Vietnam Law on Artificial Intelligence

What it is

The Law on Artificial Intelligence, No. 134/2025/QH15, is Vietnam’s comprehensive AI law. The National Assembly passed it on 10 December 2025, and it took effect on 1 March 2026. It has eight chapters and 35 articles covering the research, development, provision, deployment and use of AI systems in Vietnam.

The Law sets a risk-based regime with three tiers, lists prohibited conduct, requires transparency and incident handling, and builds national infrastructure including a one-stop AI portal and a national database of AI systems. The Ministry of Science and Technology is the lead agency for state management of AI.

Two implementing instruments are in place. Decree 142/2026/ND-CP, issued on 30 April 2026 and in force from 1 May 2026, details several articles. Decision 33/2026/QD-TTg, signed on 30 June 2026 and in force from 15 August 2026, lists 46 high-risk AI systems across six fields, which are education, ethnic and religious affairs, health, banking, legal proceedings and transport. The official texts are in Vietnamese.

Who it applies to

The Law applies to Vietnamese and foreign organisations and individuals taking part in AI activities in Vietnam. It distinguishes developers, providers, deployers and users, and gives each its own duties. AI used solely for national defence, security or cipher purposes is outside its scope.

What it requires

• Self-classification. Providers classify each system before putting it into use. Medium and high-risk systems need a classification file. A deployer inherits the provider’s classification and must work with the provider to reclassify if a modification creates new or higher risk.
• Notification. Providers notify the classification of medium and high-risk systems to the Ministry of Science and Technology through the national AI one-stop portal before use.
• Conformity assessment. High-risk systems must pass conformity assessment before use and after significant changes. Systems on the certification list need a registered conformity assessment body. Other high-risk systems can be self-assessed.
• High-risk duties. Providers must run risk management, govern training, testing and operating data, keep technical records and logs, design for human oversight and intervention, and be able to explain the system to regulators and affected people without disclosing source code or trade secrets. Deployers must operate the system within its classified purpose and risk level and keep human intervention possible.
• Transparency and labelling. People must be able to tell when they are interacting with AI. AI-generated audio, images and video must carry machine-readable marks. Deployers must clearly flag public content that could mislead about real events or people, and label content that imitates a real person’s appearance or voice.
• Incidents. Developers, providers, deployers and users must detect and fix incidents. In a serious incident, providers must remediate, suspend or withdraw the system and notify the authorities, with reporting through the one-stop portal.
• Prohibited conduct. Article 7 bans six groups of conduct, including using AI to deceive or manipulate people in ways that cause serious harm, exploiting vulnerable groups, unlawful data use, disabling human oversight and removing mandatory labels.
• Public sector. AI cannot replace the authority of a human decision-maker in state administration or public services. Agencies running high-risk systems must prepare and publish impact assessment reports.
• Liability. If a high-risk system causes damage even when properly managed, the deployer compensates the injured party and may then recover from the provider or developer where they have agreed.

Key dates

The Law took effect on 1 March 2026, Decree 142 on 1 May 2026 and the high-risk list on 15 August 2026. Systems already operating before 1 March 2026 have until 1 March 2027 to comply, or 1 September 2027 in health, education and finance.

How it relates to other frameworks

Vietnam’s structure resembles the EU AI Act, with risk tiers, conformity assessment for high-risk systems, transparency for AI interaction and synthetic content, and a list of prohibited practices. Its tiers are simpler, and notification to a national portal plays a larger role. It places far more direct duties on providers and deployers than Taiwan’s framework law, and sits alongside South Korea’s AI Basic Act as one of the region’s comprehensive AI statutes. For organisations already working to ISO/IEC 42001 or the NIST AI RMF, the risk management, data governance, record-keeping and human oversight duties for high-risk systems will look familiar. The step to plan for is classifying each system and notifying it before use.

A note on this page

This is Aicura’s reading of the Law, written to help you understand it. It is not legal advice and it is not the Law itself. Read the primary sources on the Government’s legal documents portal, and take advice on how they bear on your organisation.