Law 134/2025/QH15
The law is in effect. Compliance deadlines begin March 2027. Most organisations are already in scope and do not know it.
On 10 December 2025, the National Assembly passed Vietnam's first standalone AI Law. It took effect on 1 March 2026, making Vietnam the first country in Southeast Asia to establish a comprehensive, risk-based AI regulatory framework.
Key facts
Timeline
The law introduces obligations in phases. The compliance clock is running — and most organisations have not yet conducted an AI inventory.
10 Dec 2025
Law passed — National Assembly passes Law 134/2025/QH15 with 90.7% approval.
1 Mar 2026
Law takes effect — All organisations must begin risk classification of AI systems. Human-centric principle and prohibited practices enforceable.
1 May 2026
Implementing decree — Decree 142/2026/NĐ-CP provides implementation guidance for providers, developers, deployers, and users.
1 Mar 2027
Compliance deadline — All AI systems must comply. High-risk systems require registration, documentation, human oversight, and conformity assessment.
1 Sep 2027
Extended deadline — Health, education, and financial sector AI systems have an additional 6 months to comply.
Risk classification
Mirroring global regulatory trends, the AI Law categorises systems by their potential impact on human rights, safety, security, and public interests.
Systems that pose significant potential harm to life, health, national security, or lawful rights.
Systems carrying risks such as user confusion or minor market disruptions.
Systems with minimal impact on rights, safety, or public interests.
Exposure
The law applies to five distinct roles in the AI value chain. Most organisations occupy at least one — often more than one — without having formally identified their position. Shadow AI adoption across departments means exposure is frequently wider than leadership believes. If your organisation uses a third-party AI tool in a high-risk context, the deployer obligations sit with you. The vendor relationship does not transfer liability.
Designs, builds, trains, or refines AI models with control over technical methods and training data.
Markets AI systems under their own name, brand, or trademark — regardless of who built it.
Integrates or uses AI systems as part of their service offerings or internal operations.
Directly interacts with AI systems or relies on their outputs in decision-making.
Entities whose lawful rights, life, health, property, reputation, or access to services are impacted by AI deployment or outputs.
Our services
We help organisations understand their obligations under the VN AI Law and build practical compliance programs that fit real operations.
Audit all AI systems in use across the organisation — including shadow AI.
Classify each system under the law's three-tier framework.
Identify where your current practices fall short of obligations.
Prioritised plan to close gaps before the March 2027 deadline.
Obligations
AI inventory
Identify and document every AI system in use across the organisation — including shadow AI adopted without IT knowledge.
Risk classification
Classify each system as high, medium, or low risk under the law's criteria. Document the rationale for each classification.
Human oversight
Design and implement mechanisms that keep humans in the loop for all high-risk AI decisions. The law requires humans to remain the final arbiter.
Technical documentation
Maintain comprehensive records: system purpose, training data, performance metrics, risk assessment, and operational logs.
Registration
High-risk systems must be registered on the national AI portal before the compliance deadline. Foreign providers: local presence or authorised rep required.
AI literacy
Ensure staff who develop, deploy, or use AI systems have appropriate AI literacy — understanding capabilities, limitations, risks, and governance obligations.
Highest obligation
The law applies broadly across the economy, but certain sectors carry substantially higher compliance obligations due to the nature of their AI use cases.
Different sectors face different compliance deadlines. All non-extended sectors must comply by 1 March 2027.
FAQ
VN AI Law compliance review
Fixed-fee, four-week engagement. We audit your AI systems, classify them under the law's risk framework, identify gaps, and deliver a prioritised remediation roadmap.