Vietnam AI Law 134/2025/QH15: English summary

Full title: Law No. 134/2025/QH15 on Artificial Intelligence
Issued by: the 15th National Assembly, 10th session, passed on 10 December 2025 (signed by Chairman of the National Assembly Tran Thanh Man)
In force from: 1 March 2026, except for the transitional matters in Article 35 (Article 34)
Structure: 8 chapters, 35 articles
Repeals: Clause 9 of Article 3, Clause 7 of Article 4, Clause 6 of Article 12, point dd of Clause 2 of Article 34 and Chapter IV of Law No. 71/2025/QH15 on Digital Technology Industry (Article 33)
Implementing texts: Decree 142/2026/ND-CP; Decision 33/2026/QD-TTg (list of high-risk AI systems); Circular 05/2026/TT-BKHCN (national AI ethics framework)
Administrative penalties: as of 13 October 2026, no decree issued under Clause 5 of Article 29 found
Published in: Official Gazette No. 40 of 22 January 2026
Official Vietnamese text: Government e-portal · Official Gazette

Note: this page is LexData’s own unofficial English summary. It is not the full text of the Law or an official translation. Only the Vietnamese text has legal effect. The detail focuses on the provisions businesses most need (Articles 3, 7, 9-15, 21, 29 and 35). The summary was checked against the Official Gazette texts as of 13 October 2026.

Scope and structure

The Law governs the research, development, supply, deployment and use of AI systems (together, “AI activities”), the rights and obligations of those involved and state management of AI activities in Vietnam (Clause 1, Article 1). AI activities used solely for national defence, security or state cipher purposes are outside its scope (Clause 2, Article 1). It applies to Vietnamese agencies, organisations and individuals and to foreign organisations and individuals taking part in AI activities in Vietnam (Article 2).

Chapter	Subject	Articles
I	General provisions (definitions, principles, state policy, prohibited acts, one-stop portal)	1-8
II	Risk-based classification and management of AI systems	9-15
III	National AI infrastructure and sovereignty	16-18
IV	AI adoption, innovation ecosystem and workforce	19-25
V	Ethics and responsibility in AI activities	26-27
VI	Inspection and handling of violations	28-29
VII	State management of AI	30-32
VIII	Final provisions	33-35

Definitions and roles (Article 3)

Obligations follow the role a business plays in relation to a given AI system, so the first step is to work out that role.

Term	Meaning in short	Source
AI system	A machine-based system that performs AI capabilities with varying levels of autonomy, may adapt after deployment, and infers from inputs to produce outputs such as predictions, content, recommendations or decisions	Clause 2
Developer	Designs, builds, trains, tests or fine-tunes all or part of an AI model, algorithm or system and has direct control over the technical method, training data or model parameters	Clause 3
Provider	Places an AI system on the market or into use under its own name, brand or trademark, whether it developed the system itself or a third party did	Clause 4
Deployer	Uses an AI system under its control in professional or commercial activity or in providing services; personal, non-commercial use is excluded	Clause 5
User	Interacts directly with an AI system or uses its output	Clause 6
Affected person	Whose rights, interests, life, health, property, reputation or access to services are directly or indirectly affected by an AI system	Clause 7
Serious incident	An event in the operation of an AI system that causes or risks significant harm to life, health, human rights, property, cybersecurity, public order or the environment, or disrupts an information system important to national security	Clause 8

Principles and sector rules (Articles 4 and 6)

Article 4 sets four principles: a human-centred approach; AI does not replace human authority and responsibility, and human control and the ability to intervene must be maintained; fairness, transparency and accountability; and green, inclusive and sustainable AI. Essential sectors such as healthcare and education are subject to stricter risk management, and ministries may set sector-specific requirements (Clauses 2 and 4, Article 6).

Prohibited acts (Article 7)

Exploiting or taking over an AI system to break the law or infringe the lawful rights and interests of others.
Developing, supplying, deploying or using an AI system in order to: commit acts prohibited by law; use fake or simulated elements of real people or events to deceive or manipulate human perception or behaviour deliberately and systematically, causing serious harm; exploit the weaknesses of vulnerable groups (children, older people, people with disabilities, ethnic minorities, people lacking or with limited civil capacity and others); or create or spread fake content that may seriously harm national security, public order or social safety.
Collecting, processing or using data to develop, train, test or operate an AI system in breach of the law on data, personal data protection, intellectual property or cybersecurity.
Obstructing, disabling or distorting human oversight, intervention and control mechanisms.
Hiding information that must be disclosed or explained; removing or falsifying mandatory information, labels or warnings.
Using AI research, testing, assessment or inspection as cover for unlawful acts.

One-stop AI portal (Article 8)

The one-stop AI portal receives sandbox applications, classification notices, serious-incident reports and periodic reports, and publishes information on AI systems, conformity assessment results and enforcement outcomes (Clause 1). A national database of AI systems sits alongside it (Clause 2). Publication must protect state secrets, trade secrets and personal data (Clause 3). Under Clause 1, Article 46 of Decree 142/2026/ND-CP, until the Ministry of Science and Technology (MOST) announces that the portal is officially operating, notices and reports are filed through the channel MOST announces, with the same legal effect.

Risk classification and notification (Articles 9 and 10)

Three risk tiers (Clause 1, Article 9):

Tier	Test
High risk	May cause significant harm to life, health, the lawful rights and interests of organisations or individuals, national or public interests, or national security
Medium risk	May confuse, influence or manipulate users because they cannot tell that they are dealing with an AI system or with AI-generated content
Low risk	Any system not in the two tiers above

Classification looks at the impact on human rights, safety and security; the sector of use, especially essential sectors; and the number of users and scale of impact (Clause 2, Article 9). The details are in Chapter II of Decree 142/2026/ND-CP (Articles 5-15).

Process (Article 10):

The provider self-classifies each system before putting it into use; a medium- or high-risk system needs a classification file (Clause 1).
The deployer inherits the provider’s classification and must keep the system safe and intact; if it modifies, integrates or repurposes the system in a way that creates new or higher risk, it works with the provider to reclassify (Clause 2).
For a medium- or high-risk system, the provider notifies the classification result to MOST through the one-stop portal before the system is put into use. Developers of low-risk systems are encouraged to publish basic information (Clause 3).
A provider unsure of the risk tier may ask MOST for guidance on the basis of its technical file (Clause 4).
Supervision follows the tier: high-risk systems are inspected periodically or when there are signs of a violation; medium-risk systems are supervised through reports, sample checks or independent assessment; low-risk systems are monitored only after an incident or complaint or where safety requires it (Clause 5).
Where checks reveal errors or untruthful declarations, the authority may order reclassification, additional documents or suspension of use, and handle the breach under the law (Clause 6).

Transparency and labelling (Article 11)

Who	Duty	Source
Provider	An AI system that interacts directly with people must be designed so users know they are interacting with it, unless the law provides otherwise	Clause 1
Provider	Audio, images and video generated by an AI system must be marked in a machine-readable format as the Government prescribes	Clause 2
Deployer	Clearly disclose when making available to the public text, audio, images or video created or edited with AI, where the content may mislead people about the authenticity of events or persons	Clause 3
Deployer	Audio, images or video that simulate the appearance or voice of a real person or recreate real events must carry an easily recognisable label; for film, art and creative works the label may take a suitable form that does not interfere with the work	Clause 4
Provider and deployer	Keep the transparency information in place for as long as the system, product or content is supplied	Clause 5

The form of disclosures and labels is set by the Government (Clause 6), currently in Articles 16-18 of Decree 142/2026/ND-CP.

AI incidents (Article 12)

Every party (developer, provider, deployer and user) must keep the system safe and reliable and promptly detect and fix incidents (Clause 1). When a serious incident occurs (Clause 2):

the developer and provider must urgently apply technical fixes, suspend or withdraw the system, and notify the competent authority;
the deployer and user must record and promptly report the incident and cooperate in fixing it.

The competent authority receives, verifies and guides the response, and may order suspension, withdrawal or reassessment of the system (Clause 3). Reports go through the one-stop portal (Clause 4); the details are in Article 19 of Decree 142/2026/ND-CP.

High-risk AI systems (Articles 13 and 14)

Conformity assessment (Article 13). A high-risk system must undergo conformity assessment against the requirements of Article 14 before it is put into use or when it changes significantly; where technical standards or regulations exist, assessment under the law on standards also applies (Clause 1). Systems on the list that require certification before use are assessed by a registered or recognised conformity assessment body; for other high-risk systems the provider may self-assess or hire such a body (Clause 2). A conformity result is a condition for putting the system into use (Clause 3). The Prime Minister issues the list of high-risk AI systems, including those that require certification (Clause 4); that list is now Decision 33/2026/QD-TTg.

Provider duties (Clause 1, Article 14): set up, maintain and review risk management; govern training, testing and operating data; prepare, update and keep technical documentation and activity logs; design for human oversight and intervention; meet transparency and incident duties; explain the system to the authorities and give users and affected persons public information on its function, operation and risks; and cooperate in inspections, post-market checks and incident response. These explanations do not require disclosure of source code, detailed algorithms, parameter sets or trade and technology secrets (point e).

Deployer duties (Clause 2, Article 14): operate and monitor the system within its intended purpose, scope and risk tier; keep data secure and preserve human intervention; maintain compliance with AI technical standards; meet transparency and incident duties; explain operations to the authorities and give public information to users and affected persons; and cooperate with the provider and the authorities.

Users follow operating procedures, must not tamper with system functions and report incidents to the deployer (Clause 3). Providers and deployers are encouraged to buy civil liability insurance or use other financial security (Clause 5).

Foreign providers (Clause 6, Article 14): a foreign provider of a high-risk system supplied in Vietnam must have a lawful point of contact in Vietnam; if the system requires certification before use, it must have a commercial presence or an authorised representative in Vietnam.

Medium- and low-risk AI systems (Article 15)

Medium risk (Clause 1): provider and deployer meet the Article 11 transparency duties; the provider explains the purpose, functional logic, main input data and risk controls when the authorities ask during an inspection or when there are signs of risk or an incident; the deployer explains its operation, risk control and incident handling; users comply with disclosure and labelling rules.
Low risk (Clause 2): provider and deployer explain only when the authorities ask because of signs of a violation or harm to lawful rights and interests; users may use the system for lawful purposes and are responsible for their own use.
The State encourages both tiers to apply AI technical standards (Clause 3).

Infrastructure, ecosystem and sandbox (Chapters III and IV)

Infrastructure and data (Articles 16-18): important AI applications in essential sectors on a list issued by the Prime Minister must run on national AI infrastructure (Clause 5, Article 16). Businesses are encouraged to share their databases by agreement, in line with the law on data, personal data protection and intellectual property (Clause 4, Article 17).
Incentives (Article 20): AI activities receive the highest incentives and support available under the laws on science and technology, investment, digital technology industry, high technology and digital transformation (Clause 1).
Regulatory sandbox (Article 21): runs under the law on science, technology and innovation. Sandbox results can be used to recognise conformity assessment results or to exempt, reduce or adjust compliance duties (Clause 2); a sandbox can be suspended or ended if risks arise (Clause 3). The details are in Chapter IV of Decree 142/2026/ND-CP (Articles 21-27).
Business support (Article 25): SMEs and innovative start-ups receive support for conformity assessment costs and free templates, self-assessment tools, training and advice (Clause 1), and vouchers for computing infrastructure, shared data and Vietnamese large language models (Clause 2).
Chapter IV also covers the national AI strategy (Article 19), the National AI Development Fund (Article 22), the AI workforce (Article 23) and AI clusters (Article 24).

Ethics and responsibility (Articles 26 and 27)

The Minister of Science and Technology issues the national AI ethics framework, which organisations and individuals are encouraged to apply (Clauses 4 and 5, Article 26). Article 27 applies to state bodies using AI in public administration and public services: they must follow the framework, the human decision-maker remains responsible for how AI output is used, and an impact assessment report is required for high-risk systems or systems with a significant effect on human rights, social fairness or the public interest.

Inspection, violations and liability (Articles 28 and 29)

Inspection (Article 28). During an inspection, organisations and individuals must provide technical documentation, logs, training data and other information needed to identify the cause of a violation or incident or to allocate responsibility (Clause 3). Inspection conclusions and penalty decisions are published (Clause 4). In turn, the authorities must keep information supplied to them confidential, including source code and algorithms, and may only request what is necessary and proportionate (Clauses 1 and 2, Article 31).

Violations (Article 29):

Breaches of the Law and other AI-related rules lead to administrative penalties or criminal liability, and damage must be compensated under civil law (Clause 1).
If a high-risk system is managed, operated and used in compliance with the rules but still causes damage, the deployer compensates the injured party and may then claim reimbursement from the provider, developer or other parties if they have agreed to this (Clause 2).
That liability is excluded where the damage is entirely due to the injured party’s intentional fault, or arises from force majeure or necessity, unless the law provides otherwise (Clause 3).
If a third party hacks, takes control of or unlawfully interferes with the system, the third party is liable; a deployer or provider at fault for allowing this is jointly liable under civil law (Clause 4).
The Government is to set the detailed rules on administrative penalties (Clause 5).

Status of fines. The Law sets no fine amounts. As of 13 October 2026, LexData has found no decree on administrative penalties for breaches of the AI Law under Clause 5 of Article 29, and Decree 142/2026/ND-CP does not cover this. Decree 330/2026/ND-CP penalises breaches of cybersecurity and personal data protection rules; its Article 67 covers breaches of personal data protection rules in AI and metaverse systems. It penalises personal data breaches (including those that occur in AI systems), not the duties specific to Law 134/2025/QH15 such as classification notices or labelling.

State management (Articles 30 and 32)

The Government has overall responsibility for state management of AI; MOST is the lead agency; ministries work with MOST within their remits; and provincial People’s Committees manage AI locally (Clause 2, Article 30). The State encourages international cooperation, including mutual recognition of conformity assessment results (Clause 2, Article 32).

Entry into force, repeals and transition (Articles 33-35)

Repeals (Article 33): Clause 9 of Article 3, Clause 7 of Article 4, Clause 6 of Article 12, point dd of Clause 2 of Article 34 and Chapter IV of Law No. 71/2025/QH15 on Digital Technology Industry.
Entry into force (Article 34): 1 March 2026, except for the matters covered by Article 35.
Transition (Article 35): for AI systems already in operation before 1 March 2026, providers and deployers must meet their compliance duties within 18 months from the Law’s entry into force for systems in healthcare, education and finance, and within 12 months for other systems (Clause 1). Systems may keep operating during that period unless the authority finds a risk of serious harm and orders suspension or termination (Clause 2).
Systems on the high-risk list (Article 4 of Decision 33/2026/QD-TTg): listed systems in operation before 15 August 2026 must comply before 1 September 2027 in healthcare, education and finance and before 1 March 2027 in the other listed sectors; systems put into operation within six months from 15 August 2026 must comply before 1 March 2027.

Implementing texts

Instrument	Content	In force
Decree 142/2026/ND-CP of 30 April 2026	Details several articles of the Law and measures for its implementation (8 chapters, 46 articles): the one-stop portal, risk classification, classification files and notices, technical marking and labelling, serious incidents, conformity assessment, the sandbox, infrastructure, data and support measures	1 May 2026 (Article 45)
Decision 33/2026/QD-TTg of 30 June 2026	List of high-risk AI systems: 46 systems in 6 sectors (education; ethnic and religious affairs; healthcare; banking; judicial proceedings; transport); for each system the list states whether conformity assessment follows point a (certification) or point b of Clause 2, Article 13 of the Law	15 August 2026 (Article 3)
Circular 05/2026/TT-BKHCN of 10 March 2026	National AI ethics framework; applies to AI used for public administration and public services, and other organisations and individuals are encouraged to apply it (Article 1)	10 March 2026 (Article 4)

Decree 142/2026/ND-CP and Decision 33/2026/QD-TTg were signed by Deputy Prime Minister Ho Quoc Dung; Circular 05/2026/TT-BKHCN was signed by Minister of Science and Technology Nguyen Manh Hung.

Sources checked

LexData checked this summary against Law 134/2025/QH15 in Official Gazette No. 40 of 22 January 2026, Decree 142/2026/ND-CP in Official Gazette No. 278 of 18 May 2026, Decision 33/2026/QD-TTg in Official Gazette No. 395 of 14 July 2026 and Circular 05/2026/TT-BKHCN on the Government e-portal. Links:

See our article on the Vietnam AI law for foreign-invested companies and the summary of the Personal Data Protection Law 2025 for the rules on data used to train and run AI.

Artificial Intelligence Law 2025 (Law No. 134/2025/QH15) (English summary)