professional roles and applicable requirements. However, professional judgment does not automatically authorize the use of an AI system outside relevant legal, regulatory or organizational conditions.
Where an AI application is inappropriate for a particular patient or situation, the organization should ensure that suitable alternative clinical processes remain available.
How should healthcare organizations consider expanding an AI use case?
Successful implementation may create legitimate reasons to expand AI use. A hospital may wish to introduce an established application into another department, apply it to an additional patient population or use its outputs for a new clinical purpose.
Such proposals should not automatically be rejected, but they should be assessed before becoming routine practice.
The first question is whether the proposed expansion changes what the system is being relied on to do. Increasing the number of patients receiving an already authorized service may be different from using the same output to support a new diagnosis, treatment decision or degree of automation.
The organization should then establish whether the proposed use remains consistent with the manufacturer's intended purpose and applicable legal and regulatory conditions. Where the proposed use extends beyond those conditions, the regulatory implications should be clarified before routine implementation.
The available evidence must also be considered. Does it adequately support the new patient group, clinical setting or decision-making role? Are there clinically important differences between the proposed use and the circumstances in which the system was originally evaluated?
Patient-safety consequences are central. If the AI output is incorrect in the proposed application, what could happen to the patient? Could clinicians recognize the problem? Are suitable safeguards and professional review arrangements available?
The organization should also consider whether staff have the necessary competencies and whether existing workflows can support the expanded use safely. These considerations should lead to a documented decision.
In some cases, the proposed expansion may remain within the established intended purpose, regulatory conditions and supporting evidence. A proportionate internal authorization update may then be sufficient.
In other cases, additional clinical evaluation, manufacturer involvement, revised product documentation, AI risk-classification review, conformity assessment or medical-device regulatory action may be necessary, depending on the applicable circumstances.
Article 5 of Decree No. 142/2026/NĐ-CP is relevant when changes in deployment, integration, functions or intended purpose create new or higher risks. Article 11 also addresses circumstances requiring risk reclassification, while the Decree's provisions on conformity assessment establish additional considerations for high-risk AI systems [2].
An organization's internal approval cannot replace a legally required regulatory process. Equally, the need for additional assessment should not automatically be interpreted as a requirement to repeat every previous evaluation when valid evidence remains applicable.
Where uncertainty is substantial, the organization may decide not to proceed with routine use while exploring a more limited, appropriately governed evaluation. Research or investigational activities must separately satisfy applicable legal, ethical and institutional requirements. Ethics approval, where required, does not by itself replace other necessary regulatory permissions.
The guiding principle is that expanding the clinical role of AI should be a deliberate decision supported by appropriate evidence and authority, rather than an informal consequence of growing familiarity with the system.
Recognizing and responding to use outside approved boundaries
A clinical AI system may continue producing technically acceptable outputs while being used outside its approved clinical scope. Traditional performance dashboards may not reveal this problem.
Healthcare organizations should therefore pay attention to how AI is being used in practice, not only whether the model is functioning as expected. Possible warning signs include requests to use the system for additional clinical tasks, application to patient groups outside the approved scope, use with unsupported equipment or input data, or clinicians interpreting the output as evidence for decisions it was not intended to support.
Frontline feedback can be particularly valuable. A clinician who asks whether a system can be used for another purpose may be identifying a promising opportunity, but also an important governance question. Organizations should encourage these questions and provide a practical route for reviewing them.
When a possible boundary deviation is identified, the initial response should establish what happened, how the AI was used, whether any patients or clinical decisions may have been affected and whether immediate safeguards are needed.
Not every deviation requires stopping the entire system. Depending on the circumstances, the organization may clarify instructions, restrict a particular use, provide additional training, review affected cases or require further evidence before expansion.
Where the deviation creates significant patient-safety risk, stronger action may be necessary, including restricting the relevant function, involving clinical leadership and coordinating with the provider or manufacturer.
If a patient-safety incident or near miss has occurred, the organization should follow applicable investigation and reporting arrangements. Additional regulatory notification requirements must be assessed according to the specific event, system and legal framework. A question about possible use outside the approved boundary is not automatically a legally reportable AI incident, but it may still require prompt internal review.
The purpose of reviewing a deviation is not simply to identify who used the AI incorrectly. It is also to understand why the situation developed. Unclear instructions, workflow pressures, ambiguous product claims, insufficient training or poorly designed access controls may all contribute to use outside the approved scope.
Addressing these underlying conditions is often more valuable than relying only on reminders to staff.
Keeping clinical use boundaries visible over time
Clinical AI use-boundary management should be incorporated into existing clinical governance, quality management and patient-safety processes.
The responsible clinical service should understand how the system is actually being used. Other functions, including healthcare quality, patient safety, digital health, information technology, biomedical engineering, medical-device management and legal or compliance personnel, should contribute where relevant.
Not every healthcare organization needs a separate committee for use-boundary decisions. Existing governance structures may be sufficient if they provide clear authority, appropriate clinical expertise and a practical route for review.
Useful monitoring signals may include documented use outside approved conditions, repeated uncertainty about the meaning of AI outputs, requests for new applications, unresolved manufacturer limitations and near misses associated with inappropriate clinical reliance.
These indicators differ from conventional model-performance measures. They help the organization understand whether its actual use of AI remains consistent with the clinical scope that was assessed and authorized.
Use boundaries may also need reconsideration when clinical guidelines evolve, new evidence becomes available, the manufacturer changes relevant documentation, or the organization's services and patient population change materially.
Review should remain proportionate. A minor operational adjustment that does not affect the clinical purpose, authorized conditions or relevant risk assumptions should not necessarily trigger the same process as extending AI into a new diagnostic or treatment role.
What matters is that significant changes in clinical use are recognized and evaluated before they become routine practice.
What this means for healthcare organizations in Viet Nam
As AI becomes more widely available in hospitals, clinics and specialty services, healthcare organizations will need to pay closer attention to the clinical purposes for which these technologies are actually being used.
This is particularly relevant when AI is integrated into equipment or digital platforms that organizations already operate. New functions may become available through software updates, optional modules or additional service configurations. Clinicians may also identify potential new applications through routine experience.
The presence of a capability does not automatically establish that the organization has sufficient evidence or authorization to use it for a new clinical purpose.
Responsible governance should therefore make three distinctions clear: what is already authorized, what is excluded and what requires further assessment. These distinctions allow organizations to remain open to innovation without allowing unreviewed clinical uses to become established practice.
For healthcare leaders, a useful question is: Are we still using this AI system for the clinical purpose, patient population and conditions that our evidence and authorization actually support?
If the answer is unclear, the organization may need to clarify the current scope before extending the system's role in patient care.
Clinical AI does not necessarily become safer simply because clinicians are familiar with it. Experience can improve appropriate use, but it can also make unsupported assumptions seem routine.
The objective is not to restrict AI unnecessarily. It is to ensure that clinical use develops alongside the evidence, safeguards and accountability needed to justify that use.
Ultimately, the question is not only whether an AI system can perform a particular task, but whether the healthcare organization has sufficient evidence, authority and safeguards to use it for that task in real clinical care.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, medical-device, patient-safety, accreditation, cybersecurity, personal-data-protection or quality-management advice.
The terms clinical AI use boundary, clinical use drift and Clinical AI Use Boundary Record are used in this article as practical organizational concepts. They are not defined statutory categories or prescribed documentation requirements under Vietnamese law.
The approach proposed here is not a Ministry of Health framework, statutory approval process, IMDRF certification requirement or WHO regulatory standard.
Applicable legal obligations must be assessed for each relevant AI system and proposed use, including AI risk classification, conformity assessment where required, medical-device regulation, professional responsibilities, clinical governance, personal-data protection, research governance and other relevant requirements.
IMDRF and WHO materials are used as international reference points for intended use, clinical evidence, patient safety and responsible implementation. They do not themselves establish binding legal obligations for healthcare organizations in Viet Nam.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
Government of Viet Nam. Decree No. 98/2021/NĐ-CP on Medical Device Management, as amended by Decree No. 07/2023/NĐ-CP and Decree No. 04/2025/NĐ-CP.
Ministry of Health of Viet Nam. Circular No. 24/2026/TT-BYT on Determining Risk Levels and Management Measures for Medical-Device Products and Amending Certain Provisions of Circular No. 05/2022/TT-BYT. Issued 30 June 2026; effective 1 July 2026.
National Assembly of Viet Nam. Law No. 15/2023/QH15 on Medical Examination and Treatment, as amended. Effective 1 January 2024. Consolidated Document No. 26/VBHN-VPQH, issued by the Office of the National Assembly on 26 February 2026.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
International Medical Device Regulators Forum (IMDRF). Characterization Considerations for Medical Device Software and Software-Specific Risk. IMDRF/SaMD WG/N81 FINAL:2025. Published 29 January 2025.
International Medical Device Regulators Forum (IMDRF). Good Machine Learning Practice for Medical Device Development: Guiding Principles. IMDRF/AIML WG/N88 FINAL:2025. Published 29 January 2025.
World Health Organization. Generating Evidence for Artificial Intelligence-Based Medical Devices: A Framework for Training, Validation and Evaluation. Published 17 November 2021.
International Medical Device Regulators Forum (IMDRF). Software as a Medical Device (SaMD): Clinical Evaluation. IMDRF/SaMD WG/N41FINAL:2017. Published 21 September 2017.
World Health Organization. Regulatory Considerations on Artificial Intelligence for Health. Published 19 October 2023.