High-Risk AI Classification: The First Test of the Law of Artificial Intelligence

The Artificial Intelligence Law taking effect marks the first time Vietnam has a separate legal framework for AI. With 8 chapters and 35 articles, the law sets out the principle that AI must serve humans, not replace human authority and responsibility.

From a business perspective, Mr. Phung Quang Hung, CEO of One Mount, said that the birth and coming to life of the law is a step worth waiting for. “When a new field like AI has a clear legal corridor and regulations, businesses have a basis to rely on and do it right,” he said, adding that the law helps create a unified understanding of obligations when applying and developing AI, especially in protecting the rights of users and data subjects.

However, after the law was enacted, the tech community’s attention focused on one specific point: how to manage “high-risk” AI.

According to the law, AI systems are classified according to three risk levels: high, medium and low. In particular, high-risk groups must perform more stringent obligations such as assessing conformity, keeping technical records, and ensuring the ability to monitor and intervene by humans. This group is defined as “may cause significant damage to the lives, health, legitimate rights and interests of organizations, individuals, national interests, public interests, and national security”.

The high-risk AI category is currently still in draft form. Among them, many familiar AI systems are likely to be classified as “high risk” if they reach a certain threshold in terms of scale or level of automation. For example, a resume screening, performance appraisal or termination system would fall under this category if applied to 500 or more employees per year, or where the results are the primary basis for personnel decisions.

In finance, credit approval and insurance pricing systems can be in the high risk group if they directly affect 1,000 customers per year or more, or when decisions are automated for 30% or more. Similarly, the system for evaluating learning outcomes and enrolling students will be subject to stricter management if applied to more than 500 learners per year.

Some cases include AI systems that remotely identify biometrics in public spaces or on a large scale; AI systems that support diagnosis and treatment… must be evaluated and certified for suitability before being put into use.

This approach aims to protect human rights and the public interest. However, for businesses, the threshold of 500 or 1,000 people per year is not a large number, meaning that many operating systems may be subject to stricter management. Once in the “high risk” group, the story no longer stops at the classification label.

“The key issue is not whether the classification is reasonable, or whether to request a conformity assessment or not, but how the assessment process is carried out,” said Mr. Ngo Minh Quan, Rikkeisoft Digital Transformation Director.

According to him, when a new law is promulgated, especially in the field of technology, anxiety in the early stages is unavoidable. The nature of the law is to protect the majority, so groups that are benefiting from the “gray area” will be affected. However, what businesses care about is the predictability of the process. AI develops quickly, product cycles are short. A lengthy or unclear evaluation process can alter the pace of development. With high-risk AI systems, a suitability assessment must be performed, and there will be cases where “waiting for approval” is required. At that time, the deployment speed will hardly be as fast as before.

“But if the process is transparent, it is clear who is responsible, how long the processing time will be and does not disrupt the business and operations of the enterprise, then it is completely acceptable,” he added.

According to this digital transformation director, the current objections stem from a lack of understanding of how the AI ​​assessment process will be implemented, not necessarily because of the system’s risk classification. Therefore, he proposed a more flexible mechanism, for example requiring full assessment only when the system is deployed on a truly large scale.

Mr. Le Thanh Hung, community development expert at the Asian Open Source Association (FOSSASIA), admin of the Popular AI community, admitted that there are certain concerns from developers. According to him, in the past many AI products were developed in a relatively flexible environment. When there is a law, especially with a risk classification mechanism, businesses are forced to review their systems and data.

He believes that the essence of AI is data and algorithms. If data control is too tight, businesses may worry about affecting research and development activities. In addition, data security and intellectual property rights are also concerns of startups.

However, he acknowledged that the drafting agency had a basis in providing a list of risk levels. “If user data is leaked to a third party, the consequences are huge. Then not only the business will suffer, but the whole society will be affected,” he gave an example.

In the developer community, there is also some concern about the possibility of administrative procedures arising. According to Mr. Hung, if the evaluation process is transparent and does not cause obstacles, businesses will easily accept it. “The law needs to be flexible and adjusted according to reality,” he said.

From a positive perspective, One Mount CEO Phung Quang Hung believes that it is necessary to find a balance between control and development. Like many other new laws, the Artificial Intelligence Law will need time to have detailed instructions and receive comments from businesses and people.

Although he supports the introduction of principles for ethical AI applications, he also notes that regulators need to avoid creating procedures that “impede innovation”, specifically administrative procedures related to certification or licensing.

“It is important to balance the goals of control, protecting rights, applying AI in a healthy and ethical way and not letting procedures affect the speed of innovation,” he said.

Although the Artificial Intelligence Law has come into effect, the real test will come from the documents guiding the implementation of the law, most recently the List of High-Risk Artificial Intelligence Systems that is in the process of being completed. These regulations can accelerate the development of AI, but can also lead to hesitation, indecision or confusion on the part of developers.