ABSTRACT

1 INTRODUCTION

The rapid diffusion of artificial intelligence (AI) across public administration, commerce, healthcare, finance, transport, and digital platforms has transformed not only how decisions are made, but also how risks are created, distributed, and externalised. AI systems now perform predictive, classificatory, and quasi-decisional functions that can directly affect property, bodily integrity, privacy, reputation, and economic interests. While these technologies undoubtedly improve efficiency and support innovation, they also expose the limits of conventional private law when harm stems from complex socio-technical systems rather than readily identifiable human conduct. In classical tort doctrine, liability generally rests on fault, a sufficiently direct causal nexus, and reasonably foreseeable damage.¹ However, AI disrupts each of these elements. Machine learning systems may generate harmful outcomes through adaptive processes that are opaque, probabilistic, and only partially controllable by any single actor. As a result, it becomes difficult to determine whether responsibility should lie with the developer who designed the model, the deployer who integrated it into a service, the operator who supervised its functioning, or the end user who relied on the output. This problem has been recognised in the literature for some time. Scholars have consistently argued that AI-induced harm places pressure on traditional doctrines of fault, causation, and proof, especially where the “black box” nature of algorithmic systems prevents injured parties from understanding how a harmful result was produced.² Moreover, the issue is not merely technical. It is also normative because civil liability must still perform its core functions of compensation, deterrence, and risk allocation in an environment where agency is fragmented, and harm may arise from

distributed chains of design and deployment. From a law-and-economics perspective, liability rules must encourage efficient precautions without unduly discouraging socially beneficial innovation.³ At the same time, from a corrective justice perspective, victims should not be denied redress simply because the technology that harmed them is difficult to explain. Accordingly, the central challenge is no longer whether AI can cause legally cognisable harm; that is now beyond serious dispute. Rather, the pressing question is whether existing tort law can respond coherently, fairly, and effectively to harms generated by systems characterised by autonomy, opacity, and technical complexity.⁴

Against this background, the European Union (EU) has emerged as the most developed regulatory laboratory for addressing AI-related harm through a combination of preventive governance and compensatory liability. Importantly, the EU does not treat AI liability as a matter that can be resolved by a single instrument. Instead, it has pursued a layered framework linking ex ante obligations to ex post remedies. The EU AI Act establishes a riskbased framework that classifies AI systems by the level of risk they pose and imposes corresponding duties on providers and deployers of high-risk systems.⁵ In parallel, the proposed AI Liability Directive seeks to reduce evidentiary asymmetries by facilitating access to evidence and introducing rebuttable presumptions of causality under certain conditions.⁶ The Revised Product Liability Directive complements this approach by expanding the notion of “product” to include software and AI-enabled systems, thereby allowing claimants to seek compensation under an updated strict liability framework when defective digital products cause damage.⁷ Taken together, these measures represent more than a technical adjustment of existing rules. They signal a broader movement towards a victim-oriented and risk-sensitive model of civil liability, one that acknowledges the evidentiary and structural difficulties inherent in AI litigation.⁸ At the same time, the EU framework continues to generate debate. Commentators question whether the proposed reforms are sufficiently ambitious, whether they distribute responsibility appropriately across the AI value chain, and whether they strike the right balance between innovation and accountability.⁹ Even so, the EU experience remains highly significant, because it offers a comparatively coherent attempt to modernise civil liability without abandoning its foundational principles. Furthermore, its influence extends beyond Europe. The so-called “Brussels Effect” suggests that EU regulatory models often shape legal developments in other jurisdictions, especially those seeking internationally credible frameworks for emerging technologies.¹⁰

In contrast, Vietnam’s legal framework remains in its early stages of addressing AI governance, and its current civil liability regime has not been systematically adapted to address AI-induced harm. The 2015 Civil Code provides general rules on non-contractual compensation and recognises fault-based liability as well as strict liability in limited situations. Nevertheless, it was drafted in a context where harmful conduct was still understood largely in terms of human action, tangible products, and relatively linear causal chains.¹¹ Consequently, several regulatory gaps become evident when those rules are applied to AI systems. First, Vietnamese law does not clearly define how liability should be allocated among developers, deployers, operators, owners, and users where damage results from autonomous or semi-autonomous outputs. Second, evidentiary mechanisms remain underdeveloped, particularly in cases where claimants need access to technical information to establish fault, defect, or causation. Third, the legal system has yet to adopt a coherent, risk-based approach that distinguishes between lowand high-risk AI applications and calibrates liability accordingly. Although recent legislative developments demonstrate growing awareness of digital risks, they do not yet amount to a dedicated regime for civil

liability arising from AI-caused harm. This is precisely where the present study identifies its research gap. While existing scholarship has discussed EU AI liability in depth, and some Vietnamese scholars have begun examining EU-inspired regulatory approaches, there remains limited analysis of how EU civil liability principles can be meaningfully adapted to Vietnam’s legal and institutional conditions. Accordingly, this article examines the evolution of EU civil liability for AI-induced harm and evaluates its relevance for Vietnam’s emerging framework. Its contribution lies not simply in comparing two legal systems, but in identifying which elements of the EU model are normatively desirable, institutionally feasible, and contextually transferable in Vietnam. In doing so, the article seeks to contribute to the current debates on AI governance, legal transplantation, and the future development of tort law in emerging economies. This study makes three principal contributions to the emerging literature on artificial intelligence and civil liability. First, it provides a structured doctrinal analysis of the European Union’s evolving liability framework for AI-induced harm, clarifying how risk-based regulation, product liability, and operator liability interact within a coherent legal architecture. Second, it advances a comparative perspective by critically assessing the transferability of EU legal principles to Vietnam, taking into account institutional capacity, legal culture, and developmental constraints. Third, and most importantly, the article proposes a context-sensitive hybrid liability model tailored to Vietnam, which integrates risk-based classification, differentiated liability regimes, and evidentiary facilitation mechanisms. In doing so, the study moves beyond descriptive comparison and contributes to the development of a normative framework for AI liability in emerging economies.

2 METHODOLOGY

This study adopts a qualitative legal research design grounded in case study methodology. More specifically, it uses the EU as an instrumental case to examine how a contemporary legal system is reshaping civil liability rules in response to AI-induced harm. The case study approach is appropriate because it allows close analysis of a complex and evolving legal phenomenon within its real regulatory setting.¹³ In this study, the EU is not treated merely

the proposed AI Liability Directive, and the Revised Product Liability Directive, together with the scholarly debates that have emerged around them. This design enables the identification of the principal legal techniques, liability models, and evidentiary solutions developed in EU law, and evaluation of their potential relevance to Vietnam’s emerging legal framework. The study relies exclusively on secondary sources. These sources include legislative texts, official policy documents, peer-reviewed journal articles, book chapters, institutional reports, and comparative legal scholarship on AI liability, tort law, and digital governance. This source base is suitable because the article is doctrinal and comparative in purpose. It does not seek to measure social behaviour or generate empirical data. Instead, it aims to interpret legal developments, clarify normative trends, and assess possible pathways for legal reform. The selection of materials was guided by three criteria: direct relevance to civil liability for AI-induced harm, analytical authority, and recency. Accordingly, priority was given to recent scholarship that addresses questions of fault, causation, defect, burden of proof, product liability, and operator responsibility in the context of AI. Vietnamese legal materials, especially the 2015 Civil Code, were also examined to assess the extent to which the current domestic framework can accommodate disputes involving AI-generated harm and to identify its main limitations. The collected materials were analysed using thematic analysis following Braun and Clarke. This method was chosen because it offers a systematic yet flexible framework for identifying recurring patterns across diverse legal and scholarly sources. The analysis proceeded through three stages: close reading and initial coding; grouping codes into broader doctrinal and policy themes; and comparative interpretation of those themes in light of Vietnam’s legal context. Four themes structure the discussion: the evolution of EU civil liability for AI-induced harm; the relationship between product liability and operator liability; the limits of traditional tort principles when applied to AI systems; and the lessons that EU law may offer for Vietnam.

3 RESULTS AND DISCUSSION

3.1. Evolution of EU civil liability frameworks for artificial intelligence-induced harm

The evolution of civil liability for AI-induced harm within the EU reflects a gradual yet

governed by general tort principles and the Product Liability Directive (85/374/EEC),²⁰ which focused on defective products and required claimants to establish damage, defect, and causation. However, as AI technologies became more autonomous, adaptive, and embedded in critical decision-making processes, these traditional frameworks began to reveal structural limitations. In particular, difficulties in proving fault and causation in AI-related cases exposed gaps that could undermine effective victim compensation and legal certainty.²¹ In response, EU institutions progressively recognised that AI-induced harm presents not merely a technological challenge but a systemic legal problem requiring coordinated regulatory intervention. Early policy discussions, such as the European Parliament’s 2020 Resolution on civil liability for artificial intelligence, emphasised the need to move beyond purely fault-based models and consider strict liability for high-risk AI systems.²² At the same time, the European Commission initiated consultations on adapting civil liability rules to the digital age, acknowledging that existing doctrines were not adequately equipped to handle issues such as algorithmic opacity, distributed responsibility, and evolving system behaviour.²³

A key milestone in this evolution is the adoption of the EU AI Act,²⁴ which introduces a risk-based regulatory framework that categorises AI systems into risk levels, including unacceptable, high, and limited risk. While the EU AI Act primarily functions as an ex ante regulatory instrument, its significance for civil liability should not be underestimated. By establishing clear obligations for providers and deployers of high-risk AI systems, such as requirements for transparency, human oversight, and risk management, it indirectly shapes the standard of care expected in liability assessments.²⁵ Moreover, the classification of AI systems by risk provides a structured basis for differentiating liability regimes, thereby moving EU law towards a more calibrated and context-sensitive approach. Alongside the EU AI Act, the proposed AI Liability Directive²⁶ is a direct attempt to address evidentiary challenges in civil litigation involving AI. One of its most notable features is the introduction of mechanisms to facilitate access to evidence and to establish rebuttable presumptions of causality under certain conditions. Specifically, where a claimant can demonstrate that a

defendant has failed to comply with relevant obligations under EU law and that such noncompliance is reasonably likely to have influenced the AI system’s output, a presumption of causation may arise.²⁷ This approach does not entirely eliminate the need to prove causation; rather, it alleviates the burden on claimants in situations where technical complexity would otherwise render proof practically impossible.²⁸ In doing so, the Directive seeks to strike a balance between fairness to victims and the preservation of procedural safeguards for defendants.²⁹

At the same time, the Revised Product Liability Directive³⁰ reflects another important dimension of the EU’s evolving approach. By expanding the definition of “product” to include software, digital services, and AI systems, the Directive ensures that victims of harm caused by defective AI can benefit from a strict liability regime. This is particularly significant because strict liability does not require proof of fault, thereby reducing the evidentiary burden on claimants. Furthermore, the revised framework addresses issues such as updates, cybersecurity vulnerabilities, and the integration of AI into complex product ecosystems.³¹ As a result, the Directive contributes to a more comprehensive liability landscape in which both fault-based and strict liability mechanisms coexist and complement each other. Importantly, the evolution of EU civil liability for AI-induced harm is not limited to legislative reform. It is also shaped by broader theoretical and policy debates concerning the appropriate allocation of risk in technologically advanced societies. For instance, some scholars advocate for a more extensive use of strict liability or even insurance-based models, arguing that these approaches better reflect the inherent risks of AI systems and ensure effective compensation for victims.³² These debates highlight the tension between promoting technological progress and safeguarding fundamental legal values, a tension that lies at the heart of the EU’s regulatory strategy. Despite its conceptual sophistication, the EU framework is not without limitations, particularly regarding the fragmentation of liability across multiple actors and the absence of a fully unified standard for high-risk AI systems.

Another notable aspect of the EU’s approach is its emphasis on coherence and integration across different areas of law. Rather than creating an entirely new and isolated liability

regime for AI, the EU has chosen to adapt and extend existing legal instruments while introducing targeted innovations where necessary. This incremental yet coordinated strategy allows for continuity with established legal principles while accommodating the unique challenges posed by AI.³³ Consequently, the EU framework can be seen as part of a broader ecosystem of AI governance that combines preventive and corrective mechanisms. Finally, the evolution of EU civil liability for AI-induced harm has broader implications beyond the European context. Through mechanisms often described as the “Brussels Effect”, EU regulatory standards tend to influence legal developments in other jurisdictions, particularly those seeking to align with international best practices or to access European markets.³⁴ In this sense, the EU’s approach to AI liability is not only a regional development but also a potential reference point for global legal reform. Its emphasis on risk-based regulation, evidentiary facilitation, and the coexistence of multiple liability models offers valuable insights for countries grappling with similar challenges.

3.2. Key EU liability models: Product liability and operator liability for AI

The evolution of civil liability for AI-induced harm in the EU has not only required doctrinal adaptation but also led to the consolidation of two central, increasingly complementary liability models: product liability and operator liability. In conventional settings, harm could often be traced either to a defective product or to negligent human conduct. Product liability remains essential because it captures defects embedded in the system as an object placed on the market. Together, these models signal a shift away from a narrow, actor-specific understanding of responsibility toward a more distributed and functional allocation of legal risk across the AI lifecycle.³⁵ This development is particularly significant in the EU context, where policymakers have sought to preserve doctrinal continuity while also ensuring that victims of AI-induced harm are not left without effective remedies. It also reflects a deeper policy judgement: responsibility should attach not only to those who create technological risks, but also to those who operationalise them, benefit from them, and are best positioned to prevent avoidable harm. In that sense, the EU’s emerging dual-model approach is not merely technical. It embodies a normative rethinking of accountability in digitally mediated societies, where risk is often generated collectively and materialises through interaction between product

and AI-based technologies. AI exposes these tensions with unusual clarity. An AI system may be unsafe not because of a manufacturing flaw in a physical device, but because of biased training data, inadequate model architecture, faulty updates, or vulnerabilities that emerge after deployment. The Revised Product Liability Directive³⁶ responds to these developments by explicitly extending the concept of “product” to software and AIenabled systems, thereby bringing them within a modernised strict liability regime.³⁷ This move is highly consequential. First, it affirms that digital products are not beyond the reach of classical compensation mechanisms simply because they are intangible. Second, it recognises that defectiveness in AI must be assessed dynamically, considering not only the condition of a system when it enters the market, but also subsequent modifications, cybersecurity failures, and interactions between hardware and software components.³⁸ Third, strict liability remains especially attractive in the AI context because producers are usually better placed than victims to understand technical risks, maintain documentation, spread costs, and obtain insurance. Nevertheless, product liability has inherent limits. It is most effective where harm can plausibly be linked to a defect in the product itself. It is less effective where the system functions as designed but is used inappropriately, inadequately supervised, or deployed in unsuitable contexts. Thus, while the revised product liability model is indispensable, it cannot by itself address the full range of harms associated with AI. That is precisely why the EU debate has increasingly turned to operators as a separate locus of responsibility.

Operator liability has, therefore, emerged as a necessary complement to product liability because AI-induced harm often results from deployment decisions rather than from a defect alone. This category may include employers, hospitals, financial institutions, platform providers, public authorities, and other entities that rely on AI to structure decisions or deliver services. The justification for operator liability is both practical and normative. Practically, operators are often the actors closest to the harmful event. They choose whether to use a system, how to configure it, whether to maintain human oversight, and whether to rely on automated outputs in high-stakes settings. Normatively, they are often the actors who benefit most directly from AI's efficiency, scale, and predictive capacity and are, therefore, the appropriate bearers of the risks that accompany those benefits. This logic becomes particularly compelling where harm arises even though the AI system is not

risk AI applications.³⁹ In earlier EU discussions, operator liability was even associated with strict or quasi-strict liability for certain high-risk systems, reflecting the view that proof of individual fault may be too burdensome for victims where control is exercised through complex organisational processes. Even where strict liability is not adopted, operator liability remains important because it helps translate regulatory duties, such as monitoring, transparency, human oversight, and risk management, into civil accountability.⁴⁰ In that sense, it functions as a bridge between ex ante governance and ex post compensation.

The interaction between product liability and operator liability is, therefore, central to the EU’s emerging approach to AI-induced harm.⁴¹ These models should not be treated as rivals. Instead, they address different but overlapping dimensions of technological risk. Product liability primarily concerns risks embedded in the design, manufacture, updating, and market placement of AI systems. Operator liability, by contrast, addresses risks arising from deployment, supervision, reliance, and contextual use. When combined, they create a layered liability structure that reflects the distributed nature of AI ecosystems. Nevertheless, the EU trajectory suggests that such complexity is not grounds for preserving outdated doctrinal boundaries. Rather, it is a reason to build a more flexible liability architecture, one that recognises that AI harm is often the cumulative result of design choices, organisational decisions, and deployment practices. In this respect, the coexistence of product liability and operator liability is one of the most important features of the EU model. It allows private law to move beyond the false choice between blaming the machine’s maker and blaming its user, and instead to distribute accountability across the full chain of technological activity in a principled and pragmatic manner.⁴²

3.3. Challenges in applying traditional tort liability principles to artificial intelligence

The application of traditional tort principles to AI-induced harm reveals a series of structural challenges that stem from the distinctive characteristics of artificial intelligence systems. Classical tort law is built upon relatively stable assumptions about human agency, linear causation, and the foreseeability of harm. Unlike conventional tools, AI systems may generate outputs that are not directly programmed but instead emerge from training data,

a specific actor. In particular, the fragmentation of responsibility across developers, deployers, operators, and users complicates the allocation of liability, as no single actor may fully control or predict the system’s behaviour. Scholars have, therefore, argued that AI challenges the anthropocentric foundations of tort law, which presuppose that harm can be traced back to a human decision or omission.⁴³ Moreover, the increasing reliance on AI in high-stakes domains such as healthcare, finance, and public administration amplifies these concerns, as errors may have significant and far-reaching consequences. Consequently, the difficulty is not merely one of adapting existing rules, but of reconsidering whether those rules remain conceptually adequate in the context of autonomous and adaptive technologies.

One of the most significant challenges concerns the concept of fault, which has traditionally served as a central organising principle of tort liability.⁴⁴ However, applying this standard to AI-related cases is far from straightforward. First, determining the appropriate standard of care becomes more complex when decisions are mediated by advanced technologies that require specialised technical knowledge. Judges and litigants may lack the expertise needed to assess whether the design, training, or deployment of an AI system met reasonable expectations. Second, even where a standard of care can be articulated, proving a deviation from that standard may be difficult due to the opacity of AI systems. The so-called “black box” problem means that it is often unclear how a particular output was generated, making it challenging to identify whether an error resulted from negligence, system limitations, or inherent uncertainty in the data. Third, AI systems may evolve over time, raising questions about whether faults should be assessed at the moment of design, deployment, or operation. These issues collectively weaken the effectiveness of fault-based liability as a mechanism for addressing AI-induced harm. As a result, scholars and policymakers have questioned whether traditional fault concepts can adequately capture the complexities of AI or whether alternative approaches, such as strict liability or hybrid models, are needed.⁴⁵

Closely related to the problem of fault is the challenge of establishing causation, which is another essential element of tort liability. However, AI systems disrupt this framework by introducing multiple layers of interaction and uncertainty. Harm may result from a combination of factors, including data quality, algorithmic design, system updates, user

legal scholars have proposed using presumptions of causation or burden-shifting mechanisms to address these evidentiary asymmetries.⁴⁷ Thus, the challenge of causation in AI cases highlights a fundamental tension between the need for effective victim protection and the preservation of coherent legal standards.

In addition to fault and causation, the principle of foreseeability, often used to limit liability to reasonably predictable harm, also becomes problematic in the context of AI.⁴⁸ However, AI systems, particularly those based on machine learning, may produce outcomes that are not fully foreseeable even to their creators. This is especially true for systems that learn from large datasets and adapt over time, as their behaviour may change in response to new inputs or evolving conditions. Consequently, the scope of foreseeable risk becomes difficult to define, raising questions about the fairness and effectiveness of imposing liability. If foreseeability is interpreted too narrowly, victims may be left without compensation for harm that could not reasonably have been anticipated. Conversely, if it is interpreted too broadly, developers and operators may face excessive liability for outcomes beyond their control, potentially discouraging innovation. Furthermore, foreseeability interacts with issues of standard-setting and regulatory compliance, as emerging legal frameworks such as the EU AI Act⁴⁹ may influence what risks are considered foreseeable by establishing baseline obligations for AI systems.

Beyond these doctrinal challenges, the application of traditional tort principles to AI also raises broader concerns about access to evidence and procedural fairness. This creates significant asymmetry between claimants and defendants, making it difficult for victims to gather the evidence needed to support their claims. Without adequate mechanisms for disclosure or access to information, the effectiveness of tort law as a tool for compensation and accountability may be severely limited.⁵⁰ At the same time, expanding access to such information raises concerns about confidentiality, security, and commercial interests. Legal systems must, therefore, balance the need for transparency with the protection of legitimate proprietary rights. These tensions further illustrate that the challenges posed by AI are not confined to substantive legal doctrines but also extend to procedural and institutional dimensions. Ultimately, the difficulties in applying traditional tort principles to AI-induced harm underscore the need for legal innovation, whether through adapting existing rules, introducing new liability mechanisms, or integrating regulatory and

3.4. Implications of EU AI liability law and lessons for Vietnam

3.4.1. Transferability Criteria from the EU to Vietnam

Assessing the transferability of EU civil liability principles for artificial intelligence to the Vietnamese context requires a multidimensional framework that accounts for legal, institutional, technological, and socio-cultural factors. Legal compatibility entails evaluating how EU fault-based, strict, and operator liability rules align with existing provisions under Vietnam’s Civil Code and broader tort law, while institutional capacity considers the readiness of regulatory bodies and courts to implement, monitor, and enforce AI liability effectively. Technological maturity addresses the sophistication and prevalence of high-risk AI applications, as well as the availability of expertise necessary for oversight, whereas cultural and legal norms involve understanding domestic expectations regarding accountability, risk allocation, and legal precedent. Integrating these criteria provides a structured and context-sensitive approach to determine which elements of the EU framework are normatively desirable, technically feasible, and practically adaptable, thereby informing the development of a hybrid AI liability regime that balances innovation with effective risk management and victim protection in Vietnam.

and (iv) decide the scope, context, or domain in which the AI is applied. Entities meeting one or more of these thresholds should bear responsibility for AI-induced harm under a liability framework. This definition ensures that liability attaches not only to creators or developers but also to those who operationalise AI, providing clarity and enforceability in complex socio-technical systems.

Furthermore, an “operator” is conceptualised as any entity that exercises meaningful control over the deployment, configuration, supervision, or application of an AI system and derives economic, institutional, or operational benefits from its use. Legal thresholds for identifying an operator include the authority to: (i) alter system behaviour or settings, (ii) monitor outputs and performance, (iii) implement safeguards or mitigation measures,

3.4.2. Transferability Criteria: Adapting EU AI Liability Principles to Vietnam

The evolution of civil liability for AI-induced harm in the EU offers a valuable reference framework for Vietnam as it begins to confront similar regulatory challenges amid rapid digital transformation. However, any attempt to draw lessons must proceed cautiously. Legal transplantation is never a purely technical exercise; it involves adapting foreign legal concepts to domestic institutional conditions, legal culture, and levels of technological development. In Vietnam, the existing civil liability regime, primarily grounded in the 2015 Civil Code,⁵¹ reflects a traditional approach centred on fault, causation, and compensable damage. While these principles provide a necessary foundation, they are not specifically tailored to address the complexities of AI systems.⁵² As a result, the Vietnamese legal framework currently lacks clear guidance on allocating liability in situations involving autonomous or semi-autonomous technologies, particularly where harm arises from distributed and opaque processes. In this context, the EU model does not offer a ready-made solution, but it does provide a structured set of principles that can inform a gradual and context-sensitive reform process.⁵³

One of the most significant lessons for Vietnam lies in adopting a risk-based approach to AI regulation and liability. The EU AI Act⁵⁴ demonstrates how categorising AI systems by risk level can serve as a foundation for differentiated legal obligations and liability standards. For Vietnam, this approach could help address the current lack of prioritisation in regulatory responses to emerging technologies. Not all AI systems pose the same level of danger, and imposing uniform liability rules across all applications may be both inefficient and impractical.⁵⁵ In contrast, a risk-based framework would allow lawmakers to impose stricter requirements and potentially stricter liability regimes on high-risk applications, such as those used in healthcare, finance, or public decision-making. This would not only enhance

transparency requirements. Such an approach would be consistent with broader trends in comparative law, where liability increasingly interacts with regulatory standards to ensure both prevention and compensation.⁵⁶

A second important implication concerns the modernisation of product liability rules to encompass AI systems and digital products.⁵⁷ In Vietnam, existing product liability provisions remain largely oriented toward tangible goods, creating a gap in cases involving purely digital harm or harm arising from software-driven processes. Adapting these rules to include AI systems would require not only legislative amendment but also conceptual clarification of what constitutes a “defect” in a digital environment. Unlike traditional products, AI systems may evolve over time through updates or machine learning, raising questions about when and how to assess defectiveness. The EU’s approach, which considers factors such as post-market changes and cybersecurity vulnerabilities, provides a useful reference point in this regard.⁵⁸ At the same time, introducing strict liability for certain categories of AI-related harm could significantly reduce the evidentiary burden on claimants, thereby enhancing access to justice. However, such reforms must be carefully calibrated to avoid imposing excessive burdens on domestic enterprises, particularly small and medium-sized firms that may lack the resources to manage complex liability risks.

In addition to product liability, Vietnam can draw important lessons from the concept of operator liability to address gaps in accountability.⁵⁹ In such cases, focusing exclusively on producers would leave significant areas of responsibility unaddressed. Recognising operator liability would allow Vietnamese law to capture the role of organisations and individuals who exercise control over AI systems and benefit from their use. This is particularly relevant in sectors such as finance, healthcare, and public administration, where AI is increasingly used to support or automate decisions with significant consequences. Introducing operatorbased liability does not necessarily require the creation of entirely new legal categories; rather, it may involve clarifying and extending existing doctrines related to fault, vicarious liability, and professional responsibility. For example, organisations that deploy high-risk AI systems could be subject to heightened duties of care, including obligations to ensure human oversight, conduct risk assessments, and monitor system performance. Failure to meet these duties could then form the basis for liability in the event of harm.⁶⁰

compensation in AI-related cases is the information asymmetry between claimants and defendants. In Vietnam, this problem is likely to be even more pronounced due to limited technical expertise and the absence of specialised procedures for handling complex technological disputes. Therefore, adopting mechanisms that facilitate access to evidence, such as disclosure obligations or judicial powers to order the production of relevant information, could significantly improve the effectiveness of the liability system. For instance, where a claimant can demonstrate that a defendant has violated established safety or regulatory standards, a presumption could arise that such a violation contributed to the harm. While such measures must be carefully designed to avoid abuse, they offer a pragmatic way to address the evidentiary challenges posed by AI systems.⁶² Furthermore, capacity-building within the judiciary, including training in digital technologies and the use of expert evidence, will be essential to ensure that courts can effectively adjudicate AI-related disputes.

Finally, it is important to emphasise that legal reform in this area should proceed incrementally and in coordination with broader policy developments. The EU experience demonstrates that civil liability cannot be considered in isolation but must be integrated with regulatory frameworks, data protection laws, and sector-specific rules.⁶³ At the same time, policymakers should remain attentive to the risks of over-regulation, particularly in a context where technological innovation is still developing. Striking an appropriate balance between encouraging innovation and ensuring accountability will require continuous evaluation and adjustment of legal rules. In this regard, the EU model offers not only substantive lessons but also methodological insights, particularly in its use of phased reform, stakeholder consultation, and evidence-based policymaking.⁶⁴ Ultimately, the goal for Vietnam should not be to replicate the EU framework in its entirety, but to develop a coherent and context-sensitive approach that draws on international experience while addressing domestic needs and constraints.

3.5. A proposed hybrid civil liability framework for AI in Vietnam

The preceding analysis demonstrates that neither traditional fault-based liability nor a purely strict liability regime is sufficient to address the complexities of AI-induced harm. Accordingly, this article proposes a Hybrid AI Liability Model for Vietnam (VHAIL Model)

introduced, either as strict liability or a rebuttable presumption of fault. Second, the framework distinguishes clearly between product liability and operator liability. Product liability should apply to defects embedded in AI systems, including errors in design, training data, and updates, as well as cybersecurity vulnerabilities. This requires expanding the legal definition of “product” in Vietnamese law to include software and AI-enabled systems. At the same time, operator liability should apply to entities that deploy, control, or benefit from AI systems in practice. Operators should be subject to heightened duties of care, including obligations to provide human oversight, conduct risk assessment, and monitor systems.

Third, the framework introduces evidentiary facilitation mechanisms to address information asymmetry. Courts should be empowered to order the disclosure of relevant technical information, subject to safeguards for trade secrets. This approach balances fairness to claimants with procedural protections for defendants. Fourth, the framework emphasises functional allocation of liability across the AI value chain. Rather than seeking a single liable party, the law should recognise that AI-induced harm often results from the interaction of multiple actors. This ensures that responsibility is distributed among those best positioned to prevent harm and absorb its costs. Finally, the proposed model adopts an incremental and adaptive approach to legal reform. Instead, pilot regulations, sector-specific rules, and gradual legislative amendments should be used to test and refine liability mechanisms over time. Practically, the VHAIL Model seeks to reconcile three key objectives: effective victim compensation, fair allocation of risk, and the promotion of responsible innovation. By integrating lessons from EU law with domestic legal conditions, it offers a practical and theoretically grounded pathway for developing AI liability in Vietnam. The VHAIL Model, thus, represents a structured normative contribution to AI liability discourse in emerging legal systems.

4 CONCLUSION

The rise of artificial intelligence has exposed the growing inadequacy of civil liability frameworks built for an earlier technological era. AI-induced harm does not fit neatly within the conventional architecture of tort law. The difficulty lies not in recognising that AI

instrument or a single doctrinal solution. Instead, it combines ex ante risk regulation with ex post liability mechanisms, thereby recognising that prevention and compensation must operate together. The EU AI Act establishes a risk-based governance structure that differentiates AI systems by the level of risk they pose, while the proposed AI Liability Directive and the Revised Product Liability Directive seek to modernise evidentiary rules and expand pathways to compensation. This development is especially important because it reflects a shift from a purely fault-centred logic toward a more victim-oriented and risksensitive model of accountability, particularly in situations where technical opacity would otherwise make legal redress illusory. Product liability remains indispensable because it addresses defects embedded in software, digital systems, and AI-enabled products. Yet it cannot fully capture harms arising from unsafe deployment, deficient human oversight, or inappropriate institutional reliance on algorithmic outputs. Therefore, operator liability has become an equally important conceptual development. By linking accountability to control, supervision, and benefit, operator liability fills a critical gap left by product-centred models and recognises that many AI risks emerge not only from design, but from implementation.

For Vietnam, the comparative lessons are both clear and qualified. They are clear because the current domestic framework, centred largely on the 2015 Civil Code,⁶⁶ is not yet equipped to respond coherently to AI-induced harm. It lacks explicit rules for allocating liability among developers, deployers, and operators; it offers limited procedural tools for addressing evidentiary asymmetry; and it does not yet incorporate a risk-based approach capable of distinguishing between lowand high-risk AI applications. Nevertheless, the lessons are also qualified because legal transplantation cannot be mechanical. Vietnam should not replicate the EU model in its entirety, nor should it assume that regulatory sophistication alone guarantees legal effectiveness. In that sense, the principal value of the EU framework lies not in providing a rigid template, but in offering a set of transferable principles: risk differentiation, clearer allocation of responsibility, expanded product liability for digital systems, stronger operator duties, facilitated access to evidence, and closer coordination between regulatory obligations and civil remedies. Accordingly, the most appropriate path for Vietnam is one of incremental and contextsensitive reform. The first step is conceptual: Vietnamese law must acknowledge that AIinduced harm raises problems that cannot always be resolved through conventional tort

corrective device, but as one component of a coherent system of technological accountability. The EU experience demonstrates that such a balance is difficult but achievable. For Vietnam, the task ahead is to translate that insight into a legal framework that effectively protects victims, allocates risk fairly, and supports responsible innovation in an increasingly intelligent digital economy. The proposed model for Vietnam illustrates how such a transformation can be achieved in practice, thereby contributing to broader debates on AI governance and liability in emerging economies.

FOOTNOTES

REFERENCES

AUTHORS INFORMATION

RIGHTS AND PERMISSIONS

EDITORS

ABOUT THIS ARTICLE

FUNDING AND APC STATEMENT

DETAILS FOR PUBLICATION

AI DISCLOSURE STATEMENT

TÓM TẮT BẰNG TIẾNG VIỆT