How Should Healthcare Organizations Govern AI in Practice? Building an AI Governance Operating Model in Viet Nam
PRACTICAL FRAMEWORKS & TOOLS
How Should Healthcare Organizations Govern AI in Practice? Building an AI Governance Operating Model in Viet Nam
GOVERNANCE & RESPONSIBLE ADOPTION
Last reviewed: 1 October 2026
A hospital can adopt artificial intelligence without ever making a deliberate decision to become an “AI organization.” One department may purchase an imaging tool, another may test a clinical documentation assistant, a laboratory system may introduce an AI-enabled function through a software update, and staff may begin using generative AI for administrative work. A vendor may also add a new AI function to a platform the organization already uses.
Over time, the organization can find itself operating several AI systems without one place that can answer basic questions: What AI do we currently use? What is each system allowed to do? Who approved it? What evidence supported that decision? Who is responsible for its use? What happens when the model or workflow changes? Who can restrict or stop it if a safety concern emerges?
That is why AI governance should not begin with the question, “Should we create an AI committee?” It should begin with a more practical question: How will this organization make consistent, accountable decisions about AI throughout its lifecycle?
Viet Nam’s regulatory environment now makes that question increasingly important. The Law on Artificial Intelligence No. 134/2025/QH15 has been effective since 1 March 2026, Decree No. 142/2026/NĐ-CP since 1 May 2026, and Decision No. 33/2026/QĐ-TTg establishing the list of high-risk AI systems since 15 August 2026.[1–3] The AI Law expressly identifies healthcare as an essential field requiring tighter risk management and specifically calls for patient safety, reliability under real-world conditions and protection of health data in accordance with law.[1]
For healthcare organizations, AI governance is therefore no longer only a discussion about ethics or innovation. It increasingly intersects with clinical governance, patient safety, technology management, data protection, cybersecurity, medical device regulation, procurement and organizational accountability.
AI governance is not the same as having an AI committee
An AI committee can be useful, but a committee alone is not a governance system. A hospital may create a multidisciplinary committee and still have weak governance if nobody knows which AI systems must come before it, what information must be submitted, which decisions it is authorized to make, how those decisions are documented or what happens after approval.
An AI governance operating model is broader. It is the combination of roles, decision rights, processes, records, controls, monitoring and escalation mechanisms through which an organization decides whether and how AI may be selected, evaluated, piloted, deployed, changed, expanded, suspended and eventually retired.
The practical test is straightforward. If a department proposes a new clinical AI system tomorrow, can the organization explain who receives the proposal, what information is required, how risk is reviewed, who decides whether a pilot may proceed and what conditions must be met before routine clinical use? If a serious safety signal appears six months later, does somebody have clear authority to restrict or suspend the system? If those questions cannot be answered consistently, the organization has an AI governance gap even if an AI committee exists.
Viet Nam’s AI framework gives healthcare organizations responsibilities of their own
Under the AI Law, a healthcare organization that uses an AI system within its control for professional or service activities may act as a deployer, depending on the circumstances. Clinicians and other personnel who directly interact with the system or use its outputs may also have roles as users. This distinction matters because Viet Nam’s AI framework distributes responsibilities across providers, deployers and other relevant actors rather than treating the technology provider as solely responsible.[1]
For high-risk AI systems, the legal framework places specific responsibilities on deployers relating to appropriate operation, monitoring, risk management, safety, security, human oversight, incident management and cooperation with providers and competent authorities.[1,2] Decree No. 142/2026/NĐ-CP further requires risk management during deployment and operation to reflect the intended purpose, deployment scope, risk level and relevant technical instructions.
The practical implication is important: a hospital cannot assume that AI governance has already been completed by the vendor. Regulatory compliance by a provider and responsible deployment by a healthcare organization are connected, but they are not the same task.
Healthcare requires careful AI risk management, but not every healthcare AI system is legally “high-risk”
Viet Nam’s AI Law requires AI risk management to reflect the field in which a system is used and provides for tighter management in essential fields that directly affect life, health, lawful rights and interests, or public order and safety. In healthcare, the Law specifically refers to patient safety, reliability under real-world conditions and protection of health data.[1]
This should not, however, be interpreted to mean that every AI system used in healthcare is automatically classified as a high-risk AI system under Vietnamese law.
As of 1 October 2026, Decision No. 33/2026/QĐ-TTg establishes a specific national list of high-risk AI systems. The healthcare section of the current list is considerably narrower than “all clinical AI” and identifies specified AI systems supporting surgery or robotic surgery when the stated conditions are met.[3] Diagnostic algorithms, clinical decision-support systems, generative AI tools and administrative AI should therefore not be described as legally high-risk merely because they are used in healthcare. Their regulatory status must be determined from the applicable legal framework and the characteristics of the particular system and use case.
Healthcare organizations consequently need to answer two related but different questions: What is the system’s legal risk classification? and What level of internal governance review and oversight is appropriate for this use case? The second is an organizational governance and patient-safety decision and should not be confused with statutory risk classification.
Governance should begin with knowing what AI the organization actually uses
It is difficult to govern technology that an organization cannot see. One of the most useful starting points is therefore an organizational AI inventory or register.
An AI register is a practical governance tool, not a universal statutory requirement that every healthcare organization must maintain for every AI use. Its value is that it gives leadership a reliable picture of where AI is being used and who is responsible for it. Depending on the organization, the register may record the system and provider, relevant version, intended purpose, clinical or operational setting, responsible department, organizational owner, main users, data involved, regulatory status, statutory risk classification where applicable, approval status, monitoring arrangements and current stage of deployment.
The inventory should not be limited to products prominently marketed as “AI.” Artificial intelligence may be embedded in imaging equipment, laboratory platforms, clinical decision-support systems, electronic medical records, patient-engagement tools or enterprise software. An existing product may also acquire a new AI capability through an update without the hospital purchasing an entirely new system.
Healthcare organizations should also consider shadow AI: AI used by staff without passing through formal procurement or technology approval. Generative AI makes this particularly relevant. A clinician, administrator or manager may use a publicly available AI service for drafting, summarization, translation, research support or documentation before the organization has established rules for what information may be entered, which uses are acceptable or how outputs should be verified.
The better question is therefore not simply, “What AI products have we bought?” It is: “Where is AI influencing decisions, workflows, documentation, prioritization, communication or patient care in our organization?”
Every deployed AI system should have clear organizational ownership
AI governance tends to weaken when many teams are involved but nobody clearly owns the system. IT may manage integration, procurement may manage the contract, a clinical department may use the tool, quality management may review incidents, data-protection or legal personnel may advise on compliance, cybersecurity teams may assess technical risk, and the vendor may monitor parts of system performance.
All of those roles may be necessary, but they do not by themselves answer the question: Who inside the healthcare organization is responsible for ensuring that the AI continues to be used for its approved purpose and under appropriate controls?
A deployed clinical AI system should therefore have a named organizational owner or accountable service line. For clinically consequential AI, meaningful clinical ownership will usually be important rather than relying entirely on technical ownership. The owner does not need to understand every model parameter or personally manage every control. The role is to make sure that the system has an approved purpose, appropriate users, agreed safeguards, monitoring arrangements, escalation pathways and periodic review.
Ownership should also survive the pilot phase. The individual who led an initial six-month project may not necessarily be the right person to oversee the technology during years of routine clinical use.
New AI use cases need a defined entry point
Healthcare organizations do not need a complicated bureaucracy for every AI-enabled function, but they do need a reliable front door.
Before a new clinical AI system is purchased, piloted or integrated into routine care, the organization should capture enough information to understand what is actually being proposed. This normally includes the healthcare problem being addressed, intended users and patient population, role of the AI in the workflow, expected benefit, available alternatives, supporting evidence, regulatory status, data requirements, technical integration, cybersecurity implications, human oversight and foreseeable failure modes.
This intake stage can prevent one of the most common problems in healthcare technology adoption: beginning with the product instead of the healthcare problem. “Radiology wants to pilot Vendor X’s AI” tells a governance team very little. A stronger proposal explains that the organization is trying to reduce delayed recognition of a particular imaging finding in a defined patient population, describes where the AI output will enter the clinical workflow, identifies who remains responsible for interpretation, and defines what meaningful benefit and unacceptable risk would look like.
The purpose of an intake process is not to slow innovation. It is to ensure that the organization understands the problem, intended use and expected value before becoming committed to a technology.
Legal risk classification should be separated from internal governance review
Viet Nam’s statutory risk-classification framework determines legal categories and related obligations. Healthcare organizations should identify and respect the applicable classification and regulatory requirements, including circumstances in which modifications, integration, changes in function or other material changes may require reassessment or coordination with the provider.[1,2]
Internal governance should nevertheless go further than asking whether a system appears on the current high-risk list. A system that is not legally classified as high-risk may still justify substantial clinical oversight. An AI tool that prioritizes urgent imaging examinations, generates medication-related information or creates draft clinical documentation could create meaningful patient-safety consequences even when its statutory classification is different.
Relevant organizational considerations may include the severity of potential harm, degree of automation, clinical consequences of error, ability of clinicians to detect an incorrect output, number of patients exposed, vulnerability of the population, reversibility of a decision and availability of a safe fallback.
For this reason, a healthcare organization may adopt an internal governance review level that determines how much organizational scrutiny an AI use case receives. A low-impact administrative application might remain within ordinary technology governance, while an AI system influencing diagnosis or treatment might require clinical, quality, technical, data and safety review.
This internal review level should be clearly distinguished from statutory risk classification under Vietnamese law. It is a governance mechanism for determining the depth of organizational oversight; it does not replace, modify or reinterpret the legal classification of the AI system.
Decision rights should be clear across the AI lifecycle
One of the clearest signs of mature AI governance is that important decisions have named decision-makers. Who can authorize a pilot? Who determines whether evidence is sufficient for routine clinical use? Who can approve a material change in intended use? Who decides whether a system can expand from one department to several facilities? Who can impose additional safeguards? Who can restrict or temporarily suspend an AI system when a safety concern emerges? Who decides that the technology should be retired?
Those decisions do not necessarily belong to the same person or committee. Routine, low-impact AI may remain within existing departmental or technology governance. AI that materially influences clinical decisions may require multidisciplinary clinical and patient-safety review. Systems with greater potential consequences may require approval at a higher level of organizational leadership.
The objective should be proportionate governance. Oversight should become stronger as the potential consequences increase, rather than applying the same approval process to every AI use. One principle, however, should remain consistent: the organization should know who can say yes, who can impose conditions and who can say stop.
Multidisciplinary governance does not require building a new bureaucracy
Clinical AI crosses organizational boundaries, and no single department can evaluate all of its implications. Clinical leaders understand the care pathway and consequences of an incorrect output. Quality and patient-safety teams understand risk controls, incidents and improvement systems. IT understands integration and operational reliability. Data-protection and legal personnel understand information flows and regulatory obligations. Cybersecurity teams understand vulnerabilities and resilience. Procurement teams understand provider commitments and contracting. Frontline users understand how the technology actually changes work.
Depending on the use case, other perspectives may also matter. Patient or public input can be particularly valuable for patient-facing or high-impact AI where communication, usability, equity, autonomy or trust may materially affect implementation.
AI governance therefore needs multidisciplinary input, but that does not mean every hospital needs to create a large new “AI Department.” Many healthcare organizations in Viet Nam can build AI governance on structures they already have, including quality and patient safety, medical governance, information technology, digital transformation, data protection, cybersecurity, ethics, procurement and senior management.
A smaller organization may use a compact review group that convenes when a material AI decision arises. A large hospital system with multiple AI applications may eventually need a standing governance body supported by specialized expertise. The organizational chart matters less than whether the right expertise enters the decision at the right time.
Human oversight must be designed, not assumed
Viet Nam’s AI framework follows a human-centered approach. The AI Law states that AI serves people rather than replacing human authority and responsibility and requires human control and the ability to intervene in AI decisions and actions.[1] More specific obligations relating to oversight and intervention apply in relevant higher-risk contexts under the Law and Decree No. 142.[1,2]
In healthcare, however, writing “a doctor makes the final decision” into a policy does not automatically create meaningful human oversight. A clinician must have sufficient information, authority, time and practical ability to question the AI. The workflow should make it possible to disregard or override an output when appropriate. Users need to understand the system’s intended purpose, limitations and circumstances in which reliance on its output may be unsafe.
Consider a clinician who technically retains final authority but receives hundreds of AI-generated outputs each day, has limited information about the system’s limitations and works in an environment where accepting the AI recommendation has become the operational norm. A human remains in the workflow, but the quality of oversight may be weak.
Governance therefore needs to examine the human–AI system, not simply verify that a human appears somewhere between the algorithm and the final decision. Meaningful oversight depends on workflow design, competency, information, authority and organizational culture.
AI governance must connect with data protection, cybersecurity and medical device governance
Clinical AI rarely sits within one legal or regulatory framework. Where an AI system processes personal data, Viet Nam’s Law on Personal Data Protection No. 91/2025/QH15 and related requirements may apply.[4] Depending on the architecture and deployment environment, cybersecurity obligations may also arise under the Law on Cybersecurity No. 116/2025/QH15, which has been effective since 1 July 2026, together with its implementing framework, including Decree No. 331/2026/NĐ-CP on cybersecurity protection for information systems and Decree No. 333/2026/NĐ-CP detailing a number of provisions and implementation measures under the Cybersecurity Law.[5–7]
Certain software or AI functions may also fall within Viet Nam’s medical device regulatory framework depending on their intended purpose, characteristics and applicable rules.[8] The fact that software contains AI does not by itself determine whether it is regulated as a medical device; the intended medical purpose and applicable regulatory framework remain important.
These issues should not become disconnected approval exercises. A coordinated clinical AI review should be capable of asking: What data enters the system? Where is it processed? Who can access it? Does the provider use the data for additional purposes? What happens when the service is unavailable? Is the software subject to medical device regulation? What evidence and regulatory documentation apply? What cybersecurity controls and contingency arrangements are necessary?
An AI approval should not unintentionally become permission for a new data flow, clinical use or technical integration that nobody has actually evaluated.
Vendor governance continues after procurement
Healthcare organizations often depend heavily on providers for model development, technical documentation, software updates, support and investigation of incidents. That dependency makes vendor governance part of the AI governance operating model.
Before implementation, the organization should understand what the provider can disclose about intended use, limitations, performance, data requirements, software versions and material changes. It should know how safety concerns will be communicated and what technical information may be available if an incident requires investigation.
After deployment, the relationship becomes even more important. Who informs the hospital when an algorithm changes? Can a provider change the model without prior notification? Which changes require additional testing or organizational approval? Will performance information and relevant logs be available? How quickly must the provider respond to a significant safety concern? What happens to organizational data when the contract ends?
These questions partly belong in procurement and contracting, but they should be shaped by clinical governance and patient-safety needs. A technically sophisticated vendor does not remove the healthcare organization’s responsibility to decide whether the technology remains appropriate for its own patients, users and workflows.
Change control is central to AI governance
Software has always changed, but AI creates additional governance challenges because performance and risk may be affected by changes in the model, data, integration, workflow, intended population, intended use or clinical environment.
Viet Nam’s AI framework provides for reassessment of classification and related obligations in relevant circumstances, including material changes that may alter risk.[1,2] For healthcare organizations, this means change control should ask more than whether a software update installed correctly.
Has the model changed? Has the intended patient population changed? Is the AI being used for a different clinical purpose? Has the hospital connected it to a different data source? Has a new imaging device changed input characteristics? Has the workflow moved from advisory use toward more automated action? Has the system been introduced at a new facility with different staffing or patient characteristics?
A change that appears minor from an IT perspective may be clinically important. Governance should therefore define which types of change can proceed through routine technical management and which require clinical, regulatory or patient-safety reassessment.
Go-live approval should define conditions, not merely give permission
An AI governance decision does not need to be a simple yes or no. An organization may approve an AI system only for a defined department, patient population, clinical purpose or period of evaluation. Approval may require independent clinician review, specific training, enhanced monitoring during early deployment, a safe fallback procedure, restrictions on automated action or organizational review before major vendor updates are introduced.
These conditions should be documented as part of the approval. This creates a more precise governance question. Instead of asking whether “the AI” is safe, the organization asks whether this version of this system, used for this defined purpose, with this patient population, in this workflow and under these controls, is acceptable at this time.
That is a more useful and defensible basis for implementation.
Monitoring should be designed before go-live
Governance becomes weak when an organization performs extensive evaluation before implementation and then assumes that approval completes the job. AI performance can be affected by changes in patient populations, data sources, clinical practices, equipment or workflows. Provider updates may alter behavior. Users may gradually expand an AI system beyond its approved or intended use. A successful pilot may also create pressure for rapid expansion before sufficient real-world experience has accumulated.
Monitoring should therefore be part of the deployment decision rather than added later. Before go-live, the organization should know what it intends to monitor, who reviews the information, how often review occurs and what level of deviation triggers investigation or escalation.
Measures will depend on the system. They may include clinically relevant performance measures, false-positive or false-negative patterns, subgroup performance, clinician disagreement or overrides, workflow impact, adoption, safety events, downtime, data-quality signals and material provider changes. Not every AI application needs a sophisticated monitoring platform, but every clinically consequential AI system should have a credible way of determining whether continued use remains justified.
The NIST AI Risk Management Framework provides a useful voluntary reference here. Its GOVERN function is designed to inform and operate across MAP, MEASURE and MANAGE, and the framework treats risk management as continuous across the AI lifecycle rather than something completed at deployment.[12] As of 1 October 2026, NIST states that AI RMF 1.0 is being revised, so organizations using it should continue to monitor future updates.
Incident response should already be part of the governance model
When an AI-related safety concern occurs, a healthcare organization should not have to invent its governance structure during the incident. Viet Nam’s AI framework establishes responsibilities for monitoring and managing higher-risk AI and for responding to serious incidents where applicable.[1,2] Organizational governance should also capture safety signals that may not meet a statutory reporting threshold.
A near miss, repeated clinician disagreement, an unexpected output pattern, an unexplained performance change or a cluster of errors may still justify investigation. The governance operating model should therefore define how AI-related concerns enter the organization’s existing quality and patient-safety systems, when clinical and technical review must occur together, when the provider becomes involved and when senior leadership should be informed.
Most importantly, someone must have authority to restrict or suspend an AI system when credible evidence suggests that continued use may expose patients to unacceptable risk. The objective is not to treat every unusual output as a reportable AI incident. It is to make sure that meaningful signals are recognized, investigated and acted upon before they become repeated harm.
Scaling should be another governance decision
Pilot approval is not automatically permission for enterprise-wide deployment. An AI tool may perform well in one department because the patient population is relatively homogeneous, users received intensive implementation support and the workflow was carefully designed. Performance at another site may differ because equipment, staffing, data quality, referral pathways, patient mix or local clinical practices are different.
Moving from one site to five can therefore change risk even when the underlying model has not changed. Before expansion, governance should ask whether the evidence supporting the original approval still applies, what local validation or readiness assessment is necessary, whether new users have adequate training and oversight, whether the technical infrastructure can support wider use, and whether monitoring can still detect important performance or safety problems.
If expansion materially changes the deployment context, integration, purpose or risk characteristics, the organization should also consider whether regulatory reassessment, reclassification, additional conformity assessment or coordination with the provider is required under the applicable legal framework.[1,2]
“Scale” should therefore be a deliberate decision point, not an automatic reward for completing a pilot.
AI also needs a retirement pathway
Governance often focuses heavily on adoption because that is when procurement, budgets and implementation activity are most visible. AI systems, however, can become outdated, unsupported, clinically less useful or inconsistent with changing regulatory and organizational requirements.
A healthcare organization should know how an AI system leaves service. Retirement may require disabling interfaces, withdrawing user access, preserving records where necessary, addressing data held by the provider, transitioning to an alternative workflow and confirming that staff are no longer relying on outputs from an obsolete system.
The trigger may be poor real-world performance, an unacceptable safety concern, changed clinical practice, a new regulatory requirement, a provider ending support, excessive cost or the availability of a better alternative. An AI inventory becomes particularly useful at this stage. Without one, organizations can accumulate “orphaned” AI functions that remain technically available long after formal ownership and oversight have faded.
TCVN ISO/IEC 42001:2025 provides a useful management-system reference
Viet Nam has adopted TCVN ISO/IEC 42001:2025, Information technology – Artificial intelligence – Management system, which is identical to ISO/IEC 42001:2023.[9] The standard specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI management system within an organization.
This makes it relevant to an AI governance operating model because it encourages organizations to move beyond individual projects toward a structured system of policies, responsibilities, risk management, controls, monitoring and continual improvement.
Healthcare organizations should nevertheless distinguish the standard from statutory requirements. TCVN ISO/IEC 42001:2025 is a management-system standard; it does not replace the AI Law, Decree No. 142, personal-data requirements, cybersecurity law, medical device regulation or other applicable healthcare obligations. Responsible AI governance also does not require every healthcare organization to begin by seeking certification.
A hospital can use management-system thinking to strengthen its governance long before deciding whether formal certification provides additional value.
International guidance is also moving toward institutional and lifecycle governance
This challenge is not unique to Viet Nam. In September 2026, WHO/Europe published the Report of the Knowledge Community on Responsible Artificial Intelligence in Health. Participants identified governance gaps, unclear accountability, fragmented or biased datasets and AI-literacy deficits among the barriers to responsible AI adoption, while highlighting strong governance, transparency, codesign with patients and clinicians, appropriate validation and equitable access as important enablers.[10]
The report should be interpreted accurately. WHO/Europe expressly notes that these findings reflect the perspectives of Knowledge Community participants and do not necessarily represent the formal position of WHO. They are nevertheless consistent with the broader direction of WHO’s longstanding work on ethics and governance of AI for health, which emphasizes human autonomy, safety, transparency, accountability, inclusiveness and sustainability.[11]
NIST similarly treats governance as a cross-cutting organizational function that continues across the AI lifecycle rather than a one-time technology review.[12] The International Medical Device Regulators Forum is also developing a Technical Framework for Artificial Intelligence Life Cycle Management for AI-enabled medical technologies. As of 1 October 2026, IMDRF N93 remains a proposed document following a public consultation that closed on 10 July 2026, rather than final IMDRF guidance.[13]
These frameworks differ in purpose, jurisdiction and legal status, but they point toward a common practical lesson: responsible AI requires an organizational system, not a one-time approval.
What a practical AI governance operating model could look like in Viet Nam
A healthcare organization in Viet Nam does not need to begin with an elaborate international governance architecture. It needs a process that works consistently in its own environment.
A practical operating model can begin when a department proposes an AI use case or when the organization identifies an existing AI function already in use. The purpose, intended users, patient population where relevant, expected benefit, role of the AI in the workflow and organizational owner are documented. Clinical, evidence, regulatory, data, cybersecurity and operational questions are screened early enough to identify unsuitable or poorly defined projects before substantial resources are committed.
The system is entered into the organizational AI inventory. Its statutory regulatory status is identified, while an internal governance review level determines how much multidisciplinary oversight the use case needs. Evidence and vendor information are reviewed before pilot or deployment. For clinically consequential AI, the organization defines permitted use, human oversight, user competency, fallback arrangements, monitoring and incident escalation before go-live. Approval records not merely that the AI may be used, but where, for what purpose and under what conditions it may be used.
After implementation, performance and safety are reviewed rather than assumed. Material provider updates, important workflow changes and expansion to new sites trigger change control. Incidents, near misses and other meaningful safety signals connect with the existing quality and patient-safety system. Significant concerns can lead to additional controls, remediation, revalidation, restriction or temporary suspension.
Periodic review should then ask a question that organizations sometimes forget once a technology becomes routine: Does continued use of this AI still provide sufficient value, evidence and safety to justify keeping it in practice? If the answer changes, the organization modifies, limits or retires the system.
That is the difference between managing individual AI projects and building an AI governance operating model.
Governance should be proportionate to the organization and the risk
A large tertiary hospital with multiple AI systems may need a standing governance structure, specialist expertise, defined dashboards and scheduled oversight. A smaller clinic using one or two AI-enabled products may need a much simpler model.
Proportionality matters because governance that is unnecessarily complicated can encourage teams to work around it, while governance that is too weak can allow clinically significant technologies to enter practice without adequate review.
The objective is not to create the largest possible AI governance program. It is to create the smallest reliable governance system capable of controlling the organization’s actual AI risks.
For many healthcare organizations in Viet Nam, a practical starting point may be relatively simple: an AI inventory, a defined intake process, clear ownership, proportionate multidisciplinary review, documented decision authority, monitoring after deployment, change control and a clear incident and escalation pathway. These elements can become more sophisticated as the organization’s AI portfolio and risk exposure grow.
AI governance should connect with existing healthcare quality systems
Healthcare organizations already manage many complex technologies and risks. They have clinical policies, incident reporting, medication-safety systems, infection prevention, medical device management, staff competency processes, risk management, quality indicators, business continuity and internal audit.
AI governance should not become an isolated parallel system. An AI-related near miss can connect with patient-safety reporting. AI performance can become part of quality monitoring. User competency can connect with staff education and competency processes. AI downtime can connect with business continuity. Vendor performance can connect with contract management. Data and cyber risk can connect with existing privacy, information-security and cybersecurity governance.
This integration is particularly important for organizations with limited resources. Responsible AI does not require rebuilding every governance function from zero. It requires making sure that existing functions can recognize and manage the distinctive risks introduced by AI.
The strongest governance model will often be the one that makes AI part of normal organizational accountability rather than treating it as a special technology owned only by innovators or IT teams.
Good governance should make responsible AI easier, not simply slower
AI governance is sometimes seen as a barrier to innovation. Poorly designed governance can certainly become one. A process that requires every low-impact AI use to go through months of review will quickly lose credibility. The opposite approach, however, allowing each department to adopt AI independently until something goes wrong, is not sustainable either.
Good governance creates predictable pathways. Teams know what information they need. Lower-impact proposals can move efficiently. Higher-impact systems receive deeper review. Vendors understand what evidence and documentation the organization expects. Clinicians know where to raise concerns. Leaders know when an issue requires escalation.
Governance then becomes an enabler of responsible implementation because the organization can move with greater confidence. The goal is not to eliminate uncertainty. No governance model can predict every failure or guarantee that an AI system will remain safe indefinitely. The goal is to ensure that uncertainty is recognized, owned, monitored and acted upon.
The central question is how the organization owns its AI decisions
There will probably never be one department that can completely “own AI.” Clinical departments own care delivery, technology teams manage infrastructure, quality teams manage parts of the safety system, data-protection and cybersecurity teams manage specialized risks, vendors control important technical components, and leadership retains organizational accountability.
Trying to place all AI responsibility inside one department can create a false sense of control. A better governance question is: Can the organization reconstruct how and why an important AI decision was made?
Why was this system selected? What problem was it intended to solve? What evidence was reviewed? What was it approved to do? What limitations and risks were recognized? Who was responsible for monitoring it? What happened when the system or workflow changed? What did the organization do when safety signals appeared?
If those answers remain connected throughout the lifecycle, governance is functioning. If they disappear after procurement or pilot approval, the organization is relying on individuals, institutional memory and vendor goodwill rather than a governance system.
From AI projects to organizational capability
Healthcare organizations in Viet Nam are likely to encounter more AI, not less. Some systems will arrive as standalone clinical products. Others will be embedded quietly into the devices, software and platforms that hospitals already use. Still others may enter through staff use before the organization has formally decided to adopt them.
The sustainable response is therefore not to create a new governance process every time a new technology appears. It is to build an organizational capability that can repeatedly select, evaluate, govern, implement, monitor, change, scale and retire AI responsibly.
Viet Nam’s AI Law and Decree No. 142 now provide a much more concrete regulatory foundation than existed only a short time ago. The Personal Data Protection Law, the 2026 Cybersecurity Law and related regulations add further obligations relevant to many healthcare deployments. TCVN ISO/IEC 42001:2025 provides a management-system reference, while WHO, NIST and emerging IMDRF work offer broader approaches to governance and lifecycle management.
Healthcare organizations now need to translate these layers into processes that make sense inside real hospitals and clinics. That translation is where governance becomes operational.
The most useful question for healthcare leaders is therefore not simply “Do we have an AI policy?” It is: “If an AI system enters our organization tomorrow, do we know how we will govern it from the first proposal to the last day it is used?”
If the answer is yes, the organization is beginning to build an AI governance operating model rather than merely adopting AI.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, medical device, cybersecurity, data-protection or conformity-assessment advice, and it does not determine the regulatory classification, legal obligations or appropriate governance controls for a particular AI system or healthcare organization.
The governance practices discussed here, including an organizational AI inventory, internal governance review levels, multidisciplinary review, lifecycle approval conditions, monitoring and periodic review—are practical organizational recommendations. They should not automatically be interpreted as specific statutory requirements unless required by applicable Vietnamese law, regulation, technical regulation, contractual obligation or other binding instrument.
Statutory AI risk classification under Viet Nam’s Law on Artificial Intelligence and Decision No. 33/2026/QĐ-TTg should be distinguished from an organization’s internal clinical or operational review process. Internal governance review does not replace formal regulatory classification, conformity assessment or other specialized regulatory requirements.
TCVN ISO/IEC 42001:2025, WHO guidance, the NIST AI Risk Management Framework and other international frameworks referenced in this article can support organizational governance but do not replace Vietnamese law. Where an AI system is also subject to personal-data, cybersecurity, medical device or other sector-specific requirements, those obligations should be assessed based on the actual system, intended purpose, data flows and deployment context.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. 30 June 2026; effective 15 August 2026.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
National Assembly of Viet Nam. Law No. 116/2025/QH15 on Cybersecurity. Adopted 10 December 2025; effective 1 July 2026.
Government of Viet Nam. Decree No. 331/2026/NĐ-CP on Cybersecurity Protection for Information Systems. 19 August 2026; effective 19 August 2026.
Government of Viet Nam. Decree No. 333/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Cybersecurity Law. 19 August 2026; effective 19 August 2026.
Ministry of Health of Viet Nam. Consolidated Document No. 08/VBHN-BYT on Medical Device Management. 6 March 2026.
Viet Nam Standards and Quality Institute. TCVN ISO/IEC 42001:2025 — Information technology – Artificial intelligence – Management system. Identical to ISO/IEC 42001:2023.
World Health Organization Regional Office for Europe. Report of the Knowledge Community on Responsible Artificial Intelligence in Health. 1 September 2026. WHO/EURO:2026-13381-53155-83077.
World Health Organization. Ethics and Governance of Artificial Intelligence for Health: WHO Guidance. Geneva: WHO; 2021.
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Gaithersburg, MD: NIST; 2023.
International Medical Device Regulators Forum. N93: Technical Framework for Artificial Intelligence Life Cycle Management. Proposed document; public consultation closed 10 July 2026.