Nong Duc Tai[1]
 |
| MISA Robot, a Vietnamese-made technology product produced by MISA Group, is showcased at AI Day 2026, held in Hanoi on April 5__Photo: Thanh Tung/VNA |
The development of artificial intelligence and the legal context in Vietnam
In the context of the Fourth Industrial Revolution, artificial intelligence (AI) has emerged as a strategic technology pivotal to shaping the future of nations worldwide. AI is increasingly being deployed across virtually all sectors, including healthcare, education, finance, transportation, public administration and national defence, prompting leading jurisdictions such as the U.S., China, the EU, Korea, and Singapore to adopt dedicated national strategies and specialised regulatory frameworks to maximise the benefits of this transformative technology. In Vietnam, recognition of the strategic importance of AI has been clearly reflected in the Party’s policy documents, particularly Resolution 52-NQ/TW of 2019 on proactive participation in the Fourth Industrial Revolution and Resolution 57-NQ/TW of 2024 on breakthroughs in science and technology development, innovation and national digital transformation. These resolutions emphasise the imperative of “transforming data into a primary means of production” and “developing the data economy and data market.”, which constitute the essential foundations for AI development. Furthermore, the National Strategy on AI Research, Development and Application through 2030 (Prime Minister Decision 127/QD-TTg of 2021) sets the objective of positioning Vietnam among the top four ASEAN countries and the world’s top 50 nations in AI, reflecting the country’s commitment to keeping pace with global technological trends and strengthening its technological self-reliance.
AI has brought about profound transformations across all aspects of social and economic life, generating substantial benefits through enhanced labour productivity, optimised production processes, improved service quality in healthcare, education and public administration, and increased innovation across emerging industries. Nevertheless, alongside these significant advantages, AI also presents a range of legal and regulatory challenges that require effective governance. Deepfake technologies have been exploited for fraud, defamation, and the dissemination of disinformation; AI systems may produce discriminatory or biased outcomes as a consequence of unfair training data or opaque “black-box” algorithms; the large-scale collection and processing of personal data raise significant concerns regarding privacy and data protection; and the allocation of legal liability for harm caused by AI systems remains one of the most significant unresolved issues in the legal systems of many jurisdictions, including Vietnam.
In response to these challenges, the State’s stronger regulation has become increasingly necessary. At present, the legal regulation of AI in Vietnam remains fragmented across various legislative instruments, such as the Law on Cyberinformation Security, the Law on Cybersecurity, the Law on High Technology, the Law on Intellectual Property, the Law on Data, and the Law on Personal Data Protection. However, these statutes regulate AI only indirectly and lack sufficiently detailed provisions to comprehensively govern the research, development, provision, deployment and use of AI systems. The absence of a dedicated legislative framework has resulted in a lack of mechanisms for AI risk classification and management, certification, licensing, and regulatory oversight of high-risk AI systems, as well as inadequate policies to develop and attract highly qualified AI professionals. Consequently, numerous AI-integrated projects have encountered significant obstacles to practical implementation due to persistent legal uncertainty.
In order to realise the objectives set out in the 13th National Party Congress concerning the development of science, technology and innovation, as well as Resolution 57-NQ/TW, the enactment of a dedicated AI law became an urgent legislative priority. On December 10, 2025, the 15th National Assembly officially adopted Law 134/2025/QH15 on Artificial Intelligence (the Law), the first comprehensive legislation in Vietnam governing the development, application and governance of AI.
Key features of the Law
Effective on March 1, 2026, the Law seeks to strike an appropriate balance between risk mitigation and technological advancement. It governs the entire AI value chain from system design, training, testing and market placement to deployment and use in professional, commercial and service activities. The Law also establishes the rights, obligations and legal responsibilities of relevant organisations and individuals and defines the institutional framework for the state management of AI. Notably, AI activities undertaken for national defence, national security and cryptographic purposes are expressly excluded from the scope of the Law in recognition of their specialised regulatory regimes. The Law applies not only to Vietnamese authorities, organisations and individuals but also to foreign entities and individuals that develop, provide, deploy or operate AI systems within Vietnam’s territory, thereby adopting a comprehensive and internationally oriented regulatory approach.
For the first time in Vietnamese legislation, the Law establishes a unified set of statutory definitions relating to AI and the actors involved throughout its lifecycle. It defines AI as the electronic replication of human intellectual capabilities, including learning, reasoning, perception, judgment, and natural language understanding. An AI system is defined as a machine-based system designed to perform AI capabilities with varying degrees of autonomy and capable of adaptive behaviour following deployment. The Law further defines key stakeholders, including AI developers, providers, deployers, users and affected persons whose respective rights, obligations and legal liabilities are determined throughout the lifecycle of AI systems.
Regarding regulatory principles, the Law establishes four overarching principles that underpin AI governance. First, AI development and deployment must be human-centred, ensuring respect for human rights, privacy, national security, and compliance with applicable law. Second, AI is not intended to replace human authority or accountability; human operators must retain meaningful oversight and the ability to intervene in decisions generated by AI systems. Third, AI systems must operate in a fair, transparent and non-discriminatory manner, requiring organisations and individuals to identify and mitigate algorithmic bias and discriminatory outcomes while ensuring that AI-assisted decisions remain explainable and accountable. Fourth, AI development should promote environmental sustainability through energy-efficient technologies and the reduction of adverse environmental impacts.
To safeguard national security, human rights and public interests, the Law further prescribes six categories of prohibited acts. These include: (i) unlawfully appropriating or exploiting AI systems for illegal purposes; (ii) developing or using AI to engage in prohibited activities, including deceptive or manipulative practices employing synthetic or falsified content or exploiting vulnerabilities of individuals or vulnerable groups; (iii) unlawfully collecting or processing data relating to personal data, intellectual property or cybersecurity; (iv) obstructing mechanisms for human oversight and intervention; (v) concealing information that is subject to disclosure for transparency purposes; and (vi) abusing AI research or experimental activities to facilitate unlawful conduct. These prohibitions demonstrate the legislature’s determination to prevent technological abuse, particularly the misuse of deepfake technologies and cognitive manipulation, while reinforcing a regulatory philosophy grounded in human dignity and the protection of fundamental rights in the digital era.
A central feature of the Law is its risk-based regulatory framework, under which AI systems are classified into high-, medium- and low-risk categories based on their potential impact on human rights, public safety, national security, sector of application, and scale of societal impact. High-risk AI systems, including those used in healthcare, education, finance, recruitment, credit rating and biometric surveillance, are subject to the most stringent regulatory requirements. Before marketed or deployed, such systems must undergo conformity assessments in accordance with applicable standards and technical regulations. Providers and deployers are also required to establish comprehensive risk management systems, implement robust governance of training data, maintain technical documentation and operational logs, ensure meaningful human oversight, and comply with transparency obligations and incident response requirements.
The Law also introduces detailed transparency obligations relating to AI-generated content. AI providers must ensure that users are informed whenever they interact with an AI system. AI-generated audio, images and videos must contain machine-readable identifiers or watermarks, and deployers making AI-generated content available to the public that could reasonably mislead individuals about its authenticity must provide clear disclosure and distinguish such content from authentic materials through appropriate labelling mechanisms.
Concerning AI safety and incident management, the Law imposes a general duty on all stakeholders to ensure the safety, security and reliability of AI systems and to promptly detect and remedy incidents. Where serious incidents occur, developers and providers must immediately implement technical measures to mitigate risks, suspend or withdraw affected AI systems when necessary, and notify thereof to the competent authorities. Deployers and users are correspondingly required to record incidents, report them without undue delay, and cooperate with competent authorities throughout the investigation and remediation process. Incident reporting and management are centralised through the National AI One-Stop Portal, while the Government is empowered to issue detailed regulations on reporting procedures and the responsibilities of competent authorities, based on the severity and impact of particular incidents.
Beyond regulation, the Law places considerable emphasis on developing Vietnam’s AI ecosystem. It recognises the national AI infrastructure as a strategic national infrastructure that is open, secure and scalable, comprising computing capacity, shared data resources, AI training and testing platforms, foundation models and regulatory testing environments. The State will take charge of coordinating and investing in this infrastructure while encouraging public-private partnerships and requiring AI applications in critical sectors to operate on the national AI infrastructure to ensure safety and regulatory oversight.
The Law also establishes two key governance infrastructures: the National AI One-Stop Portal, responsible for receiving applications for regulatory sandbox participation, AI risk classification notifications, incident reports and public disclosures; and the National AI Database, which serves as the central repository for AI system information to facilitate regulatory supervision and post-market monitoring. The publication and sharing of information through these platforms must comply with legal requirements relating to cybersecurity, state secrets, trade secrets and personal data protection.
To stimulate AI innovation, the Law introduces an extensive package of incentives and support measures. AI enterprises are entitled to the highest level of preferential treatment available under Vietnamese legislation governing science and technology, high technology, digital transformation, and investment. A regulatory sandbox mechanism permits innovative AI systems to be tested in controlled environments with reduced regulatory burdens, including, where appropriate, exemptions from selected compliance obligations. The Law further establishes a National AI Development Fund, operating under a flexible financing model that accepts a reasonable degree of innovation-related risk while prioritising investment in AI infrastructure, workforce development, core technologies, and AI startups. Additional support is provided to startups and small- and medium-sized enterprises through subsidies for conformity assessment, self-assessment tools, and access to shared public datasets.
Human resource development constitutes another important pillar of the Law. The State is tasked with developing AI talents through an integrated education system spanning general education, vocational training and higher education. In particular, AI fundamentals, computational thinking, digital skills and technology ethics are incorporated into the compulsory national school curriculum, while universities and vocational education institutions are encouraged to establish specialised programmes in AI, data science and related disciplines.
Preliminary assessment of strengths and weaknesses of the Law
The Law demonstrates several noteworthy strengths, reflecting a progressive legislative philosophy that is broadly aligned with international regulatory trends.
Firstly, the Law adopts a risk-based regulatory approach that closely resembles the European Union’s Artificial Intelligence Act (EU AI Act), one of the world’s most advanced legal frameworks for AI governance. This approach strikes an appropriate balance between fostering innovation and mitigating potential societal risks by imposing legal obligations that are proportionate to the risks posed by particular AI systems. Rather than regulating AI technologies uniformly, the Law differentiates regulatory requirements based on the likelihood and severity of harm an AI system may pose.
Secondly, the Law vividly institutionalises the human-centred principle, affirming that AI is intended to assist rather than replace human decision-making in matters of significant legal or social consequence. This principle constitutes a fundamental safeguard for human rights in the digital era and establishes a legal requirement that meaningful human oversight and intervention must remain available throughout the operation of AI systems. By preserving ultimate human responsibility for important decisions, the Law seeks to ensure that AI remains an instrument serving human interests rather than an autonomous substitute for human judgment.
Thirdly, the Law establishes a relatively comprehensive governance framework encompassing AI risk classification, conformity assessment, incident management, transparency obligations, and AI-generated content labelling. Collectively, these mechanisms address many of the most pressing legal challenges associated with AI deployment, including the misuse of deepfake technologies, the assignment of responsibilities among developers, providers and deployers, and the requirements of accountability, explainability and fairness in AI-assisted decision-making.
Fourthly, the Law incorporates a wide range of incentive mechanisms designed to promote AI innovation. These include the regulatory sandbox framework, the National AI Development Fund, and preferential treatment under legislation governing science and technology, high technology, digital transformation and investment. Such measures reflect a facilitative regulatory philosophy that encourages technological development rather than constraining innovation through excessive regulation. They are particularly valuable for AI startups and small- and medium-sized enterprises, which often face significant barriers in accessing capital, computing resources and regulatory support.
Fifthly, the Law recognises AI infrastructure as a component of Vietnam’s strategic national infrastructure and introduces provisions supporting the development of high-performance computing capacity, shared data resources and national AI platforms. These measures seek to address one of the principal constraints on AI development, namely the high costs of computational resources and access to high-quality datasets, while strengthening domestic capabilities in the research, development and deployment of core AI technologies.
Finally, the Law provides a pragmatic transitional regime for AI systems that were already in operation before its entry into force. Existing AI systems are granted transitional compliance periods ranging from 12 to 18 months, thereby allowing providers and deployers sufficient time to adapt to the new regulatory requirements without causing unnecessary disruption to ongoing commercial, professional or public-sector activities.
Generally, these features demonstrate that the Law represents a significant milestone in the development of Vietnam’s AI regulatory framework. It reflects the State’s proactive commitment to shaping the governance of emerging technologies while safeguarding fundamental societal values and promoting sustainable digital transformation.
Notwithstanding these significant achievements, several aspects of the Law require further clarification or refinement during implementation.
First, the operation of the risk classification framework remains largely dependent on the Government’s future regulations. Although the Law establishes three categories of high, medium and low AI risks, it does not provide specific criteria for determining which AI systems fall within each category. This legislative choice may create practical difficulties in ensuring consistent application across different sectors and regulatory authorities. The adoption of a comprehensive catalogue of high-risk AI systems, supported by objective scientific criteria and informed by international best practices, will therefore be essential.
Second, the Law provides only a general framework for legal liability arising from damage caused by AI systems. While it recognises the responsibilities of developers, providers and deployers, it does not establish detailed rules governing liability or compensation in complex situations involving highly autonomous AI systems. In particular, proving negligence or fault remains especially challenging when decisions are generated by opaque “black-box” algorithms whose internal reasoning cannot be readily explained. Future implementing regulations should therefore provide clearer guidance on liability allocation and compensation mechanisms, potentially drawing on approaches such as mandatory insurance schemes, compensation funds or alternative risk-sharing models.
Third, with respect to AI ethics, the Law imposes ethical obligations primarily upon public-sector entities, while comparable obligations are largely absent for private-sector organisations. This distinction may prove difficult to justify, given that AI applications deployed by sole proprietorships in sensitive sectors, including healthcare, finance, education, recruitment and employment, can have ethical and societal impacts comparable to those of public-sector AI systems. Consideration should therefore be given to extending ethical governance obligations across both public and private sectors.
Fourth, the Law does not expressly recognise several important procedural rights for individuals affected by AI-assisted decision-making. In particular, it does not establish a statutory right to explanation concerning the logic underlying algorithmic decisions, a right to object to decisions based solely or predominantly on automated processing, or a right to request meaningful human review of AI-assisted decisions affecting individual rights and interests. These rights have become increasingly prominent within advanced regulatory frameworks, most notably the European Union’s General Data Protection Regulation (GDPR), and could substantially strengthen the protection of individuals in Vietnam’s digital economy.
Fifth, significant uncertainties remain regarding AI training data and intellectual property. The Law does not comprehensively address the legality of the use of copyrighted works for training AI models, nor does it clarify the legal boundary between machine learning and copyright infringement. Likewise, the ownership of AI-generated outputs remains unresolved. These issues have become increasingly significant with the rapid emergence of generative AI technologies and are likely to require further legislative attention in order to provide legal certainty for both AI developers and rights holders.
Finally, although the Law establishes institutional mechanisms such as the National AI One-Stop Portal and the National AI Database, it provides relatively limited guidance concerning the practical operation of regulatory supervision, inspection and enforcement. Questions remain regarding the institutional capacity, technical expertise, financial resources and inter-agency coordination necessary to effectively oversee increasingly sophisticated AI systems. Strengthening the professional capabilities of regulatory authorities and establishing clear mechanisms for inter-ministerial and inter-agency cooperation will be critical to the effective implementation of the Law.
These outstanding issues do not diminish the overall significance of the Law. Rather, they represent areas requiring continued legislative refinement through implementing regulations, institutional development and practical enforcement experience. Addressing these issues will be essential to ensure that the Law functions effectively in practice and achieves its overarching objective of fostering the responsible development and governance of AI in Vietnam.
Recommendations for further improvement
Based on the foregoing analysis of the strengths and remaining ambiguities of the Law, together with comparative international experience and Vietnam’s practical needs, several recommendations may be advanced to enhance the Law’s effectiveness and ensure it remains responsive to the evolving AI landscape.
With respect to implementing legislation, the Government should promptly promulgate detailed regulations that specify the catalogue of high-risk AI systems and are supported by objective classification criteria based on the potential impact of AI systems on human rights, public safety, national security, sectors of application, and the scale of societal impact. The catalogue should be publicly accessible, transparent, and subject to periodical review in order to accommodate rapid technological developments. At the same time, detailed procedures governing conformity assessment should be established for each category of AI risk, including both self-assessment mechanisms and third-party conformity assessments conducted by accredited organisations. Implementing regulations should also clarify the requirements governing disclosure and labelling of AI-generated content, ensuring that transparency obligations remain effective without imposing unnecessary burdens on innovation or commercial activities. These measures constitute essential preconditions for the effective implementation of the Law.
Regarding legal liability and compensation for AI-related harm, greater clarity should be provided concerning the responsibilities of AI developers, providers and deployers. In the short and medium terms, implementing regulations should elaborate on obligations regarding meaningful human oversight, transparency, risk assessment, and AI content labelling. Over the longer term, Vietnam should consider introducing alternative liability mechanisms for high-risk AI systems, such as mandatory insurance schemes or dedicated compensation funds, drawing upon legislative developments within the European Union and other leading jurisdictions. Consideration should also be given to establishing specialised procedures to investigate AI-related incidents and assess AI-caused harm. In addition, developers and deployers should be subject to clear obligations to provide explanations whenever AI-assisted decisions significantly affect the rights or legitimate interests of organisations or individuals.
Moreover, the ethical governance framework for AI should be strengthened and extended beyond the public sector. Fundamental ethical principles, including respect for human dignity, fairness, transparency, non-maleficence and accountability, should either be incorporated into the Law or elaborated through implementing regulations. Ethical obligations should not be confined solely to public authorities, as currently reflected in Article 28, but should also apply to private-sector organisations whose AI systems generate significant societal impacts. Enterprises developing or deploying AI systems in sensitive sectors should therefore be required to adopt and disclose internal AI ethics policies and to conduct ethical and societal impact assessments throughout the lifecycle of AI systems, from research and development to deployment and operation. At the same time, a clear distinction should be maintained between ethical principles, primarily normative and aspirational, and legally enforceable obligations, thereby ensuring both legal certainty and practical feasibility. Consideration should also be given to establishing an independent AI ethics oversight mechanism involving government authorities, industry representatives, academia and civil society.
In addition, greater protection should be afforded to individuals affected by AI systems, particularly regarding automated decision-making and personal data protection. Implementing regulations should recognise a right to explanation, enabling affected individuals to obtain meaningful information about the logic, input factors, and the degree of influence exercised by AI algorithms in decisions that affect their rights or interests. Individuals should likewise enjoy the right to request meaningful human review of decisions made exclusively or predominantly through automated processing, especially where such decisions have significant legal or practical consequences. Furthermore, both users and affected persons should be clearly informed whenever they interact with an AI system or when decisions affecting them are generated or materially influenced by AI. Detailed rules should also govern the use of personal data for AI model training, including requirements for informed consent, data anonymisation, and effective mechanisms to control subsequent uses of personal data.
Also, greater legal certainty is required concerning intellectual property and AI training data. Future legislation should distinguish more clearly between AI-assisted works, in which substantial human creativity remains involved, and AI-generated works, which are produced autonomously without meaningful human creative contribution. For AI-assisted works, copyright protection may appropriately remain vested in the individual or organisation exercising creative control over the AI system. By contrast, the legal treatment of fully AI-generated works should be developed with due regard to emerging international practices. At the same time, Vietnam should establish a licensing framework governing the use of copyrighted works and datasets for AI model training, seeking to balance the legitimate interests of copyright holders with the technological needs of AI developers. In this regard, the European Union’s Text and Data Mining (TDM) exceptions provide a useful comparative model, although any similar mechanism adopted in Vietnam should be accompanied by detailed implementing guidance to minimise unnecessary prejudice to the legitimate interests of rights holders. Consideration should also be given to establishing legal rules governing the valuation, transfer, licensing and commercialisation of AI-related intellectual property, thereby supporting the development of a vibrant technology market and innovation ecosystem.
Ultimately, the continued development of Vietnam’s AI regulatory framework will not only establish a transparent, trustworthy and human-centred legal environment for AI innovation but will also reinforce Vietnam’s position as a proactive and responsible participant in the global governance of AI. In doing so, it will contribute to the implementation of Resolution 57-NQ/TW, while advancing Vietnam’s broader aspiration to harness AI as a strategic driver of sustainable economic growth, technological self-reliance and national development in the digital era.-
[1] People’s Security Academy
