AI governance for business: a control framework and data security

In short: AI governance is a set of rules that answers four questions: which AI tools staff may use, what data they may put in, which outputs need a human sign-off, and who is accountable when something goes wrong. In Vietnam, the Law on Personal Data Protection (No. 91/2025/QH15) and Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP, took effect on 1 January 2026; the Law on Artificial Intelligence (No. 134/2025/QH15) followed on 1 March 2026. SMEs should start with three things: an inventory of AI tools in use, a data classification, and a one- to two-page AI usage policy.

What is AI governance?

AI governance means controlling AI use the way you control spending: an approved list, someone who signs off, and a record of what happened. Unlike classic cybersecurity, the main risk rarely comes from hackers. It comes from your own staff pasting a client contract into a free chatbot, or sending out an AI-drafted quote nobody checked.

A hypothetical example: the accountant at a 30-person trading company uses a personal AI chatbot to summarise a receivables sheet with every customer's name, phone number and balance. Nobody else knows, there is no contract with the provider, and the data now sits on servers abroad. Governance is how a company finds out about cases like this and either allows them under conditions or stops them.

The six-part framework below is a simplified take on the AI Risk Management Framework that the US National Institute of Standards and Technology (NIST) released for voluntary use on 26 January 2023.

Why SMEs need it too

Staff are already using AI, usually before any policy exists. This is shadow AI: employees using personal AI accounts for company work, out of management's sight. The intent is usually good. The risks are real. Depending on terms and settings, some free or personal AI tools may store and use what users type to improve their models. AI can produce confident wrong answers, and a wrong figure in a quote goes straight to the customer. And customer and employee data is personal data, now covered by a dedicated law with specific fines.

The legal framework (checked November 2026)

Instrument	Passed / issued	In force	Why it matters for AI use
Law on Personal Data Protection, No. 91/2025/QH15	26 June 2025	1 January 2026	Any collection or processing of customer and staff data, including through AI tools
Decree 356/2025/ND-CP	31 December 2025	1 January 2026	Detailed guidance for the law; replaces Decree 13/2023/ND-CP
Law on Artificial Intelligence, No. 134/2025/QH15	10 December 2025	1 March 2026	Risk classification of AI systems, transparency duties for deployers

Sources: LuatVietnam for the data protection law dates; EY Vietnam for Decree 356; Rajah & Tann Asia and the Can Tho legal information portal for the AI law. Note that No. 71/2025/QH15 is the Law on Digital Technology Industry, not the AI law; its AI provisions (including Chapter IV) were repealed by the AI law. This is a summary, not legal advice: check the original texts and consult a lawyer before deciding how to comply.

What the data protection law requires

Consent must be clear and verifiable; according to EY Vietnam, Decree 356 bans pre-ticked consent and misleading wording. Companies must prepare impact assessment files for processing personal data and for transferring it abroad. Breaches must be reported within the legal deadline, which Viet An Law summarises as 72 hours from discovery. Pasting customers' personal data into an AI service hosted abroad may count as a cross-border transfer; the safe rule is to keep personal data out of AI tools the company has not approved.

Article 8 sets maximum administrative fines of 10 times the revenue earned from illegally buying or selling personal data, 5% of the organisation's previous-year revenue for cross-border transfer violations, and VND 3 billion for other violations, according to the Vietnam Lawyers Journal (2025).

Smaller firms get partial relief. According to LuatVietnam, Article 38 lets small enterprises and start-ups choose whether to apply Articles 21, 22 and clause 2 of Article 33 (impact assessments and data protection staffing) for five years from the effective date, while household businesses and micro-enterprises are exempt from them. The relief does not apply to firms that provide data processing services, directly process sensitive personal data, or process data of a large number of people. Other duties, such as consent and security, apply to everyone.

What the AI law requires

The AI law sorts AI systems into high, medium and low risk. A company that only uses off-the-shelf AI tools is usually a user or deployer, not a developer, though classification of a specific system should be checked against the text. According to Rajah & Tann Asia, deployers must clearly disclose when AI-created or AI-edited text, audio, images or video could mislead people about authenticity, and must visibly label content that imitates a real person's appearance or voice or recreates real events. Providers must make sure people know when they are talking to AI. Systems already running before 1 March 2026 have 18 months to comply in healthcare, education and finance, and 12 months elsewhere. The law also keeps humans accountable for AI decisions, so you must be able to step in.

A six-part AI control framework

AI tool inventory and owners

List every AI tool in use: name, free or paid, who uses it, for what, and what data goes in. The fastest way is to ask each team directly and promise no one will be punished for using tools before rules existed. Each approved tool gets an owner, usually the head of the team that uses it most.

Data classification

Level	Examples	Allowed AI use
Public	Website copy, published product material	Any AI tool
Internal	Internal procedures, meeting notes without personal data	Company-approved AI tools only
Confidential	Costs, contracts, financials, business plans	Only AI tools under a business contract that excludes training on your data
Personal data, especially sensitive	Customer details, staff files, payroll, health data	Only systems assessed under the data protection law; remove or mask identifiers first

Put this table in the policy itself. Staff should be able to answer "can I paste this?" in five seconds.

AI usage policy

One or two pages in plain language that every employee reads and signs: approved and banned tools, the classification table, outputs where AI may only draft and a person must approve (quotes, contracts, customer-facing content, HR decisions), labelling rules for published AI content, and how to report a mistake, with a promise not to punish early reporting. Review it every six months. Our guide to AI tools for the office covers common tools.

Access control for AI

AI must never see more than the person using it. When you connect an assistant or an AI agent to accounting, CRM or document stores, let it read with each user's own permissions rather than a shared admin account, and log every write action: who asked, what the AI did, and when.

Vendor contracts

Get written answers before paying: Is our data used to train models, and how is that switched off? Where is it stored and for how long? How is it deleted when we leave? Which sub-processors are involved? How quickly will you notify us of a breach? Is there central user management, permissions and admin logging? The answers also feed any impact assessment you must prepare.

Human review and incident handling

Anything that leaves the company, moves money or affects a person's interests (customers, candidates, staff) needs a human final sign-off. The incident process only has to say who receives reports, who decides whether it is a personal data breach, and who notifies within the legal deadline.

Handling shadow AI

Banning AI outright tends to backfire: people switch to their phones and you know even less. Offer an official tool with a business account and training disabled, plus a short training session. After three months, ask teams which needs are still unmet, because unmet needs are where shadow AI grows back.

Who is responsible?

Final accountability sits with the leadership team, because this is a business-risk decision. A typical split in an SME: the director approves policy and tools; a part-time AI coordinator keeps the inventory and receives incident reports; IT configures accounts, permissions and logs; HR or legal handles vendor contracts, consent and the lawyer relationship; department heads make sure their teams follow the policy. Firms outside the Article 38 relief must also appoint qualified data protection staff or hire a qualified service.

A 90-day rollout

1. Weeks 1–2: build the tool inventory and list where personal data lives (sales software, CRM, HR system, spreadsheets, chat groups).
2. Month 1: issue the classification table, a short policy and an interim list of approved tools. Early and imperfect beats late and complete.
3. Month 2: choose one or two business-grade AI tools, get the six vendor answers, set up permissions and logging.
4. Month 3: train everyone; with a lawyer, confirm whether Article 38 relief applies and which impact assessments and consent forms you need.
5. Day 90: review signed policies, unapproved tools still in use, incidents reported and AI errors caught before reaching customers, then adjust.

The most common mistakes are a twenty-page policy nobody reads, handing governance to IT alone, and waiting for the law to be perfectly clear. A very small business that only uses AI for public content and never feeds in customer data does not need the full framework yet: one page of rules and an approved tool list are enough.

FAQ

Is Decree 13/2023/ND-CP still in force? No. Since 1 January 2026, Decree 356/2025/ND-CP guides the Law on Personal Data Protection and replaces Decree 13/2023/ND-CP. Update internal documents that still cite Decree 13.

Is it illegal for staff to use a free AI chatbot for work? Not in itself. The legal risk arises when staff put customers' or colleagues' personal data into it without a valid legal basis; ask a lawyer about specific cases.

Must AI-generated marketing content be labelled? Under the AI law, deployers must disclose AI-created or edited content that could mislead about authenticity and visibly label content imitating real people. Check implementing guidance for specific content types.

Do we need ISO/IEC 42001 certification? ISO/IEC 42001:2023 is a voluntary international standard for AI management systems. Most SMEs do not need certification unless a large customer asks for it; using it as a reference when drafting policy is enough.

---

HAT Solutions helps companies inventory the AI tools they use, write a data classification and AI usage policy, and design permissions when connecting AI to business software. Specialist legal questions belong with your lawyer. Contact us to review how your company uses AI. Read next: AI for business and AI customer service chatbots.