Executive Summary
- The Vietnamese supplier should negotiate a version-specific commercial weights licence, conditional on a documented permission chain and release requirements. Apache License 2.0 permits commercial modification, sublicensing and redistribution, subject to its conditions. Qwen2.5-7B serves as a licence example for this hypothetical transaction. (Apache License 2.0, §§ 2–4.)
- A lawful-training warranty needs separate evidence for the supplier’s fine-tuning corpus and the upstream model. Apache supplies no ordinary upstream title or non-infringement warranty. The parties must obtain a supported separate undertaking, select a model with adequate assurances or narrow the promise. (Apache License 2.0, §§ 7–9.)
- Fine-tuning creates new EU general-purpose AI provider obligations when the applicable provider test is met. The supplier should document the significant-change assessment and applicable compute comparison with the original model. Not every modification creates a new provider. (Regulation (EU) 2024/1689, Arts 3(3), 3(63), 53; Commission Guidelines C(2025) 7719 final, paras 59–66.)
- A privately supplied commercial derivative cannot inherit the base model’s free and open-source exemptions automatically. The supplier must assess its actual release. Even qualifying releases retain copyright-policy and public training-summary duties; systemic-risk models face further requirements. (Regulation (EU) 2024/1689, Arts 53–55.)
- Vietnamese development and export require their own assessment. A weights-and-know-how transfer may require technology-transfer registration. A hosted service processing personal data can trigger a separate business certificate, alongside AI and data duties. (Law No. 07/2017/QH14, as amended by Law No. 115/2025/QH15, Arts 4, 24, 31; Decree No. 356/2025/NĐ-CP, Arts 21–25.)
- The buyer’s statutory information entitlement differs from its procurement request. Where Article 53(1)(b) applies, the provider must supply the required downstream information, including Annex XII. The authority-facing Annex XI file does not become a universal buyer disclosure entitlement. Additional evaluation evidence, support and change notices should be specified in the contract. (Regulation (EU) 2024/1689, Art 53(1)(a)–(b), Annexes XI–XII.)
- An API changes the access bargain without removing model-provider duties or resolving personal-data roles. Identifiable customer tickets sent to Vietnam need a lawful processing and transfer arrangement. EU hosting with restricted Vietnamese support access is a proposed way to reduce those transfers. (Regulation (EU) 2016/679, Arts 3, 28, 44–46; Commission Implementing Decision (EU) 2021/914.)
- The supplier should withhold release if a requested use exceeds upstream rights or the required documentation cannot be delivered. A later upstream release on different terms does not, by itself, revoke the existing compliant Apache grant. A higher-risk customer deployment needs a fresh role, use and documentation assessment under the applicable commencement rules. (Apache License 2.0, §§ 2–4; Regulation (EU) 2024/1689, Arts 25, 113, as amended by Regulation (EU) 2026/1744.)
The licence must identify each asset and its permitted use
The supplier should describe the delivered model and the buyer’s intended acts before negotiating a general promise of ownership. Model weights are the numerical parameters used when the model produces an answer. Downloading them gives the integrator operational control that an API, which accepts requests and returns responses, ordinarily leaves with the supplier. Neither delivery method establishes the supplier’s authority to grant every requested right.
The transaction involves several legally distinct assets. The original model has its own licence and release identifier. Modified weights incorporate the fine-tuning result, whose exploitation remains subject to applicable upstream conditions. Fine-tuning code, inference software and other dependencies require their own permission records. Software copyright, where its conditions are met, protects the program’s expression; the legal classification of every numerical weight does not follow from that rule. (Directive 2009/24/EC, Arts 1–2.)
The business documents and prospective-customer materials form a separate training corpus. Permission to use them during development need not include onward delivery to the buyer. Generated responses can reproduce protected material or contain personal data, even where a contract permits commercial use of outputs. The integrator’s finished support system adds its own interface, retrieval sources, instructions and operational decisions. Those additions require separate rights and can change the applicable AI obligations. (Directive (EU) 2019/790, Arts 3–4; Regulation (EU) 2016/679, Arts 4–6; Regulation (EU) 2024/1689, Arts 3, 53.)
The supply schedule should therefore identify the base checkpoint, modified weights, supplied code, dependencies and permitted downstream products. It should distinguish rights supplied under the upstream licence from permissions the Vietnamese developer grants over its own contributions. Contractor assignments and employee-created code records should support the latter grant. Vietnam’s copyright rules require attention to the actual employment or commission and to qualifying human creative contribution. The developer should permit agreed output exploitation without guaranteeing that every output attracts exclusive protection. (Vietnam Intellectual Property Law, Arts 39, 47–48; Decree No. 17/2023/NĐ-CP, Art 5a, inserted by Decree No. 134/2026/NĐ-CP.)
The strongest commercial objection is that buyers want one accountable supplier, rather than separate permission checks. The developer can take contractual responsibility for assembling and maintaining the agreed package. That undertaking cannot create rights against an absent copyright owner or excuse breach of an upstream condition. A coherent single contract still needs an asset schedule and an express allocation of third-party rights.
Apache 2.0 can support commercial redistribution of the selected release
Qwen2.5-7B illustrates a permissive base licence for the hypothetical transaction. The base model at revision d149729398750b98c0af14eb82c78cfe92750796 is supplied under Apache License, Version 2.0, January 2004. Those permissions do not establish technical suitability for customer support. Other releases and variants require their own licence check. (Qwen/Qwen2.5-7B, LICENSE at the identified revision.)
Apache section 2 permits reproduction, preparation of derivative works, sublicensing and distribution. It imposes no general prohibition on commercial use or fine-tuning. Section 4 permits additional or different terms for modifications and derivative works as a whole, provided use, reproduction and distribution comply with Apache. The developer can therefore sell access to its modified weights under a negotiated commercial agreement, without a general obligation under that licence to publish its training data or modifications. Recipients’ upstream permissions must remain intact. (Apache License 2.0, §§ 2, 4.)
Redistribution requires a copy of the licence, prominent notices on modified files stating that they were changed, and preservation of applicable notices. A NOTICE file must be handled as section 4 requires if the supplied work includes one. The supplier should inspect every included component for its own notice obligations. Apache section 6 does not grant a general right to use the original publisher’s trademarks or imply endorsement. Own branding must respect that limit. (Apache License 2.0, §§ 4, 6.)
The patent permission is narrower than a guarantee against all patent claims. Section 3 covers specified contributor-licensable claims necessarily infringed by the contribution or its combination with the work. If the recipient institutes patent litigation alleging that the work or an incorporated contribution infringes a patent, the specified patent licences terminate as of filing. The buyer should receive the actual clause and a separate account of any patent protection the supplier offers; the copyright grant cannot be presented as universal patent clearance. (Apache License 2.0, §§ 2–3.)
The decisive objection concerns upstream training rights. Sections 7 and 8 generally disclaim warranties, including title and non-infringement, subject to applicable law or written agreement. Section 9 permits a redistributor to accept additional warranty or indemnity obligations on its own responsibility, with protection for contributors against claims caused by that undertaking. Apache permits the proposed distribution but provides no contractual assurance that every upstream training item was lawfully used. A buyer demanding that assurance must obtain a separate promise supported by evidence or select a different supplier arrangement. (Apache License 2.0, §§ 7–9.)
Restricted open weights can prevent the requested commercial bargain
Access to weights is insufficient where the applicable terms conflict with the buyer’s intended product. The Llama 3.1 Community License, released on 23 July 2024, provides a bounded comparison. Section 1(b)(i) requires the specified “Built with Llama” display and a Llama prefix for relevant fine-tuned model names when distributed or made available. It addresses products and services as well as the model materials. (Llama 3.1 Community License Agreement, § 1(b)(i).)
If this buyer requires wholly unqualified own-brand distribution and rejects those conditions, the supplier cannot give that licence under the standard terms. The parties can accept compliant branding, obtain separate permission or change the base model. Hosting the same restricted model behind an API would not remove a condition that expressly applies to the service. A different upstream instrument might permit hosting while restricting weight redistribution, so the supplier must test the actual service grant before offering that alternative.
An API-only contract would also change the buyer’s proposed business. The agreement must specify which downstream applications and customers may call the service, whether credentials can be passed on, and which output uses are permitted. It should address availability, termination, data export and migration because continued operation depends on access to the supplier’s service. The integrator must accept those access rights in place of the requested redistribution right.
Fine-tuning requires a documented EU provider assessment
The Vietnamese company should compare the original and modified models before deciding whether it owes general-purpose AI, or GPAI, provider duties. A GPAI model displays significant generality and can competently perform a wide range of distinct tasks. Incorporating it into a narrow customer-support application does not itself remove that generality. Provider status concerns developing or having the relevant model developed and placing it on the market under the actor’s name or trademark. (Regulation (EU) 2024/1689, Arts 3(3), 3(63).)
The Commission’s final GPAI Guidelines assess whether a downstream modification significantly changes generality, capabilities or systemic risk. Their quantitative indicator is modification compute exceeding one-third of the original model’s training compute. This is an indicative assessment in nonbinding guidance, rather than a statutory safe harbour below that number. A capability change can require closer assessment even where the compute comparison appears favourable. When the original compute cannot reasonably be known and cannot be estimated, paragraph 61 supplies different indicative reference points for systemic-risk and other GPAI models. (Commission Guidelines C(2025) 7719 final, paras 59–61.)
The supplier should retain the base version, training method, added data, compute calculation and evaluations of changed capabilities. It should explain whether the modified model remains general purpose and why the modification does or does not make it a new provider. Its own branding is relevant to the statutory definition, but cannot replace the assessment of the modified model. A small customer-specific adaptation should not be classified as a new GPAI model merely because files changed.
If the supplier becomes a downstream GPAI provider, its Article 53 obligations concern the modification or fine-tuning. That limits the scope of its new technical documentation, copyright policy and training summary; it does not authorise a claim that the developer audited the original training corpus. The supplier must still assess Article 54 representation. If the modification does not create provider status, the buyer can negotiate information and support contractually without misdescribing those promises as the modifier’s automatic statutory duties. (Commission Guidelines C(2025) 7719 final, paras 65–66.)
The supplier’s actual release determines the open-source exemptions
A commercial weights transaction should budget for the ordinary GPAI duties unless the supplier’s own release qualifies for the specific exceptions. Article 53(2) requires a free and open-source licence allowing access, use, modification and distribution, together with public parameters, including weights, architecture information and model-usage information. The exemption does not apply to a model with systemic risk. A publicly available Apache base cannot establish those facts for a privately supplied derivative. (Regulation (EU) 2024/1689, Arts 51, 53(2).)
For a qualifying release, Article 53(2) exempts the documentation duties in Article 53(1)(a) and (b). Copyright-policy and public training-summary obligations under paragraphs (c) and (d) remain, as does cooperation with the Commission and national authorities. Article 54(6) exempts qualifying releases from appointing an EU authorised representative. A qualifying systemic-risk model cannot use these exemptions and must also satisfy Article 55. (Regulation (EU) 2024/1689, Arts 53–55.)
The Commission distinguishes optional paid services around a freely available model from arrangements that make access or essential support conditional on payment. Its guidance also examines commercial, scale and redistribution restrictions, while allowing limited proportionate safety conditions. These details prevent a blanket equation between open weights and qualifying open source AI. The developer can choose a qualifying public release, but that choice changes its commercial control over distribution and does not remove copyright or training-summary duties. (Commission Guidelines C(2025) 7719 final, paras 80–86.)
The recommended private weights licence therefore does not rely on these exemptions. If the modification creates GPAI provider status, the commercial plan should fund the applicable documentation and representation. Commercial use of open source AI remains possible under permissive upstream terms even when the supplier’s downstream release receives no AI Act exemption.
Weights and API supply allocate different operational responsibilities
A Vietnamese GPAI provider that places its model on the Union market falls within the AI Act even without an EU establishment. Before placement, Article 54 ordinarily requires a written mandate to an authorised representative established in the Union. The buyer does not acquire that role merely by buying the model, and incorporation of a European subsidiary is not the statutory prerequisite. The representative must perform the specified checks and cooperation duties. It must retain a copy of the Annex XI technical documentation for ten years after placement and keep the provider’s contact details. (Regulation (EU) 2024/1689, Arts 2(1)(a), 54.)
With downloaded weights, the integrator ordinarily provides the finished support system under its own name. Business customers that operate it are deployers. A model purchase does not automatically make the buyer an importer of an AI system, because that statutory definition concerns systems. Under an API arrangement, the Vietnamese supplier can provide the model and a hosted system, while the integrator provides its composed customer-support product. The parties must identify which actor controls each interface, intended purpose and release. (Regulation (EU) 2024/1689, Art 3(3)–(7), (63), (68).)
Ordinary business customer support is not high risk merely because it uses a foundation model. Direct interaction with people can still trigger Article 50(1): the system provider must arrange disclosure that the person is interacting with AI, unless the statutory obviousness exception applies. Article 50(2) separately requires system providers to ensure that synthetic outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The provision’s technical requirements and exceptions qualify that duty. The exceptions for standard editing or functions that do not substantially alter input data or its semantics must be tested against the actual product; they do not exempt every generated support reply. The API and integration specifications should allocate the necessary metadata and interface work without suggesting that contractual allocation releases either legal addressee. (Regulation (EU) 2024/1689, Arts 6, 50, Annex III.)
Timing must follow the particular model and system. GPAI obligations began on 2 August 2025; providers of GPAI models placed on the Union market before that date have the Article 111(3) transition until 2 August 2027. An older base model’s global release does not establish Union placement, and a new qualifying downstream model cannot inherit that transition automatically. Article 50 applies to new support systems; the marking grace until 2 December 2026 concerns qualifying systems placed before 2 August 2026. The parties should record separate placement dates for the base model, derivative and downstream system. (Regulation (EU) 2024/1689, Arts 111(3)–(4), 113, as amended by Regulation (EU) 2026/1744.)
Licentium’s EU market-access guide provides further background on these roles. For this supply contract, each statutory duty needs an identified responsible entity, a delivery date and an agreed evidence source.
Vietnamese development and technology export impose separate release conditions
Development in Vietnam remains a legally relevant activity even where the buyer deploys the finished product in Europe. The Law on Artificial Intelligence No. 134/2025/QH15 has applied since 1 March 2026. Decree No. 142/2026/NĐ-CP, effective from 1 May 2026, expressly confines its risk-classification procedure to AI systems. A standalone model is excluded unless it forms part of a specific system. That distinction can matter to the weights package, but it does not remove separate copyright, data or technology-transfer obligations. (Law No. 134/2025/QH15, Arts 1–3, 34; Decree No. 142/2026/NĐ-CP, Art 6(2).)
For a system within the Vietnamese rules’ territorial scope, a customer-facing support chatbot can meet the medium-risk criteria concerning failure to recognise AI interaction. An internal drafting or technical tool can fall within specified exclusions. The provider must assess the actual purpose and interface against Decree 142 and the high-risk list in Decision No. 33/2026/QĐ-TTg, effective from 15 August 2026. Ordinary customer support does not justify an automatic conclusion for every product sold under that description. (Decree No. 142/2026/NĐ-CP, Arts 8–9; Decision No. 33/2026/QĐ-TTg, Annex.)
A medium-risk system brings classification, documentation, notification and transparency requirements. Material changes to purpose or operating context require reassessment. Decree 142 also contemplates contractual information cooperation between model suppliers and system providers. Its documentation provisions account for information within lawful access and control and permit sufficient equivalent foreign documentation; they do not create an unconditional demand for every training item or source-code file. The buyer’s agreement should specify the model information needed for the actual system while preserving lawful regulatory access. (Law No. 134/2025/QH15, Arts 9–11, 14–15, 28, 31; Decree No. 142/2026/NĐ-CP, Arts 6, 11–12, 16–17.)
The law’s transitional periods concern systems operating before 1 March 2026. They do not supply a general postponement for this proposed new release. Nor does describing the customer as foreign create a blanket exemption for local training and development. The supplier should record which activities occur in Vietnam and distinguish a model delivery from a hosted system it operates there. (Law No. 134/2025/QH15, Arts 1–3, 35.) Separately, Decision No. 33/2026/QĐ-TTg provides a transition for systems put into operation within six months of 15 August 2026, requiring providers and deployers to complete AI-law compliance obligations before 1 March 2027. Its application must be checked against the Decision’s scope, the system’s classification and the launch date. (Decision No. 33/2026/QĐ-TTg, Arts 3(1), 4(3).)
Technology-transfer rules can affect the weights contract’s effectiveness. The amended Law on Technology Transfer expressly includes models, algorithms, software, information and data among transferable technologies. Its definition concerns transferring ownership or use rights to apply technology in production or services. A package of weights, implementation information and know-how that lets the EU buyer operate the technology therefore warrants an assessment under that regime. The inclusion of software in the statutory list does not make every remote service a transfer. (Law No. 07/2017/QH14, as amended by Law No. 115/2025/QH15, Arts 2(7), 4(1)(b), 5.)
For a registrable export transfer, Article 31 requires registration and Article 24(3) ties contractual effectiveness to the registration certificate. The statutory filing period cannot be treated as permission to perform an ineffective transfer before certification. The Vietnamese exporter must support its application with the rights and contract records required by Decree 101. Restricted or prohibited technology requires a separate list assessment; an ordinary model description is insufficient to clear a specific export package. (Law No. 07/2017/QH14, Arts 7, 22–25, 31; Decree No. 101/2026/NĐ-CP, Arts 20–21, Annexes II–III.)
The recommended licence should make any required registration or technology permission a condition of effective delivery. It should identify the party responsible, the supporting evidence and the result if the condition fails. A pure hosted service can produce a different technology-transfer answer if no ownership or use right of that kind is transferred, but its continuing data-processing obligations still require separate treatment.
The fine-tuning corpus needs permissions that cover commercial exploitation
The developer should refuse a blanket lawful-training warranty until the agreed corpus and actual permissions support it. A licence for business documents must cover the relevant copying, preprocessing, fine-tuning and commercial exploitation. The customer’s possession of a document does not establish authority to license every incorporated work. Prospective-customer material supplied for a demonstration also needs an express decision about production use, retention, cross-customer training and disclosure to the integrator.
For EU acts, Article 4 of the Copyright in the Digital Single Market Directive permits specified text-and-data-mining reproductions and extractions of lawfully accessible material where rights have not been appropriately reserved. Necessary retention and the form of reservations matter. Article 3’s separate scientific-research exception does not become available to an ordinary commercial developer merely because it experiments with a model. Member State implementation and the location of the relevant acts remain decisive. The Directive does not supply a Vietnamese training permission or resolve every later model or output infringement claim. (Directive (EU) 2019/790, Arts 2–4, 7.)
Vietnam’s amended Intellectual Property Law and Decree No. 134/2026/NĐ-CP require a separate analysis. The decree distinguishes non-commercial uses from commercial AI training and exploitation. Commercial exploitation brings recordkeeping, rights-reservation and remuneration obligations; paying royalties alone does not establish a universal training licence. The company should obtain express commercial permissions for this scheduled corpus unless it can establish every condition of an applicable statutory route. A general assertion that publicly accessible data is free to train on would not support this transaction. (Law No. 50/2005/QH11, as amended by Law No. 131/2025/QH15, Art 7(5); Decree No. 17/2023/NĐ-CP, as amended by Decree No. 134/2026/NĐ-CP, Arts 37a–37c.)
Confidentiality duties and personal-data law impose separate conditions even when copyright use is lawful. The supplier should record each source, rightsholder, licence, purpose restriction and retention period. It should segregate customer-specific data, limit access and agree whether the buyer receives source material, summaries or controlled inspection. A confidentiality obligation does not disappear when documents become training inputs, and a customer’s contractual assurance cannot establish a missing privacy legal basis. (Directive (EU) 2016/943, Arts 2, 4; Regulation (EU) 2016/679, Arts 5–6, 9, 28.)
The buyer can reasonably request infringement evaluations because lawful ingestion does not establish harmless outputs. In a German first-instance music-model case, the Munich Regional Court treated reproducible memorised works as infringement and rejected the relevant text-and-data-mining defence. The judgment is not final, and the official record identifies an appeal. It does not establish that all model weights infringe or decide the Vietnamese hypothetical. It supports a focused contractual demand for testing of memorisation and reproduction in the proposed model and use. (LG München I, judgment of 31 July 2026, 42 O 763/25, paras 262–310; appeal recorded as OLG München, 6 U 2314/26 e.)
The supplier’s own lawful-use warranty should identify the release, scheduled data and permitted activities it can evidence. Upstream facts should be supported by available model records, applicable licences and separately obtained assurances. A buyer may still demand a broader supplier indemnity as a price of doing business. The developer can accept that financial exposure only as its own undertaking; the indemnity does not supply missing permissions or establish that training was lawful. (Apache License 2.0, §§ 7–9.)
Personal-data roles must follow training and support operations
The parties should separate customer-directed processing from the supplier’s own reuse. A supplier processing identifiable support tickets solely on documented instructions may act as processor or subprocessor. If it decides to reuse those tickets to train a general product across customers, it determines a further purpose and acquires controller responsibilities for that processing. The contract’s chosen label cannot override those operational facts. (Regulation (EU) 2016/679, Arts 4(7)–(8), 28(10).)
An EU customer does not automatically make every activity of the Vietnamese company subject to the GDPR’s territorial provisions. Article 3 requires an establishment connection or the relevant offering or monitoring of people in the Union. The EU controller or processor must still comply with its own outsourcing and transfer duties. An Article 27 representative, where required, is a separate appointment from the AI Act’s Article 54 representative. (Regulation (EU) 2016/679, Arts 3, 27–28, 44–46.)
Identifiable customer material requires a lawful processing basis, compatible purposes, transparency and appropriate security. Special-category information requires an additional Article 9 condition. The AI Act’s limited bias-detection provision does not create a general permission for ordinary customer-support training. Depending on the processing, a data-protection impact assessment may be required even though the support system is outside the AI Act’s high-risk categories. The supplier should test for personal-data extraction from weights; deleting source documents alone does not establish that a trained model is anonymous. (Regulation (EU) 2016/679, Arts 5–6, 9, 13–14, 25, 32, 35; Regulation (EU) 2024/1689, Art 4a, inserted by Regulation (EU) 2026/1744, Art 1(6); EDPB Opinion 28/2024, paras 27–55, 66–75.)
Vietnam has no EU adequacy decision. Sending tickets to a Vietnamese API, or allowing a separate Vietnamese support company remote access to EU-hosted personal data, therefore needs a valid Chapter V transfer arrangement. The 2021 standard contractual clauses can be relevant, with the module selected for the actual controller and processor relationships. Their scope excludes importer processing already directly subject to the GDPR. The parties must assess that threshold and the destination-country laws, practices and safeguards; signing a form alone does not complete the transfer assessment. (Regulation (EU) 2016/679, Arts 44–46; Commission Implementing Decision (EU) 2021/914, Art 1, Annex, clauses 14–16; EDPB Guidelines 05/2021, version 2.0, example 11.)
EU deployment of downloadable weights can reduce routine transfers if support uses redacted or synthetic cases and excludes Vietnamese access to identifiable logs. Redaction must be effective, and any retained remote access needs its own assessment. The API option remains commercially available only when the parties can support the actual data flow and its Vietnamese requirements.
A Vietnamese personal-data API can require certification and filings
Vietnam’s Personal Data Protection Law No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP have applied since 1 January 2026. The decree replaced Decree No. 13/2023/NĐ-CP. The law applies to Vietnamese organisations under its domestic scope provision, so foreign customers’ personal data cannot be dismissed solely because the people concerned are outside Vietnam. Processing grounds, purpose restrictions and the processor agreement must cover the actual training and support activities. (Law No. 91/2025/QH15, Arts 1–2, 9, 19, 37–39; Decree No. 356/2025/NĐ-CP, Arts 41–42.)
The parties should prepare the required processing and outward-transfer impact assessments and meet the applicable filing deadlines and exemptions. The ordinary transfer filing period is sixty days from the first transfer. The Data Law permits incoming foreign data to be processed in Vietnam, but that permission does not itself exempt a subsequent outward transfer of personal data. Returning identifiable records or outputs to a foreign customer must be assessed under the actual transfer provisions. (Law No. 91/2025/QH15, Arts 20–22; Decree No. 356/2025/NĐ-CP, Arts 17–20; Law No. 60/2024/QH15, Art 23(1).)
The API can also fall within the defined business of personal-data processing services. Decree 356 includes supplying and operating automated systems on a controller’s behalf and automated processing of personal data using AI. Articles 22–25 impose certificate conditions for the covered service. A Vietnam-hosted API handling identifiable support tickets presents a materially stronger case for that regime than a bare weights delivery with no supplier processing. The supplier should obtain the required certificate before starting the covered service; a transfer filing receipt is not a certificate for the business. (Decree No. 356/2025/NĐ-CP, Arts 21–25.)
The enacted Decree No. 392/2026/NĐ-CP changes assessment and certificate procedures from 15 November 2026. It preserves the substantive service categories and certificate conditions, with a transition for applications already received. The launch and filing dates should determine the applicable procedure. The parties should also classify the actual data for any core or important-data rules, rather than treating every business document as ordinary data. Personal-data assessment follows the specific personal-data regime under the amended Data Decree. (Decree No. 392/2026/NĐ-CP, Arts 42–49; Law No. 60/2024/QH15, Arts 3, 13; Decree No. 165/2025/NĐ-CP, Arts 12, 16(2), as amended by Decree No. 356/2025/NĐ-CP, Art 42(3).)
Vietnam’s cybersecurity storage and disclosure requirements must also be tested against the actual service and users. Decree 333’s domestic storage provision concerns specified data of service users in Vietnam. The EU customer’s place of incorporation does not establish every user’s location. Applicable logging and disclosure duties can affect a no-retention promise and the GDPR transfer assessment. (Law No. 116/2025/QH15, Art 25(3); Decree No. 333/2026/NĐ-CP, Arts 16, 19–20.)
The buyer needs a defined statutory and commercial handover
Where Article 53(1)(b) applies, the GPAI provider must supply downstream system providers with the required information, including at least Annex XII. That package must allow the buyer to understand capabilities and limitations and meet its own AI Act obligations. It includes model identification and release information, intended tasks, integration requirements, architecture and parameter information, input and output modalities, licence details and relevant training-data provenance and curation information. The extent of the supplier’s modification matters when it is a downstream model provider. (Regulation (EU) 2024/1689, Art 53(1)(b), Annex XII; Commission Guidelines C(2025) 7719 final, para 65.)
Where the base provider benefits from Article 111(3), the buyer cannot treat its full Article 53 package as already legally due before 2 August 2027. The procurement schedule should identify what that provider supplies and what further information must be negotiated. The new supplier’s own applicable duties remain separate. (Regulation (EU) 2024/1689, Arts 53, 111(3).)
Article 53(1)(a) requires Annex XI technical documentation for the AI Office and competent authorities where that duty applies. The buyer does not automatically receive the complete authority file, raw training corpus, source code or every proprietary evaluation record. Article 53(1)(b) still requires information necessary for the downstream provider, with protection for intellectual property and confidential information. A supplier cannot use a general trade-secret objection to withhold material that provision requires. Controlled access and confidentiality terms can permit the necessary disclosure without an unrestricted data-room licence. (Regulation (EU) 2024/1689, Art 53(1)(a)–(b), Annexes XI–XII.)
A GPAI provider must also implement a policy to comply with Union copyright law, including identifying and complying with relevant rights reservations. Placement on the Union market engages that policy duty regardless of the training location. It does not determine the copyright law governing every separate training act in Vietnam. (Regulation (EU) 2024/1689, Art 53(1)(c), recital 106; Directive (EU) 2019/790, Art 4(3).)
The public training summary is another document. Article 53(1)(d) requires the sufficiently detailed summary under the AI Office template. The Commission’s final explanatory notice permits appropriately limited detail for licensed or non-public third-party datasets. A qualifying modifying provider’s summary covers its modification training data and identifies the base model. Customer-specific fine-tuning is excluded from one user-data category, rather than from the entire summary obligation. The supplier must reconcile publication with confidentiality before accepting customer data. (Regulation (EU) 2024/1689, Art 53(1)(d); Commission Communication C(2025) 8311 final, paras 13, 19, 21, 28–33.)
The buyer should negotiate further evidence where its intended use requires it. The schedule should state the evaluations supplied, test conditions, known failure modes, languages, retrieval assumptions, security findings and limitations on the results. It should identify dependencies, release hashes, unresolved defects, documentation updates and a route for technical questions. These are contractual deliverables to the extent they exceed the applicable statutory minimum; a procurement demand alone does not create a duty to disclose every upstream secret.
The voluntary GPAI Code of Practice can help specify implementation, but adherence is not regulatory approval or proof of lawful training. Its signatories’ fourteen-day commitment for certain additional downstream information allows exceptional circumstances and is not a universal statutory response deadline. The contract should set its own response periods and distinguish emergency security notices from routine requests. (Regulation (EU) 2024/1689, Arts 53(4), 56; General-Purpose AI Code of Practice, Transparency chapter, Measure 1.2.)
The contract should allocate evidence duties and infringement remedies
The parties should settle the permitted deployment before signing an unconditional redistribution grant. The schedule should identify model versions, authorised downstream products, territory, customer access, sublicensing, attribution and prohibited uses. It should specify whether the buyer may fine-tune, merge, quantise or redistribute weights and which supporting materials accompany onward supply. Applicable upstream conditions must reach the actors whose conduct can breach them. (Apache License 2.0, §§ 2–4; Llama 3.1 Community License Agreement, § 1(b)(i).)
Customer-data reuse should require a separate, evidenced permission and lawful processing basis. Support provisions should identify access controls, retention, incident escalation and deletion or return duties. Security fixes and documentation corrections should have defined notice and delivery processes. The integrator should receive advance notice of planned changes that affect agreed capabilities, rights or compliance, with an emergency route where immediate action is required. These provisions give the buyer evidence and operational remedies without transferring provider duties away from their statutory addressee. (Regulation (EU) 2016/679, Arts 28, 32–33; Regulation (EU) 2024/1689, Arts 50, 53–54.)
The warranty schedule should distinguish supplier-controlled acts from disclosed upstream dependencies. An infringement clause should address claim notice, defence control, evidence preservation and consent to settlements that affect the buyer’s operations. Remedies should include obtaining permission, supplying a compliant replacement, retraining where appropriate, or agreed refunds and termination if lawful performance cannot continue. Any liability cap must be tested under the chosen law and cannot remove mandatory GDPR or transfer-clause performance duties. Apache section 9 also requires attention to claims against contributors caused by the supplier’s additional undertaking. (Apache License 2.0, § 9; Commission Implementing Decision (EU) 2021/914, Annex, clauses 14–16.)
The strongest buyer objection is that a qualified warranty leaves it carrying upstream risk. The parties can negotiate additional diligence, direct upstream assurances, insurance where available and a separately priced indemnity. If the buyer insists on an unsupported guarantee covering all historic training and every jurisdiction, the supplier should decline that promise or change the model and rights arrangement. A stronger contractual remedy can allocate loss; it cannot make continued infringement lawful.
The contract also needs a chosen law, forum and enforceable remedy structure. In participating EU courts, Rome I permits contractual choice subject to its limits, including overriding mandatory provisions. Rome II applies a separate rule to intellectual-property infringement, generally the law of the country for which protection is claimed, which the parties cannot displace by agreement. Vietnam’s Civil Code also permits contractual choice subject to its exceptions and applies protection-country law to intellectual property. Choosing a contract law cannot settle every third-party claim or displace public duties that apply under their own scope. The final clause must match the chosen forum and the Vietnamese supplier’s obligations and assets. (Regulation (EC) No. 593/2008, Arts 2–3, 9; Regulation (EC) No. 864/2007, Art 8; Vietnam Civil Code No. 91/2015/QH13, Arts 670, 679, 683.)
Changed terms and a later hiring use need separate decisions
A new upstream licence should trigger a release-specific review. Apache section 2 grants perpetual, irrevocable copyright permissions subject to its conditions; a later release or website change does not alone replace the terms of an existing compliant checkpoint. The supplier should preserve the accepted licence, repository revision and distributed artefacts, then evaluate the new version separately. Actual non-compliance, a third-party claim, a court order or a different binding agreement can still affect continued use. Apache’s patent-litigation rule requires a separate assessment. (Apache License 2.0, §§ 2–4.)
If the proposed update carries incompatible terms, the supplier should identify the affected version and explain which requested rights it cannot pass on. It can retain the lawful existing release where continued operation remains permissible, secure additional permission, supply a compatible replacement or renegotiate the buyer’s scope. A generic notice that “the licence changed” is insufficient to justify suspension of every installed copy. If a particular use is unlawful or prohibited, the response should address that use and the applicable suspension, withdrawal or termination requirements.
A technical update also requires an evaluation of changed capabilities, provider status, documentation and privacy effects. The buyer should receive changed evaluations and integration instructions before accepting an update that alters its intended use or controls. A new release must not be treated as compliant merely because an earlier version passed the agreed tests. (Regulation (EU) 2024/1689, Arts 53–54; Commission Guidelines C(2025) 7719 final, paras 59–66; Regulation (EU) 2016/679, Arts 25, 32, 35.)
For a bounded later variant, suppose the integrator repurposes the product on or after 2 December 2027 to rank job applicants and materially influence hiring. Annex III, point 4(a), brings that use into the high-risk assessment. Article 6(3)’s limited exceptions require their own conditions, and profiling of natural persons remains high risk under that provision. Regulation (EU) 2026/1744 postpones the relevant Chapter III requirements for Article 6(2) systems until 2 December 2027; Article 6(1) product-related systems have a separate 2 August 2028 date. This later hiring variant should be planned against the former date. (Regulation (EU) 2024/1689, Arts 6, 113, Annex III, point 4(a), as amended by Regulation (EU) 2026/1744.)
When the applicable high-risk provisions operate, a party changing a non-high-risk system’s intended purpose so that it becomes high risk can acquire high-risk-provider responsibilities under Article 25(1)(c). Article 25(4) requires the high-risk provider and supplying third parties to agree necessary information, access and assistance in writing. Its free and open-source carve-out expressly excludes GPAI models. Article 25(2)’s limited exception for an initial system provider that prohibited conversion to high-risk use does not erase a model provider’s separate duties. A substantial modification of a high-risk system can also require renewed conformity assessment. (Regulation (EU) 2024/1689, Arts 3(23), 25, 43(4), 111(2), as amended by Regulation (EU) 2026/1744.)
The supplier should therefore make the hiring change a separate permission and support decision. It should decline the changed scope where the licence prohibits it or the necessary evidence and assistance cannot be supplied. If the parties proceed, they need a revised intended-purpose record, role allocation, evaluations and documentation before that deployment. A clause limiting ordinary customer support can control the contractual bargain, but cannot prevent statutory duties arising from what either party actually does.
Release should follow the rights and evidence conditions for each offer
The preferred proposal is a pinned permissive base, a commercial licence for the supplier’s evidenced contributions and an express pass-through of upstream conditions. The integrator would host the downloaded weights, with Vietnamese support restricted to synthetic or effectively redacted cases where feasible. This arrangement preserves the buyer’s requested redistribution option and reduces routine access to identifiable support data. It remains conditional on the fine-tuning rights, Vietnamese transfer requirements, provider assessment and applicable EU documentation and representation. Onward distribution also reduces the supplier’s control over vulnerable copies. The integrator must be able to manage versions, downstream distribution and remediation under the agreed release conditions.
The parties can sign a preparatory development or evaluation agreement limited to lawful activities and rights already available. Any registration, licence or market-placement duties triggered at that stage still apply; an evaluation label creates no general exemption. An unconditional production grant and lawful-training warranty should wait until the scheduled evidence supports them. The buyer should receive the identified release package, agreed evaluations, licence and notice files, applicable public summary and a named route for incidents and changes. A failed condition should have an agreed replacement, renegotiation or exit consequence.
The API offer deserves a separate conditional decision. It can proceed when the upstream terms permit the service, the buyer accepts service access instead of weight redistribution, and the supplier can meet the applicable provider, Vietnamese service and personal-data requirements. It should be declined where hosting merely conceals an incompatible licence or an unsupported data flow. The contract should preserve usable customer records and a migration route if the supplier must stop the affected service.