When did Vietnam's AI Law take effect?

Vietnam's Law on Artificial Intelligence, No. 134/2025/QH15, was passed on 10 December 2025 and took effect on 1 March 2026. According to legal summaries, AI systems already operating before that date have a transition period of 12 to 18 months. Businesses should confirm the exact deadline for their own systems in the official text.

Does Vietnam's AI Law require labeling AI-generated content?

Yes. According to legal summaries, Article 11 requires labeling of AI-generated audio, images and video that simulate real people or real events. Businesses that use AI for marketing, training videos or synthetic voices should label those assets clearly and keep a record of what was generated. Check the official text for the required form of labels.

How does the Personal Data Protection Law affect AI projects?

Law 91/2025/QH15, in force since 1 January 2026, requires impact assessments for personal data processing and breach notification within 72 hours, according to Tilleke & Gibbins. AI systems that process customer or employee data fall within scope. Fines can reach 5% of prior-year revenue for cross-border violations, so assessments and breach procedures must cover AI tools.

Vietnam AI Law 2025: A Compliance Checklist for Businesses

Vietnam's AI Law 134/2025/QH15 has applied since 1 March 2026. A business deploying AI should inventory its AI systems, classify each by risk, label AI-generated media that simulates real people or events, keep people in charge of consequential decisions, and handle personal data under Law 91/2025/QH15, which requires impact assessments and 72-hour breach notification.

This is not legal advice. This article summarizes public sources for general information. Several details come from secondary legal summaries, and we flag those in the text. Check the official texts and consult a qualified lawyer before making compliance decisions.

Which laws govern AI use in Vietnam in 2026?

Three instruments matter most for a company deploying AI.

Instrument	Status	What it adds
Law on Artificial Intelligence 134/2025/QH15	Passed 10 December 2025, effective 1 March 2026	Risk tiers (low, medium, high), prohibited acts (Art. 7), labeling of AI-generated media (Art. 11)
Decree 142/2026/NĐ-CP	Guides the AI Law	Classification before use, cooperation on reclassification, conformity assessment for high-risk systems
Personal Data Protection Law 91/2025/QH15	Passed 26 June 2025, effective 1 January 2026	Impact assessments, 72-hour breach notification, higher fines

According to summaries by Vietcetera and Apolat Legal, the AI Law has 8 chapters and 35 articles. According to VietnamPlus, Decree 142 requires providers to classify AI systems before use, requires deployers to cooperate on reclassification, and sets conformity assessment for high-risk systems. The PDPL details come from Tilleke & Gibbins.

How does this connect to Resolution 57-NQ/TW?

Resolution 57-NQ/TW of 22 December 2024 sets the national direction on science, technology, innovation and digital transformation. According to VietnamPlus, its AI goal is for Vietnam to rank among the top three in Southeast Asia in AI research and development by 2030.

The AI Law gives that ambition a legal frame. For a business, compliance is the condition for using AI at scale with the trust of customers, regulators and staff.

Does the law apply to companies that only use AI tools?

Yes. Decree 142 assigns duties to providers, which build or supply AI systems, and to deployers, which use them in their operations. Many companies are both. A firm that builds an internal agent on top of a vendor's model supplies that agent to its own staff and also deploys the vendor's model.

The practical question is which role you hold for each system. Answer it system by system in your inventory.

What are the penalties?

According to legal summaries, fines under the AI Law reach 2 billion VND for organizations and 1 billion VND for individuals, and up to 2% of revenue in Vietnam in serious cases. These figures come from secondary sources, so verify them against the statute.

Under the PDPL, according to Tilleke & Gibbins, fines can reach 5% of prior-year revenue for cross-border violations.

According to the same legal summaries, AI systems already operating before 1 March 2026 have a transition period of 12 to 18 months. Confirm in the official text which period applies to your systems.

The AI compliance checklist for businesses

The table below turns the three instruments into tasks with owners. Use it as a starting point with your legal adviser.

#	Task	What to do in practice	Legal anchor	Typical owner
1	Inventory AI systems	List every AI tool and agent in use, including AI features inside SaaS and staff's personal tools. Record purpose, data used, users and vendor.	AI Law; Decree 142	CIO or IT lead
2	Classify by risk	Assign low, medium or high to each system and record the reasoning. Work with providers on classification. Plan conformity assessment for high-risk systems.	AI Law risk tiers; Decree 142	Legal and risk, with IT
3	Screen for prohibited uses	Check every use case against the prohibited acts in Article 7.	AI Law Art. 7	Legal
4	Label AI-generated media	Label AI-generated audio, images and video that simulate real people or events. Keep a register of generated assets.	AI Law Art. 11	Marketing and communications
5	Keep human oversight	Name a responsible person for each system. Require human approval before AI output becomes a decision about customers, employees or money. Log the approvals.	Risk-based approach of the AI Law; confirm duties for your tier	Process owner
6	Run data protection impact assessments	Assess each AI use that processes personal data. Update the assessment when purpose, data or vendor changes.	PDPL 91/2025	Data protection officer or legal
7	Prepare 72-hour breach reporting	Extend incident procedures to AI tools: detection, decision owner, notification within 72 hours, and logs that show what data the AI accessed.	PDPL 91/2025	Information security
8	Tighten vendor contracts	Cover data location, no training on company data, subprocessors, cross-border transfers, audit rights, cooperation on classification, IP ownership and exit terms.	PDPL; Decree 142	Procurement and legal
9	Keep records	Retain logs of who used which system, with what data, and what it produced.	Supports all of the above	IT
10	Train staff	Teach approved tools, data levels and labeling rules.	Supports all of the above	HR

Why start with the inventory?

You cannot classify what you have not found. Shadow AI is common. According to the MIT NANDA report summarized by Virtualization Review (19 August 2025), workers at more than 90% of companies use personal AI tools. Each of those is a data flow your impact assessment needs to cover.

What does labeling mean for marketing teams?

Article 11 targets synthetic audio, images and video that simulate real people or events. A product video with an AI-generated presenter, a cloned voice for a hotline or a generated photo of an event all fall in this area. Add visible labels and keep the source files and prompts.

What does human oversight look like in practice?

Assign a named reviewer for each AI workflow. Make the reviewer's approval a required step before output reaches a customer, a payment or a personnel file. Record who approved what and when. This also gives you the evidence a regulator or auditor will ask for.

What should vendor contracts include?

The PDPL makes you responsible for how vendors process personal data on your behalf. Decree 142 expects deployers to cooperate on classification, which requires information from providers. Gartner adds a commercial angle. According to Gartner (29 September 2026), companies should settle governance, IP ownership, knowledge transfer and exit terms before vendor engineers build agentic AI for them.

How Redstone handles this

Redstone is built around the AI Law 134/2025/QH15 and the PDPL 91/2025/QH15. It does not make a company compliant on its own. Risk classification and labeling decisions stay with you. It does give you the controls and evidence the checklist calls for.

One inventory. When staff use AI through one platform, the governance console shows who uses which agents, models and integrations, and how much.
Four data levels. Public, Internal, Confidential and Secret. Confidential data runs only on models hosted in Vietnam. Secret work is isolated and requires written approval. This makes data flows explicit for impact assessments.
PII masking. Personal data can be masked before it reaches a model.
On-premise deployment. Redstone runs on your servers or in a Vietnamese data center, and company data is not used to train models. This simplifies cross-border transfer questions and vendor terms.
Audit log with CSV export. Every agent action is recorded, which helps you reconstruct an incident inside the 72-hour window and answer auditors.
Human review. Agents propose new skills and a person approves them. In the AI Factory, agents act as the assigned person with that person's permissions, and people review the output.
Kill switch. One control stops all agents across the organization.

Talk to us about mapping your AI systems against this checklist.