Vietnam AI Regulation 2026. Law 134/2025, the Ministry of Science and Technology, and what global operators must understand.

Vietnam has a standalone Law on Artificial Intelligence. Law No. 134/2025/QH15 was passed by the National Assembly on 10 December 2025 and has been in force since 1 March 2026. Thirty five articles in eight chapters, a three-tier risk model, mandatory notification to the Ministry of Science and Technology before a medium or high-risk system enters service, conformity assessment as a precondition for high-risk deployment, and a strict liability rule that puts compensation on the deployer even where the system was operated correctly. For a foreign provider there is also a presence requirement. This guide sets out what the Law requires, when the transitional deadlines fall, and how it sits alongside Vietnam's new personal data and cybersecurity statutes.

What actually happened, in order

Vietnam legislated twice in six months, and the second law displaced the first. The Law on Digital Technology Industry, Law No. 71/2025/QH15, was passed on 14 June 2025 and took effect on 1 January 2026, except Articles 11, 28 and 29, which took effect on 1 July 2025. Its Chapter IV, Articles 41 to 45, carried Vietnam's first binding AI provisions.

The Law on Artificial Intelligence, Law No. 134/2025/QH15, was passed on 10 December 2025 and took effect on 1 March 2026. Article 33 repeals Chapter IV of Law 71/2025 along with several definitional provisions. Chapter IV was therefore binding from 1 January to 28 February 2026.

Implementation followed quickly. Decree 142/2026/ND-CP detailing the Law on AI was issued on 30 April 2026 and took effect on 1 May 2026. Decision 33/2026/QD-TTg, issuing the List of high-risk AI systems, was issued on 30 June 2026 and takes effect on 15 August 2026.

Behind all of this sits a machinery-of-government change that catches out a lot of secondary commentary. National Assembly Resolution 176/2025/QH15 of 18 February 2025 restructured the Government into fourteen ministries and three ministry-level agencies with effect from 1 March 2025. The Ministry of Information and Communications is not among them. Both Law 71/2025 and Law 134/2025 place AI and digital technology competence with the Ministry of Science and Technology, and the phrase Ministry of Information and Communications does not appear in either statute.

The three risk tiers and the notification duty

Article 9 of Law 134/2025 sets three categories: high risk, medium risk and low risk. Medium risk is the interesting one, because it has no direct EU analogue as a tier: it captures systems liable to confuse, influence or manipulate users who cannot tell that they are dealing with an AI system or with AI-generated output. The Government sets the detail, which it has done in Decree 142/2026/ND-CP.

Article 10 puts the classification duty on the provider, before deployment. For medium and high-risk systems the provider must prepare a classification dossier and notify the Ministry of Science and Technology through the AI single-window portal before the system enters service. This is a notification regime rather than a licensing regime: there is no registration number and no operating permit for AI systems.

The infrastructure behind it is Article 8, which creates the AI single-window electronic portal and the National Database on AI Systems, with operating rules set by the Government. An earlier version of this guide described a registry of high-risk AI systems deployed at scale maintained by the Ministry of Information and Communications. The mechanism is real, the description was not.

The list of high-risk systems is set by the Prime Minister. Decision 33/2026/QD-TTg covers six sectors: health, education, banking, transport, legal proceedings, and ethnic and religious affairs. Note what is not on it. Employment and human resources decisions, and critical infrastructure management, are both absent, and an earlier version of this guide listed both as illustrative high-risk categories.

Conformity assessment and the foreign-provider presence requirement

Article 13 makes conformity assessment a precondition for putting a high-risk AI system into use, and provides for a sub-list of systems requiring third-party certification before use, set by the Prime Minister. This is a genuinely EU-shaped requirement and it is stronger than most non-EU regimes covered in this network.

Article 14(6) is the provision a cross-border operator should read first. A foreign provider of a high-risk AI system in Vietnam must have a lawful contact point in Vietnam. Where pre-use certification is mandatory for the system, the foreign provider must have commercial presence or an authorised representative in Vietnam. For a company serving Vietnamese users from abroad, this is a structural decision rather than a documentation exercise.

Transparency and content labelling

Article 11 sets four transparency duties. Providers must ensure that users can tell they are interacting with an AI system. Providers must mark AI-generated audio, image and video in machine-readable format, in accordance with Government regulation. Deployers must clearly disclose publicly released AI-generated or AI-edited text, audio, image or video that is capable of misleading as to authenticity. And content simulating a real person's appearance or voice, or re-enacting real events, must carry an easily recognisable label, with a proportionate method for cinematic and artistic works.

That last limb is more demanding than the general EU Article 50 obligation, because it attaches a recognisability standard to the label rather than only a disclosure duty.

Prohibited practices, incident reporting and liability

Article 7 sets prohibited AI practices, including deceptive simulation of real people or events, exploitation of vulnerable groups such as children, elderly people, persons with disabilities, ethnic minorities and persons lacking legal capacity, harmful deepfakes, obstructing human oversight, and stripping mandatory labels or warnings.

Article 12 imposes a serious-incident reporting duty on developers, providers, deployers and users alike.

Article 29 is the liability chapter and it is where Vietnam diverges most sharply from the regimes an operator is likely to have modelled. Article 29(1) refers violations to administrative sanctions or criminal liability under general law. Article 29(2) then provides that where a high-risk AI system has been managed, operated and used in full compliance and damage nonetheless occurs, the deployer must compensate the injured party, with contractual recourse against the provider or developer. Article 29(3) exempts only the victim's wilful fault and force majeure or necessity. Article 29(4) shifts liability where a third party intruded, with joint liability if the deployer or provider was itself at fault.

Read together, that is closer to strict liability on the deployer than to the fault-based frameworks that dominate elsewhere. Article 14(5) expressly encourages liability insurance, which is a rare statutory nudge and worth noting for anyone assembling cover for a Vietnamese deployment.

On administrative fines, the honest position is that there are none yet. Article 29(5) leaves the fine schedule to a future Government regulation, and no AI-specific administrative penalty decree could be located in the Official Gazette in this verification pass. An earlier version of this guide said penalty schedules were calibrated in implementing decrees and were narrower in absolute terms than EU turnover-based fines. Neither half of that was supportable.

The two statutes sitting alongside the AI Law

Vietnam's Law on Personal Data Protection, Law No. 91/2025/QH15, was passed on 26 June 2025 and took effect on 1 January 2026. The lead authority is the Ministry of Public Security, not the science and technology ministry. Its penalties under Article 8 are the ones with teeth: buying or selling personal data attracts up to ten times the proceeds; a cross-border transfer violation by an organisation attracts up to five per cent of prior-year revenue; other violations are capped at VND 3 billion. Article 30 deals specifically with personal data in big data and AI processing. Article 39 preserves consents and impact assessment dossiers made under Decree 13/2023/ND-CP, which the Law displaces from 1 January 2026 without an express repeal clause naming it.

The Law on Cybersecurity, Law No. 116/2025/QH15, was passed on 10 December 2025 and took effect on 1 July 2026. Article 44(2) terminates the 2018 Law on Cybersecurity and the 2015 Law on Cyberinformation Security from that date. Article 25(3) carries the data localisation duty: domestic and foreign enterprises providing telecommunications, internet or value-added services in Vietnam that collect, exploit, analyse or process personal information, user relationship data or data generated by users in Vietnam must store that data in Vietnam for a period set by the Government, and foreign enterprises must establish a branch or representative office in Vietnam.

For an operator, the presence requirements in Article 14(6) of the AI Law and Article 25(3) of the Cybersecurity Law point the same way, and together they are the most consequential thing in Vietnamese law for a foreign AI provider.

Strategy and the Party layer

Decision 127/QD-TTg of 26 January 2021 issued the National Strategy on Research, Development and Application of Artificial Intelligence to 2030, on the proposal of the Minister of Science and Technology, effective on signature. An earlier version of this guide said it was updated in 2024; no such amending decision could be located in the Official Gazette across 2020 to 2026. Article 19 of Law 134/2025 now requires the Prime Minister to issue and refresh a National AI Strategy at least every three years.

Politburo Resolution 57-NQ/TW of 22 December 2024 on breakthroughs in science, technology, innovation and national digital transformation is implemented through Government Resolution 03/NQ-CP of 9 January 2025. A Party resolution binds the Party and state apparatus politically. It creates no directly enforceable obligation on a private operator, and should not be cited as though it did.

Comparison with the EU AI Act

Vietnam's framework is structurally closer to the EU AI Act than most jurisdictions in this network, and in two respects it is more demanding. Conformity assessment as a precondition for high-risk use under Article 13 tracks the EU model. The Article 14(6) presence requirement has no EU equivalent for providers established outside the Union, which the EU addresses through the authorised representative mechanism rather than through a commercial presence test. And Article 29(2) deployer compensation is stricter than anything in Regulation (EU) 2024/1689, which creates administrative liability rather than a private compensation rule.

Where the EU is heavier is the penalty ceiling. Article 99 of the EU Regulation sets EUR 35 million or 7 per cent of worldwide annual turnover for prohibited practices. Vietnam's AI administrative fine schedule does not yet exist. Its data protection law, however, does carry a turnover-based fine of up to five per cent of prior-year revenue for cross-border transfer breaches, which is a real exposure and one that AI systems moving training or inference data offshore will engage.

For global operators, Vietnamese compliance should be built alongside an EU AI Act programme rather than derived from it. Documentation from EU Article 9 risk management, Article 13 instructions for use and Article 14 human oversight will carry over. The classification notification, the conformity assessment, the presence requirement and the incident reporting duty will not, because they have no EU counterpart in that form. A full analysis of EU AI Act deployer obligations is available at agentliability.eu.

Operator compliance priorities for Vietnam

For any operator with a system that may be medium or high risk: classify it under Article 9 now, check it against the six sectors in Decision 33/2026/QD-TTg, and prepare the Article 10 classification dossier. Notification to the Ministry of Science and Technology through the AI single-window portal must happen before the system enters service, not after.

For high-risk systems: plan the Article 13 conformity assessment into the deployment timeline, and check whether the system falls on the Prime Minister's sub-list requiring third-party certification before use.

For foreign providers: resolve the Article 14(6) question early. A lawful contact point in Vietnam is the minimum; commercial presence or an authorised representative is required where pre-use certification applies. Read it alongside Article 25(3) of the Cybersecurity Law, which imposes its own local presence and storage duties.

For generative and synthetic media tools: build machine-readable marking for AI-generated audio, image and video, and an easily recognisable label for content simulating a real person or re-enacting real events.

On liability and insurance: Article 29(2) puts compensation on the deployer even where the system was operated correctly. Contractual recourse against the provider is the only route back, so allocate it explicitly in the contract rather than relying on general indemnities. Article 14(5)'s encouragement of liability insurance is a reasonable prompt to check whether existing cover responds.

On the calendar: Article 35 gives eighteen months from 1 March 2026 for health, education and finance, and twelve months for everything else. Decision 33/2026/QD-TTg sets compliance before 1 September 2027 for health, education and finance, and before 1 March 2027 for other listed sectors and for systems deployed within six months of 15 August 2026. Regulators may order suspension during the transition where serious harm is likely.

Frequently asked questions