Vietnam's AI Law, The Complete Compliance Guide for Foreign Businesses

What is Vietnam's AI Law?

Vietnam's Law on Artificial Intelligence, formally Law No. 134/2025/QH15, is Southeast Asia's first comprehensive binding AI regulation. It was passed by Vietnam's National Assembly on December 10, 2025 and took effect on March 1, 2026.

The law is modelled on the European Union's AI Act but includes a sovereign data and industrial policy layer that does not exist in the European framework. Foreign providers face additional obligations around local representation, national portal registration, and data localisation for certain high-risk applications.

The regulatory authority is Vietnam's Ministry of Science and Technology (MoST), which administers the National AI Database and issues the formal risk classification lists. Enforcement is coordinated across MoST, the Ministry of Information and Communications, and sector-specific regulators (State Bank of Vietnam for finance, Ministry of Health for healthcare).

What did Decree 142/2026 clarify?

On April 30, 2026, Vietnam's Government issued Decree No. 142/2026/ND-CP, which took effect May 1, 2026. This is the first implementing decree for the AI Law and provides the first detailed guidance on how risk classification, foreign provider obligations, and National AI Database registration will operate in practice.

Decree 142 confirms four practical points for foreign businesses.

1. The scope of regulation extends broadly across providers, developers, deployers, users, and those affected by AI systems, including foreign organisations and individuals conducting AI-related activities in Vietnam. Article 2 confirms that foreign entities operating in the Vietnamese market fall within scope regardless of principal place of business.
2. Risk classification will proceed through either self-assessment or conformity assessment body evaluation. Existing AI systems have a 60-day transition period from the decree's effective date (ending June 30, 2026) to complete an initial risk-tier assessment.
3. Serious AI incidents must be reported to MoST within 72 hours through the one-stop electronic AI portal. Vietnam's national AI database is being established under MoST, though not yet fully operational.
4. Article 18 imposes a mandatory labelling requirement on AI-generated content that simulates real persons or events, including deepfake and voice-cloning applications.

More detailed classification criteria for high-risk systems remain pending through a separate Prime Minister's list, expected in the second half of 2026. Specific administrative sanction levels are being finalised through a separate sanctioning decree, meaning the penalty amounts anticipated on this page remain subject to that final decree.

When did Vietnam's AI Law take effect?

The law took effect on March 1, 2026. Grace periods apply for existing systems but the law is now in force for new deployments.

The high-risk classification list is expected in the second half of 2026. Once published, the 30-day registration clock starts for affected systems. Companies waiting for the list before assessing their exposure are running the risk in reverse.

Who does Vietnam's AI Law apply to?

The law applies broadly to any organization deploying AI that affects Vietnamese users. Specifically:

• Vietnamese companies deploying AI, regardless of AI provider origin
• Foreign companies providing AI systems to Vietnamese users
• Foreign companies operating in Vietnam through subsidiaries, branches, or representative offices
• Multinational groups with Vietnam operations that use AI in customer-facing, HR, financial, or logistics workflows

Foreign providers of high-risk AI systems face an additional structural requirement. They must either establish a commercial presence in Vietnam or appoint an authorized local representative empowered to receive regulatory communications and handle compliance matters. Providers of other high-risk systems must at minimum maintain a lawful local contact point.

This provision is the one most regional HQs have not flagged. A Singapore-headquartered company using an AI-powered HR tool, credit-scoring model, or health application in Vietnam operations may need a local legal presence specifically for that tool, separate from the existing operating entity.

What are the three risk tiers?

Vietnam's AI Law classifies systems into three tiers with different compliance obligations.

MoST has not yet published the definitive classification criteria for each tier through the Prime Minister's list. Companies should treat any AI that touches personal data, financial decisions, or health information as presumptively high-risk until that list is published.

What are the compliance requirements?

Compliance requirements scale with risk tier. For high-risk AI systems, the full obligation set includes:

Foreign providers must additionally maintain a local representative and provide a Vietnamese-language contact point for regulatory communications and user complaints.

What are the anticipated penalties for non-compliance?

The AI Law itself does not fix administrative sanction amounts. Those are deferred to a separate sanctioning decree still pending. The figures below reflect anticipated penalties based on published legal analyses from Baker McKenzie, Duane Morris, Tilleke and Gibbins, and Vietnamese law firms tracking the decree drafting process. Actual amounts may vary when the sanctioning decree is issued.

Anticipated financial penalties:

• Administrative fines up to VND 2 billion (approximately USD 75,800) for organizational violations
• Revenue-based fines for serious violations, with the specific percentage set by the sanctioning decree
• Individual fines for accountable persons where violations are attributed to specific decisions

Non-financial penalties confirmed in the law and Decree 142:

• Suspension of AI system deployment in Vietnam
• Revocation of registration in the National AI Database
• Public disclosure of the violation
• Restrictions on future AI operations in Vietnam

Enforcement began after the March 1, 2026 effective date. Grace period companies remain in the enforcement window. The grace period does not exempt compliance, it only provides time to bring existing systems into conformance.

What should companies operating in Vietnam do now?

Waiting for the Prime Minister's high-risk classification list is the expensive option. Companies that engage the framework proactively benefit from clearer positioning and potential access to Vietnam's National AI Development Fund subsidies.

The framework is also being actively contested. On May 20, 2026, the US Chamber of Commerce and US-ASEAN Business Council filed a formal letter to Vietnam's Prime Minister raising concerns about certain restrictive provisions. This is a live signal that the enforcement regime is still being shaped. Companies with meaningful Vietnam exposure should treat the current period as a compliance-planning window rather than a stable end state.

Three moves worth making this quarter:

What upside does Vietnam's AI Law create?

Most coverage of Vietnam's AI Law frames it purely as a compliance cost. That framing misses the industrial policy layer.

The law blends regulation with active AI industry development. The Vietnamese government has committed to:

• The National AI Development Fund, which subsidises compute and access to national language models for compliant deployments
• Voucher programmes for Vietnamese SMEs adopting compliant AI
• Preferential access to the National AI Database resources for domestic and foreign providers who engage the framework early

Companies that treat Vietnam only as a regulatory cost centre will miss the subsidised AI experimentation opportunity. Companies that engage early may qualify for state support that materially reduces the total cost of AI deployment in the Vietnamese market.

Frequently asked questions