Based on my practical observations with import-export SMEs, the unmonitored use of AI by employees — what we call "Shadow AI" — exposes businesses to severe commercial, legal, and financial liabilities.  Public AI tools like ChatGPT, Gemini, or CapCut are making the daily operational workflows of our businesses faster and much more convenient. However, uploading un-censored raw data to public AI platforms violates Data Privacy Law and leaks core trade secrets such as farm-gate purchasing prices and agricultural processing specifications. This not only breaches cross-border data transfer regulations but also exposes businesses to heavy administrative fines or contract losses with international partners. From my experience, before rushing to adopt AI into daily operations, businesses must train their team and set clear rules of engagement: a 3-tier data classification SOP, Data Masking procedures, and a binding third-party AI Addendum. Only with such thorough preparation can we confidently drive digital adoption while safeguarding our core trade assets.

What Are the 3 Major Data Privacy & AI Compliance Risks for Import-Export SMEs?

Impact on People

 In my practical experience, when employees arbitrarily use "Shadow AI" by pasting sensitive information into public AI platforms, it creates huge operational risks and directly breaches Data Privacy. When confidential assets are mishandled, companies are forced to apply labor discipline, including employee termination and financial damage compensation under labor regulations.

I have realized that most SMEs currently lack sufficient knowledge and training when integrating AI into their daily business processes.

For successful and safe AI integration, we must establish Standard Operating Procedures (SOPs), organize regular staff training, and maintain human creative input to ensure compliance while retaining copyright ownership of our products.

Impact on Legal Compliance

One thing I constantly remind my colleagues is that inputting B2B contact details or operational files into public AI cloud platforms violates regulations on "Cross-border data transfer" under Vietnam's Decree 13/2023/NĐ-CP. This triggers mandatory responsibilities to obtain data subject consent, file a Data Protection Impact Assessment (DPIA), and submit formal notifications to Department A05 of the Ministry of Public Security.

Furthermore, exporters shipping to the European Union must comply with GDPR for B2B buyer data, Article 50 of the EU AI Act requiring mandatory transparency labeling for commercial AI content starting in 2026, and the EU Trade Secret Directive.

From my management perspective, purely AI-generated content lacks intellectual property copyright protection in the EU – any content, from photos and videos to infographics, generated by AI must be clearly marked and go through a human review process (human-in-the-loop AI rule).

Impact on Operational Costs

Non-compliance brings severe financial consequences. Under Decree 13/2023/NĐ-CP, administrative fines can reach up to 5% of the total revenue of the preceding fiscal year. Indirect financial losses are equally painful: margin erosion when competitors gain access to farm-gate cost of goods sold (COGS), legal defense expenses, contract termination by EU buyers, and costs required to upgrade software subscriptions to secure enterprise AI tiers.

Top 5 AI Compliance & Data Privacy Risks When Import-Export SMEs Misuse AI

• Trade Secret & Pricing Formula Leak: I have seen freight forwarders or customs clearance agents carelessly uploading scanned PDF shipping documents (such as Bills of Lading, Phytosanitary Certificates, or C/O Form EUR.1) for ST25 rice or specialty coffee shipments to Germany/Netherlands into public AI. This unintended action completely exposes confidential pricing, export volumes, and strategic trade routes.
• Illegal transfer of personal data: Export sales teams entering B2B client details (names, direct emails, phone numbers, job titles) into public AI tools like ChatGPT or Gemini without prior explicit consent, DPIA filing, or A05 notification directly violates Vietnam's Decree 13/2023/NĐ-CP and the EU GDPR.
• Loss of copyright ownership: Using original AI text or images for marketing — for example, including product photos generated by CapCut in a quotation for an EU customer — leads to rejection of copyright protection by the European Union Intellectual Property Office (EUIPO) and non-compliance with transparency labeling mandates under Article 50 of the EU AI Act.
• Third-party supply chain data exposure: Forwarders, inspection agencies, or overseas buyers entering direct sourcing directories, farm-gate purchasing prices, or freeze-drying / IQF technical specs into public AI. This data remains stored on the cloud, allowing competitors to extract proprietary information via prompt injection or model training ingestion.
• Shadow AI ingestion: Staff using free-tier tools (such as CapCut AI or public ChatGPT) where user inputs are stored on cloud servers and ingested for public AI model training, exposing proprietary internal R&D and target margin calculations.

How Should Import-Export SMEs Manage Data Privacy in AI Compliance – Risks & Legal Penalties?

I always remind my team that not all data is treated the same. Documents like NDAs or banking files must strictly never be uploaded to public AI platforms. The rules for what data can be used on AI differ for each SME, depending on contracts with AI providers and internal data privacy management policies.

Level 1: Strictly Confidential / Prohibited:

COGS reports, target margins, R&D formulas (freeze-drying, IQF parameters), original sourcing directories (e.g., list of 15 Cát Chu mango co-operatives in Đồng Tháp), NDA files, banking documents, and buyer databases with price histories.

• Rule: Absolutely prohibited from being uploaded or pasted into any public AI tool.
• Risk of Mishandling: Disruption of direct supply chains, competitor undercutting at farm gates, and loss of technical quality advantages.

Level 2: Confidential with Removing Confidential Information

 Byer/supplier email communications, draft commercial contracts, B/L terms, internal market analysis, and QC general manuals.

• Rule: Permitted ONLY after executing the 5-Step Data Removing SOP.

Level 3: Public / Internal Free

Public marketing posts, public product spec sheets, video captions/scripts, and public local import-export laws.

• Rule: Freely usable across AI tools.

5-Step Data Removing SOP:

• Step 1: Identify & extract sensitive PII, company names, and financial data.
• Step 2: Mask sensitive fields using standardized generic placeholders.
• Step 3: Process query on AI platform.
• Step 4: Audit and verify AI-generated output (a mandatory step under the human-in-the-loop rule).
• Step 5: Replace masked data with real data locally before external communication.

What Are the Legal & Data Privacy Penalties for Non-Compliant Import-Export SMEs Working with EU Clients?

Failing to comply with Data Privacy and AI Data Handling guidelines poses a massive risk. Businesses face fines up to 5% of the total revenue of the previous fiscal year for cross-border data transfer non-compliance, regulatory sanctions, employee disciplinary termination under Vietnam's Labor Code, and potential legal action by EU buyers under GDPR or Trade Secret directives.

How Can Import-Export SMEs Protect Data Privacy and Ensure AI Compliance Across Third Parties & Clients?

• ISO/IEC 42001 AI Risk Assessment: Conduct a 10-criterion AI safety assessment on supply chain partners (forwarders, logistics, labs, buyers) prior to sharing operational data.
• Bilingual AI Addendum (Phụ lục NDA mẫu về AI): Incorporate a legally binding AI Addendum into existing commercial contracts.
• Strict Contractual Binding Provisions: To protect your business data, you have to work with Cyber Data Security Team to set clear rules for third parties:
  • Absolutely no uploading of the disclosing party's confidential data into public AI models for analysis or training.
  • Require enterprise-grade encryption (TLS 1.3+ in transit, AES-256+ at rest);
  • Enforce strict role-based access control;
  • Require immediate data deletion upon request;
  • Establish audit rights to verify AI compliance across the supply chain.

Source for Citation:

1. High-level summary of the AI Act | EU Artificial Intelligence Act, https://artificialintelligenceact.eu/high-level-summary/
2. Digital Regulation Essentials: The EU AI Act | Slaughter and May, https://www.slaughterandmay.com/media/zgijlqgk/digital-regulation-essentials-the-eu-ai-act.pdf
3. ISO/IEC 42001 AI Management System Guide - SecPortal, https://secportal.io/frameworks/iso-iec-42001
4. ISO/IEC 42001 AI Risk Assessment Step-by-Step Guide, https://cyberzoni.com/iso-iec-42001-ai-risk-assessment-step-by-step-guide/
5. Article 25: Responsibilities along the AI value chain | AI Act Service, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-25
6. Article 25: Responsibilities Along the AI Value Chain - EU AI Act, https://artificialintelligenceact.eu/article/25/
7. EU AI Act GPAI Rules: What Providers Need to Know - jaggaer, https://www.jaggaer.com/blog/eu-ai-act-rules-for-general-purpose-ai
8. GPAI & Foundation Model Compliance Under the EU AI Act, https://www.glocertinternational.com/resources/guides/eu-ai-act-gpai-and-foundation-model-compliance/
9. ISO 42001 Standard for AI Governance and Risk Management, https://www.deloitte.com/us/en/services/consulting/articles/iso-42001-standard-ai-governance-risk-management.html
10. AI Risk Management: Identify, Assess & Control AI Risk - ISMS.online, https://www.isms.online/iso-42001/ai-risk-management/
11. AI Risk & Impact Assessment: ISO 42001 Guide - Glocert International, https://www.glocertinternational.com/resources/guides/ai-risk-assessment-iso-42001/