Vietnam AI Law 2026 and AI Risk Classification

Updated: 23 September 2026

Vietnam's Artificial Intelligence Law No. 134/2025/QH15 took effect on 1 March 2026. Businesses introducing AI into products or processes must identify their role, intended use and system risk level. One general conclusion cannot cover every tool called AI.

Legislation to read together

Alongside the Law, Decree No. 142/2026/ND-CP, effective from 1 May 2026, implements classification, documentation, transparency and related duties. Decision No. 33/2026/QD-TTg establishes the high-risk AI system list and took effect on 15 August 2026. Check the list, exclusion conditions and transitional arrangements together.

Article 9 establishes three risk levels: high, medium and low. Prohibited conduct under Article 7 is separate and should not be described as a fourth risk level under Vietnamese law merely because another jurisdiction commonly presents its framework that way.

Classify the system rather than only the model

Article 6 of Decree No. 142 places classification in the context of the system and intended use. The same model may suggest wording or support decisions significantly affecting an individual. Assess risk according to deployment, function and impact, not only the model provider's name.

Article 10 of the Law assigns classification responsibility to providers. Medium- and high-risk systems require documentation and notification before use as prescribed, read alongside transitional rules. If a deployer changes the purpose or operation sufficiently to alter risk, reassess classification and corresponding responsibilities.

Where to submit notifications and conformity assessments

The Ministry of Science and Technology receives submissions through the AI one-stop electronic portal mechanism. Articles 12–14 of Decree No. 142 govern dossiers, conformity assessments and notification. If the portal has not officially launched, Article 46 permits the electronic systems, public services or receiving methods announced by the Ministry. Do not assume the obligation is suspended because a particular interface is unavailable.

Article 13 of the Law requires conformity assessment for high-risk systems. The method depends on the system category and list; not every system follows the same independent certification process. Check the conformity assessment column in the annex to Decision No. 33 for the specific case.

Transparency and human oversight

Article 11 of the Law and Articles 16–18 of Decree No. 142 govern transparency and identification of AI-generated or AI-modified content. Duties differ among providers, deployers and content publishers. Distinguish notices that a user is interacting with AI, machine-readable markings and visible labels in the situations required by law.

Articles 12 and 14 of the Law and implementing provisions establish incident management, supervision and control responsibilities for relevant cases. Using AI does not transfer an agency's or organisation's decision-making authority or responsibility to the system.

Transitional dates to track

Article 4 of Decision No. 33 requires listed systems operating before 15 August 2026 to fulfil obligations before 1 September 2027 in healthcare, education and finance, and before 1 March 2027 in other sectors. Systems entering operation within six months of the Decision's effective date must fulfil obligations before 1 March 2027 under paragraph 3.

During transition, systems posing a risk of serious harm may still be ordered suspended or terminated as prescribed. Businesses should document operational start dates, sectors and system scope to apply the correct timeline.

AI classification does not replace input data assessment

A low-risk AI system may still process sensitive personal data or restricted documents. The Personal Data Protection Law, especially Article 30, and Decree No. 356 remain relevant. Conversely, an AI system processing no personal data may still have duties under the Artificial Intelligence Law depending on function and impact.

Training sources, documents supplied to search tools and output content also require review of usage rights, trade secrets and contracts. The Intellectual Property Law was amended by Law No. 131/2025/QH15, effective from 1 April 2026. Being able to access a document does not establish sufficient rights for every use.

When deploying AI, assess classification documents alongside data flow diagrams and service terms. The article on customer and employee data in AI starts with a practical question: what information actually needs to be sent to the tool?

Frequently asked questions

Does every AI tool need a separate licence? That cannot be assumed. Distinguish classification, notification, conformity assessment and any sector-specific procedures.

Does using an overseas AI provider remove responsibility? No. Deployers remain responsible for obligations attached to their own use of the system.