Vietnam is gradually establishing the legal and infrastructure foundations for AI development. The Law on AI, adopted on December 10, 2025, and effective from March 1, 2026, provides a framework for AI infrastructure and national AI sovereignty. The framework covers computing capacity, shared datasets, training and testing platforms, and foundational AI models. Decree No. 142/2026/ND-CP, effective from May 1, further details the implementation of the Law on AI.
For businesses, however, the immediate questions are more practical: what data can be used, what infrastructure is required, and how can AI be scaled without unnecessary investment or loss of control over sensitive data? At the CIO Summit 2026, organized by the Vietnam CIO Community on October 1, experts discussed these issues, highlighting data governance, computing capacity, security, and data sovereignty.
Data comes first
According to Mr. Ho Duc Thang, Deputy to the 16th National Assembly and Member of the National Assembly’s Committee for Culture and Social Affairs, AI adoption is advancing faster than governance policies within many businesses. Employees may already be using AI tools before companies have established clear rules on data, access rights, and responsibility. “The question is no longer whether businesses will use AI, but whether they have regulations and mechanisms in place to control data when employees begin using AI,” he said.
The first step, therefore, should not necessarily be choosing an AI tool, but identifying what data a business holds and which datasets can be used with AI. “Businesses need to inventory and classify their data before deciding how to apply AI to their systems,” he continued. “Not all data can be fed into AI, and the level of control required should differ depending on the sensitivity of the data.”
Less sensitive information, such as general procedures or internal documents without critical information, can be used for initial testing. Customer information, personal data, confidential documents, and commercially-valuable data should only be introduced once appropriate processes and controls are in place.
The challenge is also whether the data itself is reliable. Large volumes of information do not necessarily translate into useful datasets if they are fragmented, outdated, or poorly structured. Mr. Thang pointed to research indicating that AI-generated content is growing rapidly across the internet, while the relative share of human-generated content is declining. If AI-generated material is subsequently used without adequate controls to train new models, he noted, the quality and reliability of those models could eventually be affected.
Historical data can also introduce bias into AI systems. Mr. Thang cited the widely-discussed case of Amazon’s experimental recruitment system, which was reported to have disadvantaged female candidates because historical recruitment data was dominated by male applicants. For Vietnam, the issue also extends to language, cultural, and historical data.
Cost of scaling
Data is only the starting point. Once businesses establish what data can be used, they must determine how AI models will be run and what computing resources are required. Mr. Vu Thanh Tung, CEO of GreenNode, said businesses need more than data to deploy AI applications. They also need computing infrastructure and specialized personnel to operate it, while building such capabilities in-house can require significant upfront investment. “Investment costs are very large,” he said. “Before the investment is even completed, businesses may not yet know what the return on investment will be.”
For companies whose AI workloads are still developing, accessing computing capacity externally can therefore reduce the need to invest in and manage the entire infrastructure themselves.
Mr. Tung said businesses typically adopt a multi-cloud strategy, with different providers serving different workloads. While hyperscale cloud providers offer a broad range of services, GreenNode focuses specifically on infrastructure for AI workloads, particularly those requiring GPUs. “Businesses can use AWS or GreenNode, but the core computing platform for these AI workloads is still NVIDIA GPUs,” he said.
He identified three main differences in GreenNode’s approach in Vietnam compared to that of hyperscale cloud providers. First, it focuses on GPU-based AI workloads rather than the broader range of cloud services typically offered by hyperscalers. Second, it deploys GPU infrastructure across multiple availability zones (AZs) in Vietnam, including locations close to customers’ on-premises data centers. Third, technical and consulting support is provided by teams based in Vietnam. Together, these features allow businesses to select infrastructure based on their workload, data location, and operational requirements, while configurations can be adapted to the needs of customers in other markets.
Mr. Tung also referred to a five-layer infrastructure model for AI applications; a framework outlined by NVIDIA CEO Jensen Huang. The model spans the infrastructure required to run AI, from the physical data center and computing infrastructure to the applications and services built on top. At the bottom is the physical data center, which provides the power, cooling, and environment required to operate GPU servers. GreenNode works with data center and colocation providers for this layer, while focusing on the cloud infrastructure layer above it.
For Vietnamese businesses, this model can reduce the need to build and operate every layer of specialized infrastructure in-house, while addressing challenges around upfront investment, uncertain workloads, data location, and access to technical expertise.
New access risks
Governance and infrastructure requirements become more complex as AI moves from an assistive tool to systems capable of taking action. Traditional enterprise systems generally operate within defined access permissions. AI agents, by contrast, can connect to multiple data sources and tools to perform a series of tasks on behalf of users. This increases the potential impact of errors when agents are allowed to modify data or interact directly with operational systems.
According to Mr. Thang, this creates new risks if agents are given excessive permissions. “If an AI agent is allowed to write data or directly operate on a live system, an error by the agent no longer ends with a wrong answer,” he explained. “It can become an entire chain of actions being executed.”
Businesses therefore need different levels of access, separate testing environments from live systems, and clearly defined limits on what actions AI is permitted to perform. This also means AI preparation can no longer be treated as a technology department issue alone. Data, security, legal, finance, and business teams need to determine where AI can be used, what data can be accessed, and what authority can be delegated to AI systems.
Vietnam’s emerging AI framework is creating a national foundation for shared data, computing capacity, and AI infrastructure. For businesses, however, scaling AI begins with decisions about which data can be used, how it should be governed, what infrastructure should be owned or accessed as a service, and what level of authority should be granted to AI.
As AI moves from experimentation into core business operations, these decisions will increasingly shape how companies balance computing costs, data security, operational control, and data sovereignty.
Google translate