Current position
Overview
Vietnam enacted the Law on Artificial Intelligence (Law No. 134/2025/QH15) on 10 December 2025; it entered into force on 1 March 2026.
The law applies to domestic and foreign entities engaged in AI activities in Vietnam and adopts a risk-based framework with three tiers (high, medium and low risk). Prohibited systems include manipulative AI, social credit scoring, and real-time remote biometric identification in public spaces. High-risk systems in sensitive sectors must register in a national AI database. Grace periods apply: most existing providers have until 1 March 2027 to comply (1 September 2027 for health, education and finance).
The Ministry of Science and Technology (MOST) is the lead authority.
Key legislation & sources
Law on Artificial Intelligence (Law No. 134/2025/QH15) — summary
MOST (Ministry of Science and Technology)
Vietnam National AI Strategy
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
consultation closed
Ministry of Public Security closes consultation on draft national technical standard on cybersecurity, security information and event management (SIEM) products, general requirements
Source: Digital Policy Alert · View update ↗
implementation
Law on Digital Transformation including testing requirement enters into force
Source: Digital Policy Alert · View update ↗
implementation
Law on Digital Transformation including design requirements enters into force
Source: Digital Policy Alert · View update ↗
implementation
Decision on promulgating list of strategic technologies and list of strategic technology products enters into force
Source: Digital Policy Alert · View update ↗
consultation closed
Ministry of Public Security closes consultation on draft decree on cybersecurity protection for information systems including design requirements
Source: Digital Policy Alert · View update ↗
On 26 March 2026, the Ministry of Public Security closes the consultation on the Decree on cybersecurity protection for information systems. The decree applies to agencies and organisations involved in building, managing, operating, upgrading, or expanding information systems in Vietnam, including systems used to provide online services. The decree defines terms including information processing, information system operators, specialised cyber security units, and online services, and establishes roles and responsibilities between system managers and operators. It sets out principles requiring cybersecurity to be ensured continuously across the system lifecycle, aligned with technical standards, and implemented in a coordinated and resource-efficient manner with priority given to higher-risk systems. The Decree requires cybersecurity assurance plans to ensure system availability and minimise the impact of security incidents on the overall system when individual components are compromised. For level 3 and level 4 systems deployed using outsourced data centre or cloud services, it mandates logical separation from other systems, segmentation of network areas with access controls, and logically independent storage partitions. For level 5 systems or systems of national security importance, stricter requirements apply, including physical separation from other systems, physically independent storage partitions and main network equipment, and controlled access between system components. The decree also allows shared cybersecurity solutions for physically isolated systems only, where they are limited to monitoring, detection, warning, or edge protection functions and do not enable access to or control over internal system data or operations.
Showing 5 of 76 available API entries. Dates and summaries are supplied by Digital Policy Alert.