On 1 March 2026 Vietnam’s Law on Artificial Intelligence (No. 134/2025/QH15) took effect. The law replaces the AI provisions previously contained in the Law on the Digital Technology Industry and becomes Vietnam’s first dedicated AI statute — and one of the earlier dedicated AI laws in Southeast Asia.
The law’s basic orientation
Vietnam’s own framing is clear: the law opens the way for innovation while protecting people and the state, and it emphasises that “AI is only an assistive tool and does not replace the final decision-making role of humans”. This human-centred, human-in-the-loop orientation is close to the EU’s regulatory philosophy.
Methodologically, the law adopts a risk-tiered approach: duties are set at different levels according to risk, and a sandbox (pilot) mechanism is preserved for new technologies. AI activities serving national defence and security are outside its scope.
Implementing rules followed — the government issued a decree detailing measures for implementation, effective from 1 May 2026, refining matters including risk classification.
Why companies expanding into Southeast Asia should note it
First, Vietnam is a common landing point for manufacturing and internet businesses. Chinese AI companies’ Southeast Asian footprints often span Singapore, Indonesia and Vietnam at once. A dedicated law in Vietnam means the assumption that “Southeast Asia can be handled at a uniformly low bar” no longer holds.
Second, risk tiering feeds into product design. Once a function is classified at a higher risk level, assessment, documentation and human oversight duties follow — and these must be allowed for at the product-planning stage.
Third, the sandbox is both an opportunity and a constraint. A pilot mechanism allows new applications to be tested in a controlled setting, usually with filing and reporting requirements attached. Companies should weigh the benefit of participation against the disclosure cost.
Compliance steps for companies going global
First, build a regional rule map. The maturity of AI rules across Southeast Asia varies widely — Singapore has led with financial-sector guidance, Vietnam with a dedicated law — and they need to be handled separately. See our multi-jurisdiction service.
Second, treat cross-border data separately. Data transfer is the most easily overlooked risk in Southeast Asian operations — see our GDPR and cross-border data service.
Third, align definitions rather than redoing each country. Where a product serves both the EU and Southeast Asia, one baseline can cover the common requirements with country-specific increments. See our note on the EU AI Act transparency rules taking effect and our EU AI Act service.
The entry into force of Vietnam’s AI Law marks Southeast Asia’s AI regulation moving from “policy documents” to “statute”. For companies going global, that raises the compliance cost while providing clearer expectations — having a law to follow is better than having nothing to rely on.
This article is based on Vietnam’s Law on Artificial Intelligence (No. 134/2025/QH15) and public information from Vietnam’s Ministry of Science and Technology. It is for general reference only and does not constitute legal advice.