Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Vietnam has set ambitious sights on artificial intelligence as a cornerstone for national advancement, aligning with broader goals of digital sovereignty, economic growth and technological self-reliance. To date, Vietnam has made strides in this direction, including passing the Law on Digital Technology Industry in June 2025, which includes initial provisions to regulate AI systems. Slated to take effect 1 Jan. 2026, the law makes Vietnam one of the first countries in the region with specific legal provisions on AI.
But it seems to not be enough, as the Ministry of Science and Technology made public in late September the draft Law on Artificial Intelligence — a dedicated framework for AI. Tasked by the government with drafting the law in late August, the MST rushed the draft out, reflecting the urgency of consolidating AI governance amid rapid technological evolution.
The rationale is clear: to create a comprehensive, standalone regime that protects rights, ensures security and boosts competitiveness, while addressing gaps in existing laws. Notably, upon enactment, the AI Law will supersede and abolish the AI-related sections in the Law on Digital Technology Industry, streamlining oversight under a unified umbrella.
The draft law is open for public consultation, which ends 20 Oct.
Foundational principles
At its core, the draft AI law mandates that all AI-related activities in Vietnam adhere to seven foundational principles, blending ethical imperatives with national priorities. These include human-centrism, ensuring AI serves people while remaining under human control; safety, fairness, transparency and accountability, with explainability required for risky systems; national autonomy alongside international integration; inclusive and sustainable development; balanced policy-making; risk-based management; and innovation promotion.
This echoes the EU AI Act's emphasis on trustworthy AI, particularly in human-centric design and transparency. However, Vietnam's principles uniquely underscore cultural preservation and national sovereignty, tailoring global norms to local values.
Risk-based classification and governance
Mirroring the EU AI Act's tiered approach, Vietnam's draft classifies AI systems into four risk levels: unacceptable — prohibited outright, such as manipulative systems or real-time biometric identification in public spaces without safeguards; high-risk — for example, in health, finance, education or justice, requiring strict obligations like risk assessments, human oversight, registration in a national database and incident reporting; medium-risk — demanding transparency and labeling for user interactions or generated content; and low-risk — subject to voluntary standards and self-regulation.
Businesses in critical sectors face heightened scrutiny, with pre-market conformity assessments for the highest risks and post-market monitoring for others. Like the EU, this risk-based model aims to balance innovation with protection, but Vietnam's framework adds flexibility through government-updated lists and sandbox testing, potentially easing burdens for startups.
General-purpose AI models
Drawing heavily from EU concepts, the draft introduces regulations for general-purpose AI models — versatile systems trained on vast data for broad applications. Providers must fulfill basic obligations, including technical documentation, intellectual property compliance and risk mitigation. For models posing systemic risks — such as those with high-impact capabilities affecting markets or society — enhanced duties apply, including adversarial testing, cybersecurity measures and incident reporting.
This will impact tech firms integrating large language models, requiring them to verify downstream adaptations. While akin to the EU AI Act's general-purpose AI provisions, Vietnam's approach emphasizes national autonomy in infrastructure and data, potentially creating hurdles for foreign providers reliant on global datasets.
Role-driven accountability
The draft delineates responsibilities across the AI supply chain, assigning duties to developers, providers, deployers, importers and users based on their control and role. For instance, providers and importers handle self-assessments and documentation, while deployers ensure contextual compliance. The government will elaborate on these through a decree, and joint liability may apply for damages where roles blur, with courts empowered to compel evidence disclosure.
This chain-of-responsibility model parallels the EU AI Act's provider-deployer distinctions but adds Vietnam-specific nuances, like encouraging liability insurance and fault-based reimbursement, which could foster clearer accountability but also increase litigation risks for multinational chains.
Incentives and support for innovation
To fuel growth, the draft establishes a National AI Development Fund for research and development grants; regulatory sandboxes prioritizing small to medium-sized enterprises and startups with simplified procedures and exemptions; AI clusters in high-tech parks offering tax breaks and infrastructure perks; and talent attraction policies for experts.
These incentives open doors for domestic and foreign investment in AI infrastructure and ecosystems. Unlike the EU AI Act's focus on harmonized rules without direct funding, Vietnam's supportive measures — including free compliance templates post-sandbox — signal a pro-innovation stance, potentially to attract tech giants amid global AI races.
Revenue-based penalties and other enforcement measures
For enforcement, the draft empowers the MST and a National AI Commission to inspect and intervene, with measures like temporary suspensions or permanent bans for systems threatening national security. Serious violations by large organizations could trigger fines based on a percentage of prior-year global revenue, aligning with international deterrence practices.
Violating acts triggering these sanctions include, but are not limited to, developing or deploying prohibited AI systems — such as those manipulating cognition for harm or building unchecked facial recognition databases — breaching high-risk obligations like risk management or data security, failing to meet registration, conformity assessment, or reporting requirements, and obstructing inspections or providing false information.
This revenue-linked penalty mirrors the EU AI Act's fines and has been adopted in several Vietnamese laws. It remains unclear whether Vietnam will adopt a similar cap of 6% of global turnover for severe breaches, leaving fine levels to be detailed by the government. The approach emphasizes proportionality but raises concerns for global firms over enforcement consistency.
As a matter of local legislation, the government will need to issue a sanctioning decree for fines to be enforceable.
Phased rollout and grace period
The law is proposed to be rolled out in phases. Within six months of the 1 Jan. 2026 effective date, by 1 July 2026, the National AI Commission will be established, guiding documents promulgated, and the National Artificial Intelligence Development Fund put into operation. After 12 months, starting 1 Jan. 2027, provisions on prohibited acts and the legal sandbox mechanism take effect. After 18 months, beginning 1 July 2027, obligations for high-risk AI systems apply in full.
For high-risk AI systems already in use before the law takes effect, providers and deployers must review, self-assess and complete registration and conformity assessments starting 1 July 2029, within 24 months from the date relevant high-risk AI system requirements apply in full. The government will detail an appropriate transition roadmap to avoid disrupting lawful operations.
Fast-approaching deadline and what lies ahead
As Vietnam's National Assembly convenes for its 10th session starting 20 Oct. — coinciding with the public consultation deadline for the draft AI Law — the legislation is poised for passage in the coming weeks. This fast-tracked timeline underscores the government's digital ambitions but also amplifies the need for input.
Stakeholders, from tech providers to platforms, should swiftly voice comments and concerns to lawmakers through official channels, while closely monitoring revisions to navigate this evolving landscape.
Post-enactment, the government and prime minister will issue detailed guiding documents on risk criteria, lists of high-risk applications, and procedural mechanisms, to flesh out the law's implementation. A sanctioning decree is also expected to be issued. The MST, as the focal agency, will lead in promulgating national standards and technical regulations to support these efforts.
Huu-Tuan Nguyen, CIPP/E, is a special counsel at BMVN International, and Alex Do, CIPP/E, is an IPTech executive cum patent coordinator at BMVN International, in alliance with Baker McKenzie Vietnam.
