Healthcare AI Portfolio Governance in Viet Nam: How Organizations Should Prioritize, Standardize and Oversee Multiple AI Systems Across Sites and the Lifecycle
PRACTICAL FRAMEWORKS & TOOLSHEALTH-SYSTEM GOVERNANCE & SCALE
Healthcare AI Portfolio Governance in Viet Nam: How Organizations Should Prioritize, Standardize and Oversee Multiple AI Systems Across Sites and the Lifecycle
PRACTICAL FRAMEWORKS & TOOLS
Last reviewed: 7 October 2026
Healthcare AI governance can look manageable when an organization has one or two systems. A multidisciplinary team can review the evidence, assess the vendor, validate the use case, approve a pilot and monitor performance after go-live. The governance problem changes once AI begins to spread across departments, workflows and sites.
A hospital group may eventually have AI supporting imaging prioritization, endoscopy, pathology, clinical documentation, deterioration prediction, patient communication, coding, scheduling, revenue-cycle management and quality improvement. One enterprise platform may contain several AI functions. Existing software may acquire new AI capabilities through upgrades. Clinical departments may request additional products while staff independently begin using general-purpose generative AI tools. Several apparently unrelated applications may also depend on the same foundation model, cloud service or vendor.
At that point, governing each AI system well is no longer enough. The organization also needs to understand what the collection of AI systems is doing to the healthcare organization as a whole. This is the purpose of healthcare AI portfolio governance.
Portfolio governance does not replace intake, procurement, local validation, monitoring, change control, incident management or decommissioning for individual systems. It adds another organizational layer: visibility, prioritization, standardization and oversight across multiple AI systems, use cases, departments, sites and lifecycle stages.
This direction is increasingly visible internationally. Joint Commission's current voluntary Responsible Use of AI in Healthcare (RUAIH) certification assesses AI at the organizational level and addresses governance, effective data management, risk and bias reduction, lifecycle monitoring and evaluation, safety-related reporting, transparency and education. Its Health Care System pathway goes further: where AI activities are centrally managed or governed across multiple healthcare organizations, participating organizations are expected to follow the same governance, processes and policies for AI use [5].
CHAI's 2026 Governance Playbooks similarly approach AI governance as an organizational capability rather than as a series of isolated product reviews. The playbooks cover AI Policy, Organizational Structures, Organizational Resources, Responsible AI Lifecycle Management and Use, Risk and Impact Assessments, Responsible Data Management and Use, Third Party Management, and Education, Training and Feedback. Their baseline controls are intended to integrate into existing organizational processes and be adapted to local context [6].
For healthcare organizations in Viet Nam, the question is therefore no longer only “Is this AI system safe enough to use?” It is also: “Across all the AI we are using or considering, where should governance attention go, which controls should be standardized, where does local variation matter, and what risks become visible only when we look at the portfolio as a whole?”
Portfolio governance is not the same as an AI inventory
An AI inventory is the foundation of portfolio governance, but the two are not equivalent.
An inventory answers what AI do we have? It may record the system, intended use, department, provider or vendor, owner, approval status, deployment sites, statutory classification where relevant, version and monitoring responsibilities.
Portfolio governance asks a broader set of questions. Which systems matter most? Which require greater governance resources? Where are controls inconsistent? Which tools overlap? Which systems share important dependencies? Where is risk accumulating? Which AI is producing meaningful value? Which should be scaled, restricted, consolidated or retired?
An organization can therefore have an excellent inventory and still have weak portfolio governance. The inventory creates visibility; portfolio governance turns that visibility into prioritization and organizational decisions.
Portfolio governance is not a statutory AI classification system
This distinction is particularly important in Viet Nam.
Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026. Under Article 10, the AI provider is responsible for classifying the system before it is put into use. A deployer may rely on the provider's classification, but where the deployer modifies, integrates or changes system functions in a manner that creates a new or higher level of risk, the deployer must coordinate with the provider on reclassification [1].
Decree No. 142/2026/NĐ-CP, effective since 1 May 2026, further operationalizes classification, high-risk AI governance, risk management and conformity assessment. It also addresses circumstances in which modifications, integration or changes in functions or purpose of use by a deployer create new or higher risk [2].
For high-risk AI, Article 13 of Decree No. 142 requires the provider to reassess conformity during use where a significant change affects the basis or results of the original conformity assessment. Relevant changes include changes to key functions, intended use or application scope; system architecture or AI model; major data sources or processing methods; integration with another system or a new operating environment; and other changes materially affecting compliance with applicable high-risk requirements [2].
Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, separately establishes Viet Nam's current List of High-Risk Artificial Intelligence Systems [3].
Healthcare AI portfolio governance should therefore not replace statutory classification, conformity assessment or reclassification processes, or create an alternative legal taxonomy. A portfolio may contain legally high-risk, medium-risk and other AI systems while the organization separately uses internal criteria to decide how governance attention and resources should be distributed.
An AI system that is not legally high-risk may still warrant substantial organizational attention because of scale, sensitive data, workflow effects, patient-facing communication, uncertainty or dependency on critical infrastructure. Conversely, placing an AI system in a lower internal priority group cannot reduce obligations imposed by law.
The portfolio framework proposed here is therefore an organizational governance mechanism, not a statutory classification under Vietnamese law.
Build the portfolio around use cases, not just product names
One AI product may support several materially different uses.
A general-purpose language model might draft administrative correspondence, summarize internal policies, support clinical documentation and generate patient-facing communication. A hospital information system might contain predictive analytics, generative summarization and workflow automation within the same commercial product.
If the organization records the product only once, important differences can disappear.
Portfolio governance should therefore preserve visibility at both system or platform level and material use-case level. The platform matters because technical architecture, contracts, vendor relationships and upstream dependencies may apply across several functions. The use case matters because clinical consequence, users, data, workflow, human oversight and patient exposure may differ substantially.
A practical portfolio can therefore treat one enterprise platform as a common technology relationship while separately recording its important governed use cases. This allows the organization to ask both how dependent are we on this platform? and which uses of this platform create the greatest healthcare consequence?
Portfolio governance begins before deployment
A portfolio should not contain only AI already in routine use.
Organizations need visibility across the pipeline: proposed systems, intake submissions, technologies under evidence review, systems undergoing local validation, controlled pilots, limited deployments, routine use, restricted uses, suspended systems and retired technologies.
Organizational pressure often becomes visible before go-live. If ten departments simultaneously request new AI projects, the governance problem already exists even though none has been deployed. If several high-consequence systems approach implementation at the same time, training, validation and monitoring capacity may become constrained. If several departments are separately considering the same vendor, the organization may be missing opportunities for common due diligence or contracting.
CHAI's AI Intake Playbook, released on 1 October 2026 as a draft framework entering pilot testing, illustrates this growing volume problem. Its companion workbook contains 57 controls across 11 domains derived from more than 800 questions in health-system intake questionnaires [8].
Portfolio governance should therefore connect directly with intake. Every material AI request should become visible early enough for the organization to understand not only the proposed technology but also its effect on the existing portfolio and governance workload.
Use lifecycle status consistently across the organization
A large AI portfolio becomes difficult to interpret when departments use different meanings for the same words.
One team may call a system “approved” when procurement has been authorized. Another may mean technical integration is complete. A third may use “approved” to mean routine patient-facing use has been authorized.
Organizations should therefore define common lifecycle states. A practical sequence might be:
proposed → intake → under review → validation or pilot → approved for limited or routine deployment → routine use → restricted → suspended → retired
These are organizational workflow states, not statutory classifications.
The exact terminology matters less than consistency. Leaders and governance teams need to know whether approval means permission to investigate a vendor, run an offline evaluation, conduct a controlled pilot or use the system routinely. Portfolio governance becomes unreliable when lifecycle status is ambiguous.
Prioritize governance attention, not merely systems
Portfolio prioritization is not intended to produce a ranking of AI products. Its purpose is to determine where scarce governance attention should go first.
Healthcare organizations have finite capacity. Clinicians, quality teams, data specialists, cybersecurity staff, legal advisers, IT teams and frontline professionals cannot apply identical review and monitoring intensity to every AI use.
Risk-proportionate governance is therefore necessary.
CHAI's Risk Categorization Tool Version 3, released on 2 September 2026, was developed for healthcare systems and teams conducting pre-deployment risk review. Version 3 currently emphasizes the domains of Life & Patient Safety and Technology & Data and is intended to guide deeper assessment, mitigation and monitoring [7]. It is an international governance tool, not the Vietnamese statutory AI classification framework.
At portfolio level, organizational priority may increase with clinical consequence, action authority, patient exposure, scale, data sensitivity, uncertainty, affected populations, irreversibility, difficulty detecting failure and third-party dependence.
The key question is not “Which AI is most sophisticated?” It is “Where would weak governance matter most?”
Standardize controls that should be common
One of the major benefits of portfolio governance is reducing unnecessary variation.
If every department creates its own AI intake form, risk terminology, vendor questionnaire, approval record and incident process, governance becomes inconsistent and expensive.
Healthcare organizations should therefore standardize controls that reasonably apply across AI uses. These may include organization-wide AI policy, intake requirements, common definitions, minimum evidence expectations, decision-authority rules, documentation requirements, baseline privacy and cybersecurity expectations, change-control triggers, incident-reporting pathways, AI inventory fields and minimum lifecycle records.
Joint Commission's RUAIH Health Care System pathway provides a useful international reference: where AI activities are centrally governed across multiple healthcare organizations, participating organizations are expected to follow the same governance, processes and policies for AI use [5].
That does not mean every site must use AI identically. It means the organization should identify which governance rules should not change merely because the technology is being used at another facility.
Standardization should not eliminate local validation and adaptation
Central governance can also go too far.
A healthcare group may decide that because an AI system has passed central review, every hospital or clinic can implement it in exactly the same way. That assumption can create new risk.
Sites may differ in patient populations, workflows, equipment, staffing, digital maturity, referral patterns, coding practices, data quality, specialist availability and downstream capacity. Central approval that a system is eligible for deployment does not prove that it will perform safely or fit operationally at every site.
Portfolio governance should therefore distinguish common governance controls from local implementation evidence.
Central governance may standardize policy, vendor due diligence, contractual expectations, risk methodology, minimum monitoring requirements and incident processes. Local implementation may still need to assess workflow fit, population relevance, data availability, human oversight, training, fallback arrangements and site-specific validation.
A useful principle is:
centralize what should be common; localize what must fit the care environment.
Every material deployed use should have clear ownership
A portfolio becomes difficult to govern when systems have departments but no accountable owners.
For each material AI use, the organization should know who owns the clinical or operational use case, who owns technical operation, who owns monitoring and who coordinates with the vendor or AI provider. These responsibilities may legitimately sit with different people.
The department benefiting from AI should not assume that IT owns all risk simply because IT maintains integration. Likewise, the technology team should not be expected to decide whether a change in clinical performance remains acceptable.
Clear ownership also helps identify orphaned AI: systems that remain active even though nobody clearly owns their continued justification, performance or governance obligations.
An active AI use without clear ownership should itself be treated as a governance concern.
Portfolio governance needs to see aggregate workload
A system may pass its own workflow assessment and still contribute to an unsafe overall environment.
Imagine five clinical AI tools, each producing a manageable number of alerts. If all five send notifications to the same nurses, the combined alert burden may become unacceptable.
The same applies to human verification. An ambient scribe may require small amounts of correction, a generative discharge tool may require additional checking and an AI inbox assistant may require verification. Individually, each burden may appear modest. Together, they can shift substantial cognitive and documentation work back onto clinicians.
Portfolio governance should therefore examine aggregate human-factor exposure, not only system-level usability. Relevant signals may include combined alert volume, verification burden, workflow interruptions, duplicated work, additional handoffs, staff complaints, automation dependence and cumulative training requirements.
This is a healthcare quality and patient-safety issue, not simply a workforce-efficiency issue.
Look for conflicting AI outputs across the portfolio
As AI adoption increases, healthcare professionals may encounter more than one AI system influencing the same decision or workflow.
An imaging system may prioritize a study while another prediction system classifies the patient differently. A generative clinical assistant may produce advice inconsistent with a specialty decision-support tool. Two models may use different definitions of risk.
Each system may be individually defensible while the combined workflow remains confusing.
Portfolio governance should therefore identify overlapping decision domains and ask whether multiple AI systems can provide inconsistent or competing signals to the same users.
Where overlap exists, the organization may need to define which source, professional role or workflow should govern the decision in that context, how conflicting AI outputs are handled, and when human escalation is required.
This problem may not appear during single-system validation because it is created by interactions within the portfolio.
Duplicate capability can create unnecessary governance burden
AI adoption can easily produce duplication.
Different departments may purchase tools performing substantially the same function. Multiple generative AI platforms may be used across the organization. Several products may provide overlapping documentation or analytics capabilities.
Duplication is not automatically inappropriate. Different specialties may genuinely need different systems. Unnecessary duplication, however, creates additional procurement, training, cybersecurity, privacy, monitoring, incident-response and vendor-management burden.
Portfolio governance should therefore ask whether a new AI capability fills a genuine gap, replaces an existing system or simply adds another technology the organization will need to govern indefinitely.
A safe AI system can still be an unnecessary AI system.
Safe does not necessarily mean valuable
Portfolio governance introduces a discipline that individual safety review cannot fully provide: periodic reconsideration of value.
A system may remain technically reliable and clinically safe while producing little meaningful benefit. It may save only modest time, have low adoption for legitimate reasons, duplicate another capability or demand disproportionate monitoring effort.
Healthcare organizations should therefore periodically reconsider whether continued AI use remains justified.
Relevant questions include whether intended outcomes have been achieved, whether hidden workload has emerged, whether benefits remain after implementation support ends, whether another capability now serves the same need more effectively and whether governance burden remains proportionate to benefit.
This does not mean healthcare technology should be judged only by financial return. Value may include patient safety, clinical quality, access, staff experience, equity, operational resilience and organizational learning.
The point is simply that continued deployment should have a reason.
Portfolio governance should identify concentration risk
One of the most important portfolio-level risks may be invisible in individual product reviews.
Several apparently different AI systems may depend on the same foundation model, cloud platform or external API, while one vendor may become embedded across several clinical and administrative workflows. Each individual system may have an acceptable fallback plan, but a shared dependency can still create much larger organizational exposure.
Portfolio governance should therefore map significant shared dependencies, including important vendors, foundation models, cloud services, APIs, subprocessors and common data infrastructure.
The goal is not necessarily to eliminate concentration. That may be impossible or undesirable. The organization should instead understand where concentration exists, what happens if a shared service changes or becomes unavailable, what alternatives or fallback arrangements exist and whether dependency has become inconsistent with organizational resilience.
CHAI's Governance Playbooks include Third Party Management as a core domain precisely because responsible AI use extends beyond the visible application itself [6].
Shared foundation models deserve particular attention
Generative AI creates a specific portfolio challenge.
Several clinical or administrative applications may appear to be different products while relying on the same underlying foundation model. A change to that model may therefore affect several downstream applications at once, while the healthcare organization may have little direct control over that update.
Portfolio governance should ask whether different tools share an upstream model, whether important model changes are communicated, whether the vendor performs appropriate revalidation, whether local monitoring can detect changes and whether several downstream systems might deteriorate simultaneously.
This does not require complete transparency into every proprietary model. It requires enough dependency visibility to understand potential common-mode failure, situations in which one upstream change or failure affects several downstream AI applications at the same time.
Data flows should be considered across the portfolio
Individual AI reviews often examine whether a vendor receives personal data and whether relevant safeguards are in place. Portfolio governance should also examine the combined ecosystem.
How many external environments receive patient information? Are the same datasets exported repeatedly to different vendors? Are AI-derived outputs being written back into clinical records? Are local performance data shared externally? Are multiple tools creating overlapping repositories?
A system-by-system review may conclude that each arrangement is acceptable while the combined data architecture becomes unnecessarily complex. That complexity can itself create risk.
Viet Nam's Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/NĐ-CP have both been effective since 1 January 2026 [9,10]. Portfolio-level visibility does not replace processing-specific compliance with that framework or other applicable legal requirements.
Portfolio governance should instead connect with organizational data governance and cybersecurity so that the organization can understand aggregate external data exposure and architectural complexity, not merely individual contractual arrangements.
Monitoring should be standardized at the framework level, not the metric level
Important AI systems require appropriate post-deployment monitoring, but they do not all need the same indicators or review frequency.
A deterioration model may require monitoring of sensitivity, alert response and clinical outcomes. An ambient scribe may require documentation-accuracy and correction-burden measures. Administrative AI may require process-error and efficiency indicators.
Portfolio governance should therefore standardize how monitoring is governed without imposing identical metrics on unrelated technologies.
Common requirements might include a documented monitoring owner, defined indicators, review frequency proportionate to risk, escalation criteria, change triggers, evidence of review and a decision process for unacceptable performance.
Joint Commission RUAIH expects organizations to monitor and evaluate the safe and effective performance of AI throughout the lifecycle [5]. CHAI likewise includes Responsible AI Lifecycle Management and Use in its Governance Playbooks [6].
At portfolio level, an important question is therefore: Are all systems that require monitoring actually being monitored?
That is different from asking whether a monitoring policy exists.
Monitor governance completion as well as model performance
A useful portfolio view should make overdue governance obligations visible.
Systems may have missed scheduled performance reviews, incomplete local validation, outdated vendor documentation, unresolved corrective actions, material updates awaiting change review, staff groups requiring retraining or temporary approvals approaching expiry.
A portfolio can appear clinically stable while a governance backlog accumulates behind the scenes. That backlog matters because unresolved governance obligations can eventually become patient-safety, regulatory or operational problems.
Portfolio governance should therefore track not only AI performance but also whether the organization is actually completing the controls it said it would perform.
Change control becomes more difficult at portfolio scale
One vendor update may affect one AI system. A platform update may affect twenty use cases.
Portfolio governance therefore needs to understand the blast radius of change.
The AI inventory should connect important system versions and upstream dependencies with use cases, departments and deployment sites. When a material change occurs, governance teams can then identify what may require revalidation, additional monitoring, retraining or local review.
For high-risk AI, significant change also has a regulatory dimension. Under Decree No. 142/2026/NĐ-CP, the provider must reassess conformity where a significant change affects the basis or results of the previous conformity assessment. Depending on the change, this can involve key functions or intended use, system architecture or model, important data sources or processing methods, integration or operating environment [2].
Separately, where a deployer modifies, integrates or changes system functions or purpose of use in a way that creates new or higher risk, coordination with the provider concerning classification may be required under the AI framework [1,2].
Portfolio governance does not decide these statutory questions. Its role is to help the organization recognize which deployed uses may be affected when a common technology changes.
A safety signal in one system may matter elsewhere
Single-system incident management asks what happened with one AI system. Portfolio governance asks an additional question: where else might this lesson apply?
A documentation hallucination identified in one department may be relevant to another application using the same underlying model. A vendor outage may reveal a shared dependency. An unsafe workflow identified at one hospital may also exist at another site. A subgroup performance concern may justify examining related AI uses.
Safety learning should therefore propagate across the portfolio when appropriate. Without portfolio-level learning, departments may repeatedly discover the same problem independently.
Multi-site organizations need common governance and visible local variation
Healthcare groups face a recurring tension: standardization improves consistency, but healthcare delivery remains local.
Portfolio governance should therefore record both central controls and site-specific conditions.
A centrally approved AI system may still operate through different interfaces, patient populations, staffing arrangements or workflows across facilities. One site may have completed local validation while another has not. One site may have specialist capacity to respond quickly to AI alerts while another does not.
Common governance should establish minimum requirements every site must meet. Local governance should make relevant variation visible rather than hiding it behind one enterprise approval.
A strong multi-site model does not pretend every site is identical. It ensures that important differences are known, assessed and managed within a common governance architecture.
Restricted and suspended systems should remain visible
Once an AI system is paused, it should not disappear from the portfolio.
Restricted or suspended AI remains part of the organization's governance history. It may still contain data, remain technically installed, require contractual management or eventually be reconsidered.
The portfolio record should preserve why use was restricted or suspended, what conditions would be required for restart, whether the underlying issue was clinical, technical, organizational or contractual, and whether the lesson may apply to other systems.
A portfolio containing only successful active deployments tells an incomplete story.
Retirement should be governed, not forgotten
AI systems eventually reach the end of useful life.
A vendor may discontinue support. A model may become obsolete. Another system may replace it. Evidence may no longer support continued use. Changes in data or integration may make performance unreliable.
Retirement therefore requires governance.
The organization should determine when the system stops influencing care, how users are informed, what happens to integrations and data, whether records must be retained, whether access is removed, whether contractual obligations continue and which lessons should be preserved.
Portfolio governance should distinguish retired from merely inactive. An abandoned AI capability that remains technically accessible can later become shadow AI.
Portfolio governance should manage governance capacity as a scarce resource
Governance itself has capacity limits.
An organization may have enough expertise to conduct high-quality review and monitoring of ten AI systems but not fifty. If adoption grows faster than governance capacity, review becomes superficial, monitoring is delayed and unresolved actions accumulate.
CHAI explicitly includes Organizational Resources as a core Governance Playbook domain [6].
Portfolio governance should therefore track governance demand as well as AI systems. Useful signals may include intake volume, review cycle time, review backlog, number of systems per monitoring owner, unresolved actions, upcoming revalidations, training workload and missing expertise.
This does not mean an organization should stop adopting AI whenever governance teams become busy. It means governance capacity is part of safe implementation capacity.
Prioritization should change when governance capacity is constrained
When resources are limited, every AI request should not necessarily be processed strictly on a first-come, first-served basis.
Higher-consequence, time-sensitive or organization-critical systems may warrant earlier governance attention. Lower-impact proposals may appropriately move through streamlined pathways, while clearly duplicative proposals can sometimes be deferred until existing capabilities are better understood.
This is risk-based resource allocation.
Portfolio governance allows the organization to decide deliberately where clinical, quality, technical and legal expertise should be concentrated rather than allowing project timing or vendor pressure to determine priority.
Portfolio governance can identify opportunities for shared controls
Multiple AI systems often require the same underlying governance capability.
Rather than recreating processes repeatedly, organizations may establish shared services or controls for AI intake, vendor due diligence, privacy assessment, security review, model-card collection, local-validation support, incident reporting, monitoring infrastructure, staff education and governance documentation.
This reduces duplication and can improve consistency.
Standardization is especially valuable where several sites or departments repeatedly need the same governance functions. The goal is not to centralize every decision; it is to avoid solving the same governance problem from the beginning every time another AI system enters the organization.
Portfolio governance should support rationalization
As the portfolio grows, organizations should periodically ask whether its composition still makes sense.
There may be too many tools serving the same workflow, several vendors providing substantially overlapping functionality, systems that are no longer aligned with organizational needs or technologies whose expected benefits have never materialized.
Standardizing on fewer platforms may reduce complexity, training burden, interfaces, monitoring requirements and vendor relationships. Decommissioning low-value AI may free governance capacity for more consequential uses.
But consolidation can also increase vendor and infrastructure concentration. Portfolio governance should therefore consider both benefits and risks rather than assuming that either more tools or fewer tools is inherently better.
Leadership needs portfolio assurance, but should not manage the portfolio directly
Executive and governing-body oversight should receive an appropriate summary of portfolio exposure, major risks, outcomes, dependencies, resource constraints and material decisions.
Leadership should not need to approve every portfolio adjustment. Operational governance teams should retain authority within defined limits to prioritize reviews, standardize common controls, manage routine monitoring and recommend rationalization.
Material issues should escalate when they exceed delegated authority, create substantial patient-safety or organizational exposure, require major investment, involve significant unresolved risk or affect strategic direction.
This keeps portfolio governance connected to leadership without turning senior executives into AI program managers.
A practical Healthcare AI Portfolio Governance Framework
Healthcare organizations in Viet Nam can structure portfolio governance around the following cycle:
make AI visible → segment the portfolio → prioritize governance attention → standardize common controls → preserve necessary local adaptation → monitor individual and aggregate risk → identify shared dependencies and workload → allocate governance resources → evaluate value → rationalize, restrict, scale or retire → learn across the portfolio
Make AI visible means maintaining a reliable view of proposed, reviewed, piloted, deployed, restricted, suspended and retired AI uses. Segment the portfolio means grouping systems according to material governance characteristics rather than treating every technology identically. Prioritize governance attention means focusing scarce expertise where weak governance could have the greatest consequences.
Standardize common controls means creating organization-wide policy, intake, review, documentation, change-control and safety pathways that do not need to be reinvented by every department. Preserve necessary local adaptation means recognizing differences in patient populations, workflows, data, staffing and site capabilities.
Monitor individual and aggregate risk means looking both at each AI system and at portfolio-level effects such as alert burden, duplicated work, common dependencies and cumulative data exposure. Identify shared dependencies and workload means understanding where multiple AI systems depend on the same vendor, model, cloud service, workforce or operational pathway.
Allocate governance resources means matching review, monitoring and assurance capacity to organizational exposure. Evaluate value means determining whether systems continue to produce outcomes that justify their risks, workload and governance burden. Rationalize, restrict, scale or retire means making deliberate lifecycle decisions rather than assuming deployed AI should remain indefinitely.
Learn across the portfolio means allowing incidents, evaluation findings, vendor experience and implementation lessons from one AI use to improve governance of others.
This Healthcare AI Portfolio Governance Framework is proposed here as a practical organizational approach. It is not a statutory Vietnamese AI framework, a Joint Commission standard, a CHAI portfolio-governance model or a substitute for system-specific legal, clinical or technical assessment.
A practical Portfolio Governance Dashboard
Organizations do not need an elaborate technology platform before portfolio governance can begin. A smaller healthcare organization may manage a limited portfolio using a structured register and periodic governance review, while a large multi-site system may require dedicated governance tooling.
Whatever technology is used, a useful portfolio view should allow the organization to answer several questions quickly: how many material AI uses exist and where they sit in the lifecycle; which have greater clinical or organizational consequence; which reviews, validations or monitoring activities are overdue; where material safety signals remain unresolved; which systems have undergone important changes; which vendors or infrastructure services create concentration exposure; where governance resources are constrained; which tools overlap; which systems have not demonstrated expected value; and which require scaling, remediation, restriction or retirement.
The purpose is not to create a dashboard because dashboards look mature. It is to create decision visibility. A portfolio dashboard containing large amounts of information but not influencing organizational decisions adds little governance value.
Existing Vietnamese quality-management structures should remain part of the foundation
Portfolio governance should not become an AI bureaucracy separated from healthcare quality.
Circular No. 19/2013/TT-BYT remains recorded as in force and establishes a hospital quality-management framework involving organizational responsibility, quality indicators, use of data and continuous improvement [4].
As AI becomes embedded across clinical and operational workflows, portfolio findings should therefore connect with existing quality-management structures.
If several AI systems create excessive alert burden, that is a quality and human-factors issue. If multiple systems repeatedly generate documentation corrections, the pattern may matter to medical-record quality. If AI performance differs materially across sites, that finding should enter organizational quality improvement rather than remain isolated within an AI governance function.
Portfolio governance is strongest when AI becomes visible inside routine healthcare quality, patient safety and organizational improvement.
What healthcare organizations in Viet Nam should avoid
One failure mode is inventory without governance, where an organization knows which AI systems exist but does not use that knowledge to prioritize action. Another is standardization without local context, where central approval is treated as evidence that every site can implement the system identically. The opposite failure is local autonomy without common controls, where different departments or hospitals independently define their own policies, evidence requirements and safety processes.
Organizations should also avoid system-by-system tunnel vision, where every individual AI product passes review while aggregate workload, duplicated capability or concentration risk becomes unacceptable. Permanent pilots can leave technology in loosely governed evaluation states for extended periods, while an accumulating governance backlog can cause reviews and corrective actions to fall behind adoption. Uncontrolled portfolio growth can also occur when new systems are continually added while low-value technologies are rarely reconsidered or retired.
The goal of portfolio governance is not to maximize the number of AI systems an organization can manage. It is to ensure that the organization can govern the AI it chooses to use well.
What this means for healthcare organizations in Viet Nam
As healthcare organizations move from isolated AI projects toward broader adoption, the governance question changes.
The challenge is no longer only whether one AI system has enough evidence, whether one vendor meets contractual requirements or whether one pilot is ready to scale. The organization increasingly needs to understand the interactions among many individually approved decisions.
Which systems affect the same clinicians? Which depend on the same vendor or upstream service? Which duplicate one another? Which generate the most safety signals? Which require substantial human review? Which have not demonstrated value? Which controls can be standardized? Which sites require additional adaptation? Where should scarce governance resources go?
These are health-system questions, but they are also healthcare quality and patient-safety questions.
The practical transition is:
from governing individual AI tools → to seeing the whole AI portfolio → to standardizing what should be common → to preserving what must remain local → to managing aggregate risk, value and governance capacity across the lifecycle
Responsible healthcare AI at scale is not achieved simply by repeating good single-system governance many times.
Once AI becomes widespread, the interactions among systems, and the portfolio they collectively create, become governance objects in their own right.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, cybersecurity, data-protection, procurement, medical-device, accreditation or quality-management advice.
The term healthcare AI portfolio governance is used in this article as an organizational governance concept. It is not a statutory classification or formal governance mechanism prescribed by Vietnamese AI law.
The Healthcare AI Portfolio Governance Framework and portfolio dashboard concepts proposed here are practical organizational approaches developed for this article. They are not official frameworks of the Vietnamese Government, Ministry of Health, Joint Commission or CHAI.
Joint Commission RUAIH, CHAI Governance Playbooks, CHAI Risk Categorization Tool and CHAI AI Intake Playbook are used as international organizational reference points. Joint Commission RUAIH is currently a voluntary U.S. certification program. CHAI's Risk Categorization Tool is not the statutory AI risk-classification framework under Vietnamese law, and the October 2026 AI Intake Playbook remains a draft framework undergoing pilot testing.
Portfolio-level prioritization, standardization or rationalization does not remove system-specific responsibilities. Applicable requirements concerning statutory AI classification, high-risk AI, conformity assessment, significant changes, personal-data protection, medical-device regulation, professional responsibility and other obligations must still be assessed for each relevant system and deployment context.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
Ministry of Health of Viet Nam. Circular No. 19/2013/TT-BYT Providing Guidance on Management of Quality of Medical Examination and Treatment Services in Hospitals. Issued 12 July 2013; effective 15 September 2013; currently recorded as in force.
Joint Commission. Responsible Use of AI in Healthcare Certification. Launched 1 June 2026.
Coalition for Health AI. AI Governance Playbooks. Released 27 May 2026.
Coalition for Health AI. Risk Categorization Tool, Version 3. Released 2 September 2026.
Coalition for Health AI. AI Intake Playbook and AI Intake Controls and Evidence Workbook. Released as a draft framework on 1 October 2026; pilot phase underway.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.