Vietnam's AI Law: Enabling the AI EconomyA Framework That Is Globally Aligned and Distinctly Vietnamese

A New Voice in Global AI Regulation

When we talk about AI governance, the conversation is still largely dominated by two players: the European Union, with its comprehensive AI Act and GDPR architecture, and the United States, with its sector-driven, deregulation-leaning approach. But something significant happened on 1 March 2026. Vietnam's Law on Artificial Intelligence entered into force, and the global AI governance landscape quietly welcomed a new and thoughtful participant.

By February 2026, 38 countries had enacted AI laws, according to the IAPP Global AI Law Tracker. Vietnam is not simply joining a trend. It is contributing something genuinely distinct: a model that is simultaneously enabling, sovereignty-conscious, and rights-protective, without falling into the trap of regulatory overreach that has drawn so much criticism toward the EU AI Act.

I have had the opportunity to present this law at international forums, and I want to share what I believe practitioners and businesses most need to understand. This is not a law to be afraid of. It is a law worth paying attention to.

The Spirit of the Law: Enablement Before Restriction

The first thing I always say when presenting Vietnam's AI Law is this: do not read it as a law of restriction. Read it as a law of enablement.

Vietnam has made a deliberate political choice to position AI as a strategic economic driver, and the law reflects that at every level. Three provisions illustrate this orientation clearly.

Article 21 creates a regulatory sandbox, allowing businesses to test AI products in real-world conditions under regulatory oversight. Innovation cannot thrive under the weight of pre-market compliance uncertainty. The sandbox gives companies room to learn, adjust, and iterate before the full weight of regulatory obligations attaches.

Article 22 establishes the National AI Development Fund. This is a dedicated state resource, outside the normal annual budget cycle, committed to financing AI research, infrastructure, and scaling. Vietnam has written this fund into the law itself. That means AI development is a structural priority tied to the state's long-term vision, not a line item that disappears in next year's budget negotiations.

Article 25 provides government vouchers to SMEs and startups, giving them direct access to AI infrastructure, shared data, and technical consulting. For smaller businesses and foreign entrants who might otherwise face prohibitive barriers, this is a meaningful signal: Vietnam wants you to participate.

Hanoi offers regulatory partnership. That distinction matters enormously for any business thinking about Southeast Asia.

Sovereignty Written Into Law

One of the most distinctive features of Vietnam's AI Law is that it does not leave national sovereignty to policy documents and executive decisions. It writes sovereignty directly into the statutory text. Three articles form the core of this architecture:

Article 16 establishes national AI infrastructure: state-funded compute, cloud, and connectivity made available to domestic developers and investors. This is not a pilot program. It is a legal entitlement, giving domestic AI actors a structural advantage in the global competition for compute access.

Article 17 creates AI Service Data Platforms: shared national data assets for AI training. By reducing the data acquisition barrier at the legislative level, Vietnam addresses one of the most significant asymmetries in global AI competition, which is the advantage held by large incumbents sitting on proprietary data estates.

Article 18 mandates a structured program to build domestic AI capability and explicitly targets reduced dependence on foreign technology stacks. This is digital sovereignty as industrial policy.

Europe began waking up to this issue at the France and Germany Digital Sovereignty Summit in November 2025. Vietnam did not wait for a geopolitical crisis. It wrote the response into law.

The Risk Framework: Three Tiers, Five Criteria

Vietnam's approach to risk classification will be familiar in structure to anyone who knows the EU AI Act. It uses a tiered model: high risk, medium risk, and low risk, each triggering proportionate compliance obligations. Unlike the EU's four-tier system, Vietnam works with three categories, which I find cleaner in practice.

What is genuinely innovative is how Vietnam defines high-risk classification. Rather than publishing a fixed list of use cases at enactment, the law establishes five substantive criteria under Article 9:

Human Rights Impact asks whether the system affects health, freedom, or equality.

Safety and Security asks whether it implicates public order, cybersecurity, or national security.

Context and Domain considers whether deployment is in healthcare, education, finance, or the justice system.

Level of Automation asks whether the system makes or heavily influences consequential decisions.

User Scope and Scale asks how many people are affected and over what timeframe.

The specific thresholds will be issued by the Prime Minister.

Accountability: The Five AI Actors

Vietnam's accountability framework identifies five distinct legal actors, and understanding who they are is essential for any business structuring its Vietnam operations.

The Developer creates or designs the AI system and is responsible for safety and legal compliance from the design stage onward.

The Provider brings the AI to market and must meet all regulatory requirements before commercial deployment.

The Deployer uses the AI in a real-world setting and is responsible for risk assessments, ethical use, and incident reporting.

The User interacts with the AI and carries a responsibility to engage responsibly and understand the system's limitations.

The Impacted Person is anyone significantly affected by the AI's decisions or outputs. This person has defined rights: to be informed, to seek redress, and to challenge outcomes.

That last category is the one I find most compelling. Recognising the Impacted Person as a defined legal actor is not merely a consumer protection gesture. It is a governance mechanism. It creates structural pressure for meaningful transparency and redress that goes beyond disclosure requirements. From a rights-based perspective, it is arguably the most significant single provision in the entire law.

The Compliance Lifecycle: Pre-Launch to Post-Deployment

For businesses preparing to operate under Vietnam's AI Law, obligations follow a clear three-stage lifecycle.

At the pre-launch stage, companies must self-classify their AI system by risk tier, prepare technical documentation and data governance materials, develop a risk management framework, and, where applicable, complete a conformity assessment and notify the Ministry of Science and Technology.

At go-live, transparency is the central obligation. Users must be informed they are interacting with an AI system. AI-generated content must be appropriately labelled. Where the risk profile requires it, human oversight mechanisms must be activated before the system goes live.

Post-deployment obligations are ongoing. This means continuous risk monitoring, performance tracking, and incident reporting within 24 hours for high-risk systems. Systems must be reclassified if their risk profile changes, and operators must cooperate with regulatory audits and inspections.

For foreign providers, Article 14, Clause 6 is particularly important. Foreign providers of high-risk AI systems must appoint a legal liaison in Vietnam, but are not required to establish a commercial presence unless the system is subject to mandatory conformity assessment. This is a deliberate incentive: legal clarity and market access, without the overhead of physical establishment. It is one of the details that I find most telling about the intent behind this law.

Enforcement: Proportionate and Investment-Conscious

Vietnam's enforcement approach contrasts noticeably with the EU AI Act's headline penalties of up to 35 million euros or 7% of global annual turnover. Vietnam's penalties scale to business operations within Vietnam and reflect the seriousness of the violation.

This is not a soft stance on compliance. The law is clear that enforcement will grow alongside the sector. But it is an investment-conscious stance: penalties designed to change behaviour without deterring the foreign participation that Vietnam's AI ecosystem genuinely needs.

For practitioners advising multinational clients, this proportionality changes the risk calculus meaningfully. Vietnam market entry does not carry the same compliance risk profile as EU AI Act exposure, and that difference is deliberate.

Global Alignment and Regional Leadership

Vietnam's AI Law does not exist in isolation. Vietnam has actively participated in building the international norms this law reflects: the UNESCO AI Ethics Recommendation, the ASEAN AI Governance and Ethics Guidelines, and the UN Convention Against Cybercrime, known as the Hanoi Convention, which Vietnam hosted and signed.

This alignment matters for practitioners because it signals that Vietnam's regulatory direction is unlikely to diverge sharply from international consensus on the fundamentals: transparency, human oversight, non-discrimination, and data protection. Companies that have invested in EU AI Act compliance will find meaningful conceptual overlap with Vietnam's framework, even where specific obligations differ.

At the regional level, Vietnam's AI Law positions it as a potential governance leader within ASEAN. With implementing regulations still being finalised as of March 2026, there is real space for international legal expertise to contribute to a framework that will shape AI governance across Southeast Asia for years to come.

What This Means for Practitioners

For EU-based counsel advising Vietnamese companies, the risk classification logic, accountability chain, and transparency obligations will feel conceptually familiar. The key differences are the sandbox mechanism, the government support infrastructure, and the proportionate enforcement model. These represent genuine competitive advantages that should feature prominently in any market entry advice.

For international AI companies considering Vietnam, the legal liaison requirement under Article 14 is manageable. The sandbox provides a real compliance pathway for novel systems. The voucher and fund provisions offer financial support that should be factored into business case modelling, not treated as a footnote.

For data protection practitioners, Article 7 Clause 3 creates a direct intersection between AI compliance and Vietnam's Personal Data Protection Decree through its prohibition on illegal data collection or processing. A unified data and AI governance strategy is not optional.

For IP practitioners, the explicit prohibition on AI systems that infringe intellectual property rights, including through training data, creates due diligence obligations that apply from model procurement onward.

Vietnam Is Building Its Own Seat at the Table

Let me close the way I close when I speak about this law in person.

Vietnam's AI Law is clever, forward-thinking legislation. It draws on global experience while remaining distinctly Vietnamese in its ambition. This is a country that has decided it will not be a passive consumer of AI governance frameworks designed elsewhere. It is building its own.

The law supports businesses with real financial tools. It protects citizens through genuine accountability mechanisms, including the novel recognition of the Impacted Person as a legal actor. It builds sovereignty into its statutory structure. And it manages risk through a principled, criteria-based framework designed to evolve as the technology evolves.

For the international AI law community, Vietnam deserves more than passing attention. The implementing regulations coming in 2026 will be critical to follow. And practitioners with expertise in both EU frameworks and Vietnamese regulatory context will find themselves in a genuinely valuable position, both to contribute and to advise.

Vietnam is not waiting on the sidelines of the global AI conversation. It is building its own seat at the table. And from what I have seen of this law, the seat is built to last.

The views expressed in this article are solely those of the author and do not represent the position of any affiliated institution. This article is for informational purposes only and does not constitute legal advice. Implementing regulations remain pending as of the date of publication; practitioners should verify current requirements before advising clients.