Decision 1225/QD-CT: 05 groups of information prohibited from being shared with the public AI.

Article 13 of the Regulations sets out a set of information security rules that relevant parties must adhere to when applying AI technology in their work. Two of these rules include:

Security comes first.

The application of AI tools in work processes must ensure compliance with regulations on protecting state secrets, personal data, and taxpayer information. In other words, before asking if AI can speed things up, users should first ask. Is it permissible to share the data I'm about to upload?.

05 types of information that should not be shared with the public AI

"Public AI" can be understood as chatbots or AI assistants provided externally, where input data is processed on infrastructure not managed by the tax authorities.

According to Clause 2 of Article 13, it is strictly prohibited to import, upload, or share the following information with public AI tools and third-party AI services:

• • State secrets.
  • Taxpayer information — That is, data on businesses, household businesses, and individuals that the tax authorities are managing.
  • Data exchanged under international treaties or agreementsFor example, information exchanged under tax agreements.
  • Personal data.
  • Source code, cryptographic keys, passwords, digital certificates, API keys, authentication information. or information that could affect system security.

These data sets can only be incorporated into the AI ​​system if approved by the competent authority or if the AI ​​system is deployed in an environment managed by the tax authority and fully meets information security requirements.