Vietnam’s Law on Artificial Intelligence is now in force and sets a comprehensive framework for the development, deployment, and management of AI. Multiple sources note the same key dates: it was passed by the National Assembly on December 10, 2025, and became effective on March 1, 2026. The law regulates research, development, provision, deployment, and use of AI systems in Vietnam. It also signals a policy direction that aims to balance innovation with risk control, with guiding principles such as human-centric development, safety, fairness, transparency, and accountability. In practice, that means organizations should plan for governance that keeps meaningful human supervision and clear responsibility for outcomes.
A central operational requirement is risk classification. Vietnam’s framework categorizes AI systems by level of risk (low, medium, or high), with stricter obligations for systems with greater potential impact on individuals, public safety, or national infrastructure. This makes risk triage the first compliance step for most teams. OneTrust gives a practical contrast: a generative AI tool used internally to draft marketing copy may be lower risk, while AI used to evaluate credit eligibility or recommend medical treatment would likely draw stricter scrutiny. For businesses, documenting how you reached your risk classification is as important as the classification itself, because follow-on duties depend on that first decision.
What Businesses Must Implement Before and After Deployment
High-risk AI systems face the most stringent controls, including pre-deployment conformity assessments to verify safety and compliance requirements. Depending on the category, assessments may be performed through registered conformity assessment bodies or through self-assessment mechanisms. Baker McKenzie’s overview adds that Vietnam also introduces mandatory conformity certification for select systems on a prime minister-issued list. For foreign providers, the law can also require a local contact point, and for those requiring pre-use conformity certification, a commercial presence or authorized representative. Securiti notes that “conformity assessment” is the mandatory verification process before a high-risk system is put into service or placed on the market, and it points to an AI Single-Window Portal intended to streamline tasks such as sandbox registration, incident reporting, and public disclosure of AI system classifications.
Vietnam also clarifies accountability across the AI lifecycle. The law distinguishes roles involved in AI development and deployment, reflecting multi-party supply chains where a global provider may build a tool and a Vietnamese organization deploys it. This matters for contracts and operating procedures: responsibilities should be allocated between developers, providers, deployers, and end users in a way that aligns with how the system is designed, provided, and operated. TechPolicy.Press highlights the law’s emphasis that AI is a support tool and that final decisions in matters important to society must be made by humans. It also reports that Vietnam sets out rules for fault-based liability, reinforcing why organizations should keep evidence of supervision, testing, and decision controls when AI outputs influence real-world outcomes.
To operationalize Vietnam AI law compliance in 2026, many businesses will need a staged plan that starts immediately and continues through 2027. Securiti states a 12-month compliance grace period (to March 2027) for general AI systems, which can help prioritize remediation work. At the same time, Baker McKenzie notes that pre-market models are required to be compliant by August 2, 2027. Because application procedures were still pending as of May 2026 according to SotaMedia, teams should build “no-regrets” controls now: maintain a system inventory, document risk classification, define who is accountable for oversight, prepare for conformity assessments where relevant, and establish internal workflows to use the AI Single-Window Portal for reporting and required disclosures. This is the most practical way to reduce rework as implementation details and lists of covered systems are clarified.
When did Vietnam’s AI Law take effect, and when was it passed?
How does the law classify AI systems for compliance purposes?
What must businesses do for high-risk AI systems before deployment?
Do foreign AI providers have obligations under Vietnam’s AI Law?
What is a practical first step for Vietnam AI law compliance in 2026?
