Prepare for emerging regulatory trends
Regulation moves. The EU AI Act is rolling out in phases through August 2027. Vietnam is drafting its own AI Law. ASEAN is publishing a regional framework. Decree 13 is itself slated for amendment. The Bizzi posture is to align BAGF with the most demanding regime you touch, then update incrementally as each new rule lands.
Context
Section titled “Context”If you waited for the Vietnamese AI Law to be finalized before building controls for transparency, residency, and human oversight, you would be 18 to 24 months behind. By aligning BAGF with the EU AI Act and NIST AI RMF up front, you are already substantially covered for the controls the Vietnamese draft is likely to require. The remaining work is to track the deltas and ship them.
EU AI Act. The phased timeline
Section titled “EU AI Act. The phased timeline”Regulation (EU) 2024/1689 entered into force on 1 August 2024. The rollout.
| Milestone | Date | What activates |
|---|---|---|
| In force | 1 Aug 2024 | The Act becomes binding law |
| Prohibited practices | 2 Feb 2025 | Unacceptable-risk practices banned (social scoring, manipulation) |
| GPAI obligations | 2 Aug 2025 | Obligations for General Purpose AI providers |
| High-risk AI systems | 2 Aug 2026 | Annex III high-risk obligations apply |
| Full application | 2 Aug 2027 | All provisions in effect |
Bizzi’s classification. The accounting-support features (OCR, summarization, chatbot) sit at limited risk with Article 50 transparency obligations. They are not high-risk under Annex III, because they do not fall into the listed categories. If an EU customer extends usage into a listed category, credit scoring for example, the feature is reclassified.
Actions in flight for EU AI Act readiness.
- Article 11 technical documentation maintained for EU customers.
- AI Disclaimer on every chatbot interaction, per Article 50.
- Full logging and traceability through the observability layer, per Article 12.
- Mandatory human oversight on high-value transactions, per Article 14.
Draft Vietnamese AI Law
Section titled “Draft Vietnamese AI Law”The Ministry of Science and Technology is drafting Vietnam’s AI Law. Based on public statements and the 2025 to 2026 consultation drafts, the expected structure includes.
- Risk-based classification, in the same family as the EU AI Act.
- Transparency obligations for AI systems interacting with end users.
- Residency requirements for certain sensitive use cases.
- Allocated liability between AI Developers and AI Deployers.
The Bizzi posture. Because BAGF is already mapped to the EU AI Act and NIST AI RMF, most of the likely Vietnamese requirements are already covered. You will publish a BAGF minor version when the official draft is finalized, mapping existing controls to the new article numbers.
Other trends you are tracking
Section titled “Other trends you are tracking”- ISO/IEC 42005. The forthcoming AI System Impact Assessment standard. You will adopt it on publication.
- Decree 13/2023 amendment. A 2026 amendment is expected to clarify cross-border transfers and biometric data. Response scenarios are drafted.
- ASEAN Framework on AI Governance. Voluntary regional framework. Bizzi participates in the consultation and will align when the final version ships.
How we adapt
Section titled “How we adapt”When a new rule lands, the response runs in six steps.
- Detect. Legal monitors continuously. You subscribe to legal alert services and join the ASEAN AI Working Group.
- Assess. Legal, the DPO, and the CPTO score the impact. Which features are affected, which controls must update.
- Plan. A roadmap is drafted against the regulatory deadline.
- Implement. Squads ship the changes. The CoE updates standards.
- Communicate. Customers are notified through the transparency report and DPA updates.
- Document. BAGF moves to a new minor or major version depending on the scope of the change.