Vietnam AI law: what firms using AI should check

Vietnam AI law means the Law on Artificial Intelligence, which took effect on 1 March 2026. It sorts AI systems into three risk tiers and puts the heaviest duties on high-risk uses. A firm that uses or buys AI tools should know which tier each tool falls in, who is responsible for what, and which deadline applies. This checklist covers those points in plain terms. It is general information, not legal advice.

Sources: VnEconomy, "National Assembly approves Vietnam's first AI law" (11 December 2025); Allen & Gledhill, "Vietnam's new Law on Artificial Intelligence" (March 2026).

What the law is and when it applies

The National Assembly passed the law on 10 December 2025. Of the 434 delegates who took part, 429 voted yes. The law has 35 articles and is the country's first full law on AI. It follows a "management for development" approach. That means it tries to control risk without stopping firms from using the technology.

The law covers domestic and foreign organisations that run AI activities in Vietnam. It took effect on 1 March 2026. A framework law like this one leaves many details to later decrees from the Government, the Prime Minister and the Ministry of Science and Technology. As of the February 2026 Baker McKenzie update, those instruments were still being drafted. Treat the details below as a first check, and watch for the decrees.

Sources: VnEconomy (11 December 2025); Baker McKenzie, "Vietnam artificial intelligence law: foundation and outlook" (February 2026).

Check 1: Find the risk tier of each tool

The law sets three tiers. Systems should be classified before they are deployed.

High risk: systems that could seriously harm life, health, legal rights or national security. These need a conformity assessment before use and after major changes.
Medium risk: systems that could confuse or influence people because they may not realise they are dealing with AI or AI-made content.
Low risk: everything else, with light oversight.

The tier depends on the harm a system could do, the sector, the number of users and the scale of impact. The VnEconomy report says stricter rules apply to high-risk uses in areas such as finance, health care, justice, labour and education. If you buy a tool, you inherit the supplier's classification. If you change the tool in a big way, ask the supplier whether the tier still holds. Write down the tier for each tool in one list.

Sources: Allen & Gledhill (March 2026); Baker McKenzie (February 2026); VnEconomy (11 December 2025).

Check 2: Know your role

The law uses four roles. A developer builds, trains or fine tunes a system. A provider puts a system on the market or into use under its own name. A deployer uses a system in professional or commercial work. A user interacts with the system or uses its output. Personal, non commercial use is left out of the deployer role.

Most firms that buy AI tools are deployers. For a high-risk tool, a deployer must run and monitor it within the classified scope, protect the data and stop outside interference. For a medium-risk tool, the deployer is accountable for how it runs, for controlling risk and for handling incidents. Providers of high-risk systems must keep technical records. Providers of medium-risk systems must explain how their systems work when authorities ask. Ask each supplier for these documents now, and keep a copy.

Sources: Baker McKenzie (February 2026); Allen & Gledhill (March 2026).

Check 3: Labels, disclosure and incidents

Two duties matter for many firms. The first is openness. A system that talks directly to people should let them know it is AI, unless another law says otherwise. Providers must tag AI-made audio, images and video in a machine-readable way, as the Government will set out. Deployers must clearly tell the public when AI-made or AI-edited content could confuse people about whether a person or event is real. Content that copies a real person's face or voice, or recreates a real event, must be labelled so it can be told apart from real material.

The second is incidents. After a serious fault, developers and providers must act quickly to fix, suspend or recall the system and tell the authority. Deployers and users must record and report incidents through a central AI portal. Authorities can order a system to be suspended, withdrawn or reassessed. Set up a simple log and name one person to own it. Reporting thresholds are still to be clarified.

The law also bans some acts. These include using data in breach of data protection, personal data, intellectual property or cybersecurity laws, switching off or faking human oversight, and hiding required labels or warnings.

Sources: Allen & Gledhill (March 2026); Baker McKenzie (February 2026).

Check 4: Mark the deadlines

Systems already running before 1 March 2026 get a grace period. For health care, education and finance, it is 18 months from the effective date. For all other fields, it is 12 months from the effective date. The grace period does not protect a system that poses a serious risk. Authorities can still order it suspended or ended.

Foreign suppliers also have duties. A foreign provider of a high-risk system needs a legal contact point in Vietnam. If the system needs a conformity assessment before use, the provider must also have a commercial presence or an authorised representative there. If your vendor is abroad, ask where its contact point is. The law allows penalties from administrative fines to criminal liability. The Government will issue the detailed penalty rules later.

Sources: Baker McKenzie (February 2026); Allen & Gledhill (March 2026).

A short list to start this month

List every AI tool your firm uses, with the vendor and the team that owns it.
Mark each tool as high, medium or low risk, and note who decided.
Ask vendors for documents, logs and their Vietnam contact point.
Add AI labels to any AI-made image, audio or video you publish.
Start an incident log and name an owner.
Count 12 or 18 months from 1 March 2026, depending on your sector, put that date in your calendar, and watch for the new decrees.

Sources: Editors' practical guidance, drawn from the law summaries listed below.