Vietnam has leapt ahead in regional AI regulation with the newly passed Law 134/2025/QH15. Moreover, the accompanying Prohibited Acts Decree establishes hard limits on technology uses that threaten public safety. Consequently, developers, platforms, and investors now face a detailed rulebook that combines risk classification with heavy fines. Meanwhile, deepfake fraud and cyberattacks already cost Vietnamese users billions of dong, pressuring lawmakers to act decisively. In contrast to older frameworks like Decree 72, the new rules target algorithmic manipulation rather than generic content control. Furthermore, officials stress that strict Governance will stimulate trustworthy innovation by clarifying acceptable boundaries. Businesses therefore need to map their systems against the law’s risk tiers before the 1 March 2026 start date. Regulatory capacity, certification pathways, and user labeling duties will determine practical burdens. Nevertheless, early preparation can reduce disruption and unlock market advantages. The following analysis unpacks the law’s structure, obligations, and controversies in a concise, actionable format.

AI Law Overview Snapshot

Law 134/2025/QH15 contains 35 articles that define a tiered approach to AI Governance. Specifically, systems are grouped as low, medium, or high risk depending on potential harm. Additionally, an “unacceptable” category triggers an outright ban supported by the Prohibited Acts Decree. The National Assembly approved the statute with 429 votes for and five against, signalling rare consensus. Furthermore, officials framed the package as “management for development,” echoing the EU AI Act while retaining national priorities. These foundations set the stage for subsequent implementing instruments, including Decree 72 adjustments that integrate online service responsibilities. In summary, Vietnam chose a familiar template but customised penalties, incentives, and domestic content obligations. Such tailoring reflects both security concerns and industrial ambitions. Accordingly, observers should monitor emerging circulars that will clarify technical standards.

AI Risk Tiers Explained

High-risk systems include biometric identification, credit scoring, and critical infrastructure controls. Moreover, providers of such tools must conduct conformity assessments before market entry. Enforcement will rely on accredited auditors and surprise inspections by science ministry officials. Meanwhile, medium-risk applications face lighter reporting but still require clear documentation. Low-risk services remain mostly self-regulated, yet transparency provisions still apply when users interact with automated outputs. Importantly, the Prohibited Acts Decree empowers regulators to reclassify products rapidly through subordinate guidelines. Consequently, firms should build internal review boards to track shifting thresholds. Governance processes that embed Ethics principles will help demonstrate diligence during audits. These measures narrow compliance gaps while supporting user trust.

Prohibited Acts Decree Review

The decree lists activities considered “unacceptable” regardless of applied safeguards. For instance, non-consensual facial recognition in public places is barred. Additionally, malicious deepfakes meant to deceive voters or incite violence join the blacklist. In contrast, artistic deepfakes with clear disclosure may qualify for exemptions decided under Decree 72 amendments. Furthermore, any AI that manipulates behavior by exploiting psychological vulnerabilities is forbidden. The text also bans social scoring that causes unfair discrimination in employment, lending, or education. Enforcement fines reach two percent of Vietnam revenue or two billion VND, whichever is higher. Consequently, leadership teams must map functionality against the banned list before product launch. Notably, the Prohibited Acts Decree can expand through Prime Minister decisions, allowing rapid response to emerging threats. Therefore, staying engaged with policy announcements is critical.

Key Penalty Figures List

• Up to 2 % of prior-year Vietnam revenue for severe violations.
• Maximum 2 billion VND administrative fine for other organisational breaches.
• Individual cap at 1 billion VND for comparable offences.
• Criminal liability when harm meets penal code thresholds.

These figures demonstrate significant financial exposure. However, strong Governance processes can mitigate Enforcement risks.

The section reveals Vietnam’s zero-tolerance stance on harmful AI. Consequently, compliance professionals must prioritise banned-use audits before studying labeling duties.

Labeling And Compliance Duties

Transparency lies at the heart of user protection. Therefore, AI-generated or edited content that might mislead must carry visible labels. Moreover, users must know when they converse with a machine, not a person. Providers of high-risk systems must maintain technical logs, submit risk reports, and secure third-party certifications. Professionals can enhance their expertise with the AI Developer™ certification to navigate these procedural requirements. Additionally, foreign suppliers must appoint local contact points, echoing obligations in Decree 72 for social networks. Importantly, failure to display labels counts as a breach under the Prohibited Acts Decree, exposing firms to instant penalties. Compliance frameworks that integrate Ethics by design will streamline audits and preserve brand integrity. Subsequently, documented compliance efforts can reduce sanction severity where discretion exists.

Labeling obligations translate abstract principles into operational tasks. Nevertheless, thoughtful tooling and staff training can keep costs manageable. The next section assesses economic impact.

Industry Impact Outlook Ahead

Domestic champions such as Viettel, FPT, and VNPT anticipate preferential procurement once conformity certificates arrive. Moreover, sandboxes designed under the new decree will accelerate pilot deployments while ensuring state oversight. Startups, however, fear rising documentation expenses, especially around cross-border data flows. In contrast, multinational platforms weigh whether local revenue justifies new Enforcement exposure. Deloitte analysts predict Vietnamese AI spending could reach US$1.2 billion by 2027 if clarity persists. Regulatory visibility attracts capital, yet overly prescriptive checklists may slow iteration. Therefore, balanced guidance remains vital.

Compliance consultancies already market readiness packages. Furthermore, demand for accredited auditors and legal technologists is growing fast. Developers who pair technical skill with formal Ethics training will command salary premiums. Consequently, certification programs gain traction among young professionals.

Investors also evaluate the availability of local talent, cloud capacity, and patent growth rates. Meanwhile, universities are expanding machine-learning curricula to satisfy hiring demand. Government venture funds promise preferential lending to early-stage projects that address priority sectors such as smart agriculture and logistics. Consequently, incubation hubs across Ho Chi Minh City report rising occupancy and partnership inquiries from foreign accelerators. This momentum could offset transitional compliance costs. Nevertheless, policy predictability will remain the decisive variable for long-term capital commitments.

The market picture mixes opportunity with caution. Subsequently, rights implications deserve equal attention.

Rights And Ethics Debate

Civil society groups welcome fraud reduction goals but warn of speech suppression risks. Additionally, broad wording on “impersonation” could chill satire and political commentary. Asia Times commentators argue Enforcement discretion, inherited from Decree 72, lacks transparent appeal channels. Nevertheless, Deputy Minister Bùi Hoàng Phương insists users must retain agency through clear notices. Legal scholars highlight that embedding Ethics review panels into product design can balance innovation and dignity. Moreover, comparative studies find Vietnam’s Governance mirrors the EU AI Act yet grants agencies wider investigative authority. The Prohibited Acts Decree, critics say, might become an elastic tool if oversight remains opaque. Therefore, establishing multi-stakeholder monitoring boards would strengthen legitimacy.

This dialogue underscores the delicate line between safety and freedom. Consequently, observers now watch the implementation calendar.

Next Steps Timeline Ahead

The law becomes fully enforceable on 1 March 2026. Before that date, ministries will release classification lists, auditing standards, and fee schedules. Moreover, the Prime Minister may expand the banned catalogue through quick decisions under the AI ban. Companies should schedule gap assessments by Q3 2025, upgrade labeling interfaces, and register local representatives. Meanwhile, regulators plan capacity-building workshops and draft Decree 72 amendments for online platforms. Compliance pilots will likely begin within sandbox environments, offering early feedback. Consequently, agile compliance roadmaps can prevent costly retrofits.

Key milestones include high-risk system lists, first conformity bodies, and user-notice template releases. Furthermore, multinational statements on data localisation could sway investment sentiment. Compliance teams that track gazette updates will enjoy strategic advantage.

The countdown to March 2026 intensifies project timelines. Nevertheless, proactive planning ensures smoother certification waves and sustained market access.

Vietnam’s rapid regulatory shift positions the country as an Asian testbed for responsible AI. Moreover, the Prohibited Acts Decree provides clear guardrails against exploitative technologies while pairing strict Enforcement with innovation incentives. Governance structures, Ethics integration, and lessons from Decree 72 together define success or stagnation. Consequently, organisations must align architectures with risk tiers, label outputs, and secure third-party attestations. Professionals aiming to lead these efforts should consider the linked AI Developer™ credential for immediate skill validation. In contrast, delaying preparation invites fines and reputational damage. Therefore, adopt a compliance-first mindset now and turn Vietnam’s new framework into a competitive edge.