You bought the AI. Now who is accountable?

The reply went out at 4:47 p.m. on a Friday. A customer had asked whether their annual plan could be cancelled, and the answer came back generous: full refund, plus a free month, apology included. Nobody in the company had approved that offer. The support agent had, acting on a rule that nobody remembered writing.

What happened next mattered more than what the agent said. The founder asked who was responsible. The support lead said the tool belonged to marketing. Marketing said the contract was with the vendor. The vendor said the account settings were the company's. Twenty minutes in, the only settled fact was that no human in the building had an answer.

Every small company that adopts AI eventually reaches this moment. The machine does something wrong, or expensive, or merely embarrassing, and the org chart shows a hole where accountability was supposed to be. Governance is the work of closing that hole before somebody falls through it.

TL;DR

• Treat compliance as a design priority rather than a late overlay. For a 10-50 person company the whole job reduces to four moves: inventory what runs, classify the risk, write a minimal policy, and monitor on a schedule.
• 2026 is the year the rules stopped being hypothetical. The EU AI Act became applicable and its enforcement powers went live; Vietnam's Law on Artificial Intelligence, No. 134/2025/QH15, has been in force since 1 March 2026, with an implementing decree and a high-risk list standing behind it. These dates are fixed on official pages, not under discussion.
• Agents earn real authority the way people do: a gate where it counts, a log you can read, and a named human who answers for the result. Delegate only what you can audit.

Three legal shifts moved the map this year. The fourth shift is already sitting in your office.

The European rules arrived in stages, and the last stage landed this year. The Regulation entered into force on 1 August 2024. Bans on the riskiest uses, together with the duty to keep staff literate about AI, have applied since 2 February 2025. Obligations for general-purpose models and for governance bodies followed in August 2025. The Regulation as a whole became applicable on 2 August 2026, and from that point the Commission and the national authorities hold enforcement powers (European Commission, AI Act, accessed 27 October 2026). Transparency duties, covering disclosure when a person is dealing with a chatbot and clear labelling of certain AI-generated content, apply from August 2026.

The timetable itself then moved. A simplification package — adopted as the AI Omnibus on 19 November 2025, politically agreed on 7 May 2026 and in force since 27 July 2026 — pushed the heaviest high-risk obligations back: for the listed sensitive uses they now start on 2 December 2027, and for AI embedded in regulated products the deadline runs to 2 August 2028 (same source, accessed 27 October 2026). Companies that treated the earlier deadline as permanent learned the lesson the hard way, which is why every regulatory claim in this article carries the date we checked it.

Vietnam went the other direction and wrote AI into statute twice. The Law on Digital Technology Industry, No. 71/2025/QH15, has been in force since 1 January 2026 and treats AI as one of the industries it governs (full text, accessed 27 October 2026) — but its AI chapter no longer carries the operative detail, because the Law on Artificial Intelligence, No. 134/2025/QH15, passed on 10 December 2025 and in force since 1 March 2026, repealed those provisions in its Article 33 and replaced them with a dedicated regime: risk classification, notification, transparency, incident handling and liability (full text, accessed 27 October 2026). The data rule underneath both is newer than most English-language guides assume: Law No. 91/2025/QH15 on Personal Data Protection took effect on 1 January 2026 with Decree 356/2025/NĐ-CP, and between them they replaced Decree 13/2023/NĐ-CP (national legal database, accessed 27 October 2026). We come back to what survived that change in the risk map below.

The fourth shift is the one that turns theory into a Tuesday-morning problem. Agents stopped being chat windows. A model drafts the reply, checks the stock, updates the CRM and sometimes sends the mail itself, so the distance between "the AI suggested it" and "the customer has been told" collapsed to a single click. That click belongs to a person, whether or not anyone has said which one. We wrote earlier about keeping data control and human oversight intact while this happens (keeping AI agents under your own control); this piece sits underneath it, covering what you have to decide and write down before the first agent touches a customer.

What AI governance means for a 10-50 person company

A large bank builds governance as an institution: committees, model risk teams, documentation standards, sign-offs stacked on sign-offs. A company of thirty people cannot copy that, and should not try. The institution is not the point. The point is that a human being can answer, in writing, for what a machine did.

In practice that means five artifacts, none of which take a department to produce. An inventory of every AI system in use, including the ones nobody officially approved. A risk class for each entry, assigned by what happens when it fails rather than by how impressive the model is. A one-page policy that says which data may go where and who signs off on what. An approval matrix for the actions that can cost money or customers. And logs good enough to reconstruct a bad afternoon.

Read that list again and notice what is missing: no lawyers on retainer and no six-month programme. The cost of governance at this size is a few hours of focused attention and the discipline to keep it current. That is the whole argument for doing it as a design decision instead of an overlay, because by the time you want it as an overlay it is an incident response.

There is also a floor already written into the rules. Article 4 of the EU AI Act obliges providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy among staff and other people operating the systems on their behalf, taking account of their technical knowledge, experience, education and training (Regulation (EU) 2024/1689, Article 4, accessed 27 October 2026). For a small team that duty looks like a short internal brief: what the model gets wrong, which data it may see, which actions need approval, and who gives it. The obligation is sized for enterprises in its phrasing, but small firms meet it with a page and a conversation, not a curriculum.

So governance at this scale is neither a luxury nor a mystery. It is a small pile of decisions with names on them. The rest of this article works through where those decisions bite first.

The risk map: where small companies actually get hurt

Risk registers look abstract until they describe your week. Below are the four lanes that account for most of the damage we see in companies under fifty people, with the minimum control that keeps each one survivable.

Customer data is the lane with a deadline attached. Decree 13/2023/NĐ-CP governed personal data from 1 July 2023 until 1 January 2026, when Law No. 91/2025/QH15 on Personal Data Protection and its implementing Decree 356/2025/NĐ-CP took effect and replaced it (full text of the Law and gazette copy of the Decree, accessed 27 October 2026). The two obligations that matter for AI use survived the change of instrument: an impact assessment dossier for processing activities (Articles 21 and 22) and a named data protection person or unit (clause 2 of Article 33). Article 38 then carves out the smallest businesses — household businesses and micro-enterprises are exempt from those provisions outright, and small enterprises and startups may defer them for five years from the law's effective date — except where the company's business is processing personal data for others, or where the data is sensitive. Read the exception carefully, because a company whose product processes other people's data does not get the grace period. The carve-out is a window for building the habit, not a reason to skip it.

Automated decisions are where fairness becomes an operational question. If a system ranks people for jobs, credit, screening or differential treatment, the failure mode is not a wrong paragraph, it is a wrong outcome for a human being. The EU rules draw this line explicitly: social scoring is on the prohibited list, and employment and credit uses sit in the high-risk category with duties attached (European Commission, accessed 27 October 2026). You do not need to be governed by that Regulation for the lesson to apply. Any decision that harms a person should have a human who sees the input, the recommendation and the reason before it takes effect.

Output you publish carries your name, not the model's. The transparency rules that took effect this year require disclosure when people interact with a chatbot and clear, visible labelling of certain AI-generated content, including deep fakes and AI-generated text published to inform the public on matters of public interest (same source, accessed 27 October 2026). Even where that specific duty does not reach you, the commercial risk does: a customer who discovers a fabricated case study learns something about your quality control, not about the model.

Commitments are the quiet lane. Nothing in your systems is more expensive than a promise made to a customer by software. The refund in our opening story was not a model failure in the technical sense. It did exactly what the permissions allowed. Which brings us to the rules themselves, and why the dates matter more than the headlines.

The legal landscape, with each date printed beside its source

The EU AI Act: applicable since 2 August 2026

Start with the shape of the EU rules, because they are the ones most likely to reach a Vietnamese business. The AI Act sorts systems into four tiers: unacceptable risk, high-risk, limited risk carrying transparency duties, and minimal risk. It bans nine practices outright, among them social scoring, untargeted scraping of faces from the internet or CCTV material, and emotion recognition in the workplace (European Commission, AI Act, accessed 27 October 2026). A small firm rarely lands in the banned tier. It shows up in the transparency tier, through chatbots and generated content, and in the deployer seat for tools somebody else built.

The fines are the part a small company should not skim. Infringements involving prohibited practices face the highest penalties, up to 35 million EUR or 7% of total worldwide annual turnover, whichever is higher, while most other breaches top out at 15 million EUR or 3% on the same test, and supplying wrong, incomplete or misleading information draws a ceiling of 7.5 million EUR or 1% (European Commission, enforcement framework, accessed 27 October 2026). Worldwide turnover is the denominator, so being small lowers the figure without lowering the rule.

Reach is the part that surprises exporters. Article 2 of the Regulation applies it to providers and deployers established in a third country where the output produced by the AI system is used in the Union (Regulation (EU) 2024/1689, Article 2, accessed 27 October 2026). If a Vietnamese supplier's AI-generated report is consumed by a customer in the EU, that supplier is inside the frame regardless of where its office sits. Selling to the Union through a partner does not change the analysis, because the test is where the output is used.

The relief on offer is real as well. The simplification package extended to small mid-caps the simplified technical documentation that had been written for SMEs, and widened access to regulatory sandboxes where systems can be tested against real conditions (European Commission, accessed 27 October 2026). The message in the official text is that a small company is not expected to behave like a bank. It is expected to be able to explain itself.

Vietnam: the Law on Artificial Intelligence 134/2025 and its implementing decree

Vietnam's regime is younger, narrower and, for a small company, more procedural than the European one. The Law on Artificial Intelligence, No. 134/2025/QH15 — 8 chapters, 35 articles — took effect on 1 March 2026, and four of its provisions decide what a buyer of AI has to do. Each carries an article number you can check in the full text (accessed 27 October 2026):

• Three risk tiers (Article 9). A system is high, medium or low risk. High risk means a real capacity to harm life, health, property, human rights, or national and public interests; medium risk covers systems able to confuse or manipulate users who cannot tell they are dealing with a machine.
• Classify, then notify (Article 10). The provider classifies the system before it goes into use, keeps a classification dossier for medium and high risk, and reports the result to the Ministry of Science and Technology through the single AI portal. A deployer inherits that classification and must re-classify when its own changes or integrations raise the risk.
• Transparency (Article 11). A system that interacts directly with people must be designed and operated so users know they are talking to AI, and AI-generated content must be marked as the Government prescribes.
• Records, inspection and liability (Articles 28 and 29). During an inspection the organisation must produce technical dossiers, trace logs and training data. Article 29 places the duty to compensate damage on the deployer of a high-risk system even where that system operated within the rules.

The Law also answers the question that opened this article, and it answers it against the machine: an AI system does not replace the authority or the responsibility of the human decision-maker, who answers for how the output was reviewed and used. Liability is spread across four roles — developer, provider, deployer, user — so a small company that buys a tool and puts it in front of customers is a deployer, with the duties that come with the seat.

Decree 142/2026/NĐ-CP, issued on 30 April 2026 and in force since 1 May 2026, is where those duties turn into forms and deadlines (full text, accessed 27 October 2026). Four details matter to a company that has already bought AI:

• Notification that issues an identifier. A medium or high-risk system is notified through the one-stop AI portal before use, and the portal issues the system an identifier code (Article 12). What you end up holding is a registration, not a deck.
• Labelling (Article 18). From 1 May 2026, audio, images and video made or edited by AI must carry a recognisable mark when they simulate a real person's appearance or voice, or reconstruct a real event. Four cases are exempt, and one of them is generous enough to matter: internal use inside an organisation is not public release.
• Incident reports (Article 19). A preliminary report goes through the portal within 72 hours for an emergency or loss-of-control incident, within five working days for the rest, with remediation results inside 15 days.
• Sandbox (Chapter IV). Small and medium enterprises can test a system under controlled risk, with obligations reduced according to the trial level — the mechanism the Law opens in Article 21.

Two pieces finish the frame. The Prime Minister issued the list of high-risk systems in Decision 33/2026/QĐ-TTg on 30 June 2026, effective 15 August 2026: systems on that list are high risk by designation, and everything else is classified by the criteria in the decree. And the Law on Digital Technology Industry, No. 71/2025/QH15, is no longer the AI statute — Article 33 of the AI Law repealed its AI chapters and clauses, so from 1 March 2026 the Vietnamese framework lives in 134/2025/QH15, its implementing decree and that decision. Systems already running before 1 March 2026 sit in a transition: the decree gave them 60 days, to 30 June 2026, to notify the portal with a conversion plan, while Article 35 of the Law grants longer grace periods — 18 months for healthcare, education and finance, 12 months for other sectors, counted from the effective date.

Give an agent permissions the way you would give them to a new hire

Nobody hands a new employee the payment system, the customer database and the company stamp on day one. Agents get treated differently, usually because the setup screen offers the permissions as a series of toggles and nobody is assigned to read them. We have written about the control-plane approach to this problem (agent permissions and the control plane); the operating version of it fits on a card.

Sort every action into three levels. The agent executes on its own: drafting summaries and formatting reports for internal use. The agent proposes and a human approves: the reply to an angry customer, a price change, a contact record edit, and anything that sends mail outside the company. The agent prepares material for a human decision: the CV shortlist, the lead scores, the renewal-risk flags, and eligibility calls about real people. Two of those levels are automation, and only the third looks dangerous at first glance, which is exactly why the mapping has to be written down rather than felt out.

Permissions should follow the same discipline you apply to staff accounts. Allowlist the tools each agent may call instead of granting open access. Keep credentials separate between agents so one compromise does not become total. Close the sending channel by default and open it only where a named person stands behind the outcome.

The approval gate itself deserves more attention than it usually gets. A button that says "Approve" with no context produces rubber stamps, and rubber stamps are governance in name only. The reviewer should see the source data, the proposed action, and what data category was touched, with three real options: approve, edit, reject. If the reviewer cannot make an informed choice in the interface, the gate is decoration, and the incident report will eventually say so.

Four steps you can finish this quarter

The framework below is deliberately smaller than the ones written for regulated industries. A company of thirty people does not need more process; it needs the four steps finished and repeated.

Step 1: Inventory everything that runs. List the assistants, the automations, the CRM plugins, the browser extensions, the scripts someone wrote over a weekend, and the personal accounts staff use because the official tool was slow to approve. For each entry capture the owner, the purpose, the data it touches and whether it acts alone or only proposes. Shadow systems are the ones that surprise you later, and they are invisible until somebody spends an afternoon asking what is actually in use.

Step 2: Classify by consequence. Assign each entry a level based on what happens when it fails, not on how capable the model is. A small model that can email every customer outranks a large one that only drafts. Four levels work: low, medium, high, and restricted for anything the company cannot yet control. The output is a living register with an owner and a next review date per row, and that register is where governance stops being an opinion.

Step 3: Write the minimal policy. One page: which data classes may enter which tools, the approval matrix covering money, customer commitments, personal data and decisions about people, the person accountable for each system, the switch that stops everything, and the date the page was last reviewed. Circulate it. A policy that exists only in a founder's head fails the moment that founder is on leave.

Step 4: Monitor on a schedule and on triggers. Review the register quarterly, and review it out of cycle when a new agent goes live, a vendor changes its terms, or a workflow starts touching a new kind of data. The review is a checklist, not a workshop: what ran, what was approved, what was rejected, what broke, which permissions grew. Our companion piece lays that out as a 30-day self-audit you can run with a spreadsheet (the AI governance audit checklist).

Steps one to three take days. Step four is the one that gets skipped, and skipping it is how a company discovers in month five that an agent quietly accumulated rights nobody granted on purpose.

Signs you are compliant enough, and signs you are not

"Compliant enough" is not a certificate. For a small company it means an outsider could reconstruct who decided what, from evidence you produced without panic. These are the signals we look for when a client asks whether they are there yet.

• Every AI system has a name attached to a person. Not a vendor, an employee who answers for it.
• The inventory is current. Somebody can list what runs without opening the accounting software first.
• The dangerous actions are gated. Sending to customers, spending money, editing customer records, and any decision that works against a person all require a second signature.
• Logs are readable. For last month you can show who asked for what, what the agent did, and what data it touched.
• The policy is findable and short. A new hire can locate it on day one and paraphrase it by day three.
• Staff can say where customer data goes. If three people give three different answers, the data class list is fiction.
• The stop switch has been tested. You know how to disable an agent, and you have done it once for real.

The reverse list is shorter and less comfortable: nobody can enumerate the tools in use, personal accounts are handling customer records, an agent can send external mail with no gate, or the last incident lives only in a chat thread. Any one of those means the overlay has not been built yet, whatever the deck says.

Finally, accept that the target moves. The dates in this article came from official pages on a specific day, and one of them already moved once this year. Compliance is not the state of having checked; it is the habit of checking again when the source changes.

The 5ac take: governance is what makes delegation safe

Here is the trade nobody puts on a slide. Without gates, delegation is fake: the founder re-reads every outgoing message, approves every change, and the agent saves almost nothing, because the checking costs more than the doing. That is when AI adoption stalls and people blame the model.

With gates and logs attached to a named owner, the arithmetic flips. A person approves a batch instead of each item and inspects the exceptions instead of the whole stream, then points at a record when a customer asks what happened. Trust becomes something you can audit rather than something you feel. In our experience that is the moment a small team stops using AI as a toy and starts treating it as capacity.

This is also why we put compliance at the design stage rather than the retrofit stage. Retrofitting means you rebuild permissions, chase consent again and try to reconstruct what happened, which is slow and incomplete. Designing it in costs a page, an afternoon and a recurring calendar entry. The companies that do the second thing move faster afterwards, because nobody is quietly afraid of the systems they just switched on.

Takeaway

Do not start with a framework. Start with this list, this week, in whatever tool your team already lives in. If you can answer all five, you are further along than most companies of your size.

• Can you name every AI system in the company? Including the personal accounts and the extensions nobody remembers installing.
• Does each one have a human owner? A person, not a vendor, who answers when it goes wrong.
• Are the high-consequence actions gated? Mail to customers, money, customer records, and decisions about people.
• Can you read last month's log? Who asked, what the agent did, what data it touched, who approved.
• Is the policy one page and findable? Written before it was needed, reviewed when the rules or the stack changed.

Frequently asked questions

References

• European Commission — AI Act — application timeline, prohibited practices, transparency duties, enforcement dates, and the simplification changes. Accessed 27 October 2026.
• Regulation (EU) 2024/1689, full text (EUR-Lex) — Article 2 scope for third-country providers and deployers, Article 4 AI literacy duty. Accessed 27 October 2026.
• Law No. 134/2025/QH15 on Artificial Intelligence, full text — 8 chapters and 35 articles, passed 10 December 2025, in force 1 March 2026; Article 9 (three risk tiers), Article 10 (classification and notification), Article 11 (transparency and labelling), Article 28 (inspection and the duty to produce dossiers, logs and training data), Article 29 (violations, compensation), Article 33 (repeal of the AI provisions of Law No. 71/2025/QH15), Article 35 (grace periods). Accessed 27 October 2026.
• Decree 142/2026/NĐ-CP implementing the Law on Artificial Intelligence — issued 30 April 2026, in force 1 May 2026; Article 12 (notification through the one-stop AI portal and system identifier), Article 18 (labelling AI-generated audio, image and video, with exemptions), Article 19 (incident reporting within 72 hours, 5 working days and 15 days), Chapter IV (AI sandbox under Article 21 of the Law), and the 60-day transition notification. Accessed 27 October 2026.
• Decision 33/2026/QĐ-TTg — the list of high-risk AI systems — issued by the Prime Minister on 30 June 2026, effective 15 August 2026. Accessed 27 October 2026.
• Law No. 71/2025/QH15 on the Digital Technology Industry, full text — passed 14 June 2025, effective 1 January 2026; its AI chapters and clauses were repealed by Article 33 of Law No. 134/2025/QH15. Accessed 27 October 2026.
• Law No. 91/2025/QH15 on Personal Data Protection — passed 26 June 2025, in force 1 January 2026, replacing Decree 13/2023/NĐ-CP; Articles 21 and 22 (impact assessment dossier), clause 2 of Article 33 (data protection person or unit), Article 38 (exemptions for household businesses, micro, small enterprises and startups, and their limits). Accessed 27 October 2026.
• Decree 356/2025/NĐ-CP implementing the Law on Personal Data Protection (official gazette copy) — issued 31 December 2025, in force 1 January 2026, replacing Decree 13/2023/NĐ-CP. Accessed 27 October 2026.
• European Commission — the enforcement framework of the AI Act — maximum penalties for prohibited practices and for other breaches, who enforces them, and the application dates for the high-risk rules. Accessed 27 October 2026.

— James Marcus, Content Lead 5ac.vn, October 2026. Regulatory dates were checked against the official sources listed above on the access date shown; re-check them before you rely on them.