Navigating Vietnam’s New AI Law.

Vietnam is taking a major step to shape its digital economy through two pivotal legislative developments: the Draft Law on Artificial Intelligence (“Draft AI Law”) and the Law on Digital Technology Industry No. 71/2025/QH15 (“DTI Law”). The DTI Law will take effect on January 1, 2026. The Draft AI Law is scheduled for deliberation during this session, which runs through December 11, 2025. If the Draft AI Law is enacted during this session, the effective date could also be January 1.

Together, these instruments aim to establish a structured but innovation-friendly foundation for Vietnam’s emerging AI ecosystem. The government appears to emphasize a risk-based regulatory model, balancing the encouragement of technological growth with safeguards for individual rights, transparency, and national interests.

Phased Implementation:

The Draft AI Law includes a phased implementation schedule designed to allow businesses adequate time to adapt to new regulatory requirements. Interestingly, regulation revolves around the perceived level of risk.

• January 1, 2026: Establishment of regulatory infrastructure and initial implementation framework begins. This phase focuses on setting up the National AI Database, appointing regulatory authorities, and publishing detailed guidance.
• July 1, 2027: Full obligations for high-risk AI systems take effect. From this date, all new high-risk AI systems must complete conformity assessments and registration procedures before deployment, 18 months after the law’s effective date.
• July 1, 2029: Legacy high-risk AI systems (those already in operation) must begin transition procedures. Existing systems receive a 24-month window to complete registration and conformity requirements.

This graduated approach is intended to provide businesses with adequate lead time to assess their AI systems, develop compliance mechanisms, and complete necessary registrations without disrupting ongoing operations. 

A Risk-Based Framework: Four Levels of AI Risk 

Vietnam’s Draft AI Law organizes AI systems into four risk categories: unacceptable, high, medium, and low, each accompanied by a specific level of regulatory scrutiny. This structure reflects similar international approaches, such as the European Union’s AI Act, but adapts them to Vietnam’s domestic context.

• Unacceptable risk: AI systems deemed to threaten human rights, personal safety, or social order are prohibited outright. Specifically, the Draft AI Law bans: AI that manipulates human cognition or behavior to cause harm; social credit scoring systems leading to unfair discrimination; real-time remote biometric identification in public spaces for law enforcement (except in narrowly approved serious crime cases); large-scale facial recognition databases built through indiscriminate data scraping; and deepfakes or AI-generated content that threaten national security, public order, or social stability.
• High risk: AI applications in sensitive sectors, including healthcare, finance, education, transport, recruitment, justice, and energy, must comply with strict obligations covering data quality, risk management, human oversight, and prior registration in a national AI database.
• Medium risk: Systems that directly interact with users or generate content must be clearly identified as AI tools, ensuring users are informed when engaging with automated systems.
• Low risk: Minimal-impact systems are encouraged to follow voluntary best-practice guidelines and transparency principles.

This graded framework allows regulators to concentrate on supervision where the potential impact is highest while keeping entry barriers manageable for lower-risk innovation.

Implications for Investors 

For investors evaluating Vietnam’s AI market, the risk classification system becomes a central due-diligence factor. Each risk tier carries different operational and compliance implications:

• Higher compliance costs in high-risk sectors: Investments in AI for healthcare, fintech, transport, recruitment, justice, energy, or critical infrastructure carry significant upfront and ongoing costs. These include conformity assessment fees, registration procedures, documentation requirements, human oversight implementation, incident reporting systems, and post-market monitoring obligations. The dual requirements of obtaining prior approval and maintaining continuous compliance make governance infrastructure a material cost factor.
• Market-entry constraints: Projects that rely on restricted or prohibited technologies (such as biometric surveillance without authorization) may face outright legal barriers.
• Governance and accountability: The framework places legal responsibility on organizations and individuals overseeing AI systems, making corporate governance and auditability key priorities.
• Transparency as an advantage: Firms that design explainable and transparent AI solutions can gain user trust and regulator confidence, strengthening long-term competitiveness.
• Cross-border obligations: Foreign providers offering AI services that affect users in Vietnam may need to appoint local representatives and comply with registration and data-handling requirements.
• Phased compliance planning: The 18-month window before full high-risk obligations take effect (until July 1, 2027) provides a strategic opportunity for early-stage compliance preparation. Investors should factor in the timeline for conformity assessments, database registration, and the appointment of local representatives when structuring market-entry plans. Legacy systems benefit from an even longer transition period, with requirements not taking full effect until July 2029.

Operational Expectations for AI Developers and Users 

Organizations developing or deploying AI in Vietnam will be expected to embed governance and ethical principles into every phase of the technology lifecycle:

• Comprehensive risk mapping: Identify where each AI system falls within the four-tier risk model and maintain documented assessments and mitigation plans.
• User awareness: Ensure clear communication when users interact with AI tools, including labeling and disclosure requirements.
• Human oversight: Maintain human decision-making authority for systems with substantial social or economic consequences.
• Data protection alignment: Ensure that AI operations comply with Vietnam’s existing cybersecurity and personal-data protection frameworks.
• Registration and prior approval: High-risk AI systems require two distinct compliance steps before deployment: (1) obtaining prior government approval through a conformity assessment that evaluates the system’s compliance with safety, transparency, and risk-management standards, and (2) registration in the National AI Database for ongoing monitoring purposes. Once deployed, these systems remain subject to continuous obligations including incident reporting, post-market surveillance, maintenance of human oversight mechanisms, and periodic inspections by regulatory authorities.
• Foreign provider obligations: International companies offering AI services that affect users in Vietnam must appoint a legal representative within Vietnam. This representative serves as the primary compliance contact and liaison with regulatory authorities, responsible for ensuring that the foreign provider meets all registration, reporting, and cooperation requirements under Vietnamese law. 

Regulatory Authority and Oversight Structure 

Vietnam’s AI governance framework operates under a streamlined regulatory structure following a major government reorganization in early 2025:

• National Committee on Artificial Intelligence: As outlined in the Draft AI Law, a high-level National Committee led by the Prime Minister will oversee strategic AI policy development, approve major AI programs and projects, and establish regulatory frameworks for highly autonomous AI systems. This Committee will provide top-level coordination across government agencies on AI policy matters.
• Ministry of Science and Technology (MOST): In February-March 2025, Vietnam consolidated its digital technology and science/technology functions by merging the former Ministry of Information and Communications into the Ministry of Science and Technology. The newly expanded MOST now serves as the lead agency responsible for AI regulation, digital technology oversight, and science and technology policy. MOST drafted the AI Law and will be the primary implementing agency for AI standards, technical regulations, and compliance oversight.

Organizations deploying AI in Vietnam should expect MOST to be their primary regulatory contact for registration, approval processes, standards development, and compliance matters. The specific operational mechanisms for conformity assessments and database management are expected to be detailed in implementing regulations following the AI Law’s enactment.

Incentives and Opportunities Under the Digital Technology Industry Law 

While compliance will require planning and investment, Vietnam’s legislative package also creates meaningful incentives:

• Tax and land-use benefits: The DTI Law prioritizes AI development, digital infrastructure, and semiconductor projects through preferential taxation and access to land and capital.
• Innovation sandboxes: Pilot programs allow companies to test new AI applications under controlled regulatory conditions before large-scale rollout.
• Alignment with international standards: By following a risk-based structure similar to that adopted in the EU and other jurisdictions, Vietnam increases its appeal to multinational investors seeking legal consistency across markets.
• Reputation through ethical leadership: Early adopters who demonstrate transparent and responsible AI practices will enjoy a first-mover advantage as trust and compliance become market differentiators.

Compliance Pathway for High-Risk AI Systems

Organizations deploying high-risk AI in Vietnam must navigate a structured compliance pathway:

1. Pre-deployment phase: Conduct internal risk assessment to determine if the system qualifies as high-risk under the law’s categorization. Design systems with built-in compliance features including explainability, human oversight mechanisms, and data governance protocols.
2. Conformity assessment: Submit the system for government evaluation demonstrating compliance with technical standards, safety requirements, and risk-mitigation measures. This assessment must be completed before any deployment.
3. Database registration: Register the approved system in the National AI Database, providing detailed information about its purpose, technical specifications, risk category, and responsible parties.
4. Ongoing compliance: Maintain continuous adherence to obligations including incident reporting (particularly for system failures or unintended harm), post-market monitoring, periodic reviews, and cooperation with regulatory inspections.
5. Local representation: Foreign providers must ensure that their appointed Vietnamese representative is empowered to handle all compliance matters and respond to regulatory inquiries.

This structured approach transforms compliance from a one-time hurdle into an ongoing operational commitment requiring dedicated resources and governance frameworks.

Balancing Risk and Opportunity 

Vietnam’s forthcoming AI governance framework, anchored in the DTI Law and the current Draft AI Law, positions the country as a regional leader in digital-economy regulation. Investors and operators who approach the market with strong compliance systems, transparent data practices, and proactive engagement with regulators are likely to benefit most from this transformation.

Though the law introduces new layers of oversight, it also establishes clear rules that foster sustainable innovation. For companies willing to adapt, Vietnam offers a rapidly expanding, rules-based environment in which AI investment and deployment can thrive responsibly.