Vietnam Fires the Starting Gun on Southeast Asia's First AI Law
On 1 March 2026, Vietnam became the first Southeast Asian nation to enact binding AI legislation. Law No. 134/2025/QH15 moved from the policy discussion rooms straight into enforceable regulation, establishing a comprehensive framework that now governs how AI systems are developed, deployed, and used across the region's most populous nation.
The law arrived at a moment when Southeast Asia's approach to artificial intelligence regulation was fragmenting. Whilst Singapore maintained voluntary frameworks, Malaysia drafted legislation, and Indonesia pursued principles-based guidance, Vietnam leapfrogged the region with a risk-based legal structure that mirrors the European Union's approach. The shift signals something significant: binding rules, not soft guidelines, are becoming the regulatory norm.
How Vietnam's AI Law Works
Rajah & Tann Asia noted: "The Law on AI marks Vietnam's first comprehensive, standalone law governing AI. It draws considerable influence from the European Union's Artificial Intelligence Act." This structural alignment was deliberate. Vietnam's framework divides AI systems into three risk categories: high-risk, medium-risk, and low-risk.
High-risk AI systems, such as those used in healthcare, criminal justice, and financial services, face the strictest requirements. Developers must conduct pre-market conformity assessments, implement ongoing risk management, maintain human oversight mechanisms, and submit to periodic audits. The Ministry of Science and Technology (MOST) leads enforcement, with supporting roles for sectoral regulators.
Duane Morris stated: "Mirroring global regulatory trends such as the EU AI Act, the AI Law categorizes AI systems into three risk tiers." Medium-risk systems require transparency documentation and governance measures. Low-risk systems face minimal restrictions, reflecting the law's pragmatic approach to lighter-touch regulation where the harms are limited.
According to VILAF's analysis by Vaibhav Saxena: "The AI Law establishes a unified legal framework regulating the development, supply, deployment, and use of AI systems in Vietnam." This scope applies to both domestic and foreign entities, meaning multinational technology companies must comply whether they build AI in Hanoi, Ho Chi Minh City, or ship it into the country.
The Prohibited Acts and Transition Timeline
Vietnam's law explicitly bans certain AI applications. Prohibited acts include using AI systems for illegal purposes, creating deepfakes that simulate real persons without consent, and deploying AI in ways that exploit vulnerable populations. These restrictions carry enforcement teeth, not merely advisory language.
Recognising that immediate compliance could create operational chaos, the law includes grace periods. Healthcare, education, and financial services AI systems have 18 months to comply. All other systems have 12 months. The Ministry of Science and Technology is drafting implementing decrees that will provide technical guidance and clarification on risk classification, assessment procedures, and documentation standards.
| Country/Region | Regulatory Approach | Status |
|---|---|---|
| Vietnam | Comprehensive, risk-based binding law | In force (1 March 2026) |
| Singapore | Voluntary framework | No binding legislation |
| Malaysia | Draft AI bill | In development |
| Indonesia | Principles-based guidance | No formal legislation |
| Thailand | Draft bill | Pending approval |
| Philippines | Roadmap only | Early stage |
By The Numbers
- 18 months: transition period for healthcare, education, and finance AI systems
- 12 months: transition period for all other AI applications
- Three: risk-based categories (high, medium, low)
- 1 March 2026: official enforcement date
- 6 Southeast Asian nations: still without binding AI laws
What Businesses Must Do Now
For companies operating in Vietnam, the practical implications are immediate. Any organisation developing, supplying, or deploying AI must classify its systems according to the risk framework. High-risk systems need conformity assessments before market launch. Medium-risk systems require transparency documentation. All systems need governance structures to ensure responsible use.
The grace periods matter, but they are not indefinite. Organisations with 18-month transitions should treat those deadlines as hard dates, not provisional endpoints. MOST will enforce through inspections, audits, and administrative penalties for non-compliance.
"The AI Law establishes a unified legal framework regulating the development, supply, deployment, and use of AI systems in Vietnam."
— VILAF, via Vaibhav Saxena
What This Means for Southeast Asia
Vietnam's law creates a regulatory anchor in a region that had drifted towards ad hoc, voluntary, or principles-based approaches. The move from guidelines to binding rules signals that Southeast Asia is moving past the era of self-regulation. Other nations will feel pressure to harmonise or clarify their own frameworks.
ASEAN shifts from AI guidelines to binding rules, a trend now accelerated by Vietnam's concrete legislation. The question for other nations is no longer whether to regulate AI, but how to do it in ways that attract investment whilst protecting citizens and businesses.
Companies already operating in Vietnam or planning expansion into the market should audit their AI systems immediately. Those with high-risk applications in healthcare, education, or finance must prioritise conformity assessments within the first months of operation. Those with medium or low-risk systems have slightly more breathing room, but compliance planning should start now.
"The Law on AI marks Vietnam's first comprehensive, standalone law governing AI. It draws considerable influence from the European Union's Artificial Intelligence Act."
— Rajah & Tann Asia
Frequently Asked Questions
Does Vietnam's AI Law apply to foreign companies?
Yes. The law applies to any entity developing, supplying, deploying, or using AI systems in Vietnam, regardless of where the company is registered. Multinational technology companies must comply with Vietnam's requirements or face administrative penalties and market restrictions.
What happens if a company misses the transition deadline?
Non-compliance triggers administrative enforcement actions from MOST and sectoral regulators. These can include inspections, corrective orders, penalties, and in severe cases, suspension of operations. The Ministry expects implementing decrees to clarify enforcement procedures and penalty levels.
How does Vietnam's law compare to the EU AI Act?
Vietnam's framework mirrors the EU's risk-based approach, with high-risk, medium-risk, and low-risk categories. The key difference is that Vietnam's law explicitly applies to foreign entities operating in the country, whereas the EU's scope focuses on the internal market and extraterritorial reach. Vietnam also includes specific prohibitions on deepfakes and exploitation of vulnerable groups.
Are there sector-specific exemptions or special rules?
The law includes longer transition periods for healthcare, education, and finance (18 months) versus other sectors (12 months). Implementing decrees will likely include sector-specific guidance for critical areas like criminal justice, employment, and consumer protection, but no full exemptions are currently envisaged.
What should a company do if its AI system spans multiple risk categories?
Classify according to the highest risk application. If an AI system has both low-risk and high-risk uses, apply high-risk requirements across the entire system. Implementing decrees will provide clearer guidance on mixed-risk scenarios, but erring towards higher oversight is the prudent approach during the transition period.
What You Should Do Now
Vietnam's AI Law has moved from discussion to enforcement. If you operate AI systems in Vietnam, conduct a risk assessment now. Classify each system, identify compliance gaps, and prioritise high-risk applications. For those with 18-month transitions, begin conformity assessments immediately. For others, use the 12-month window to build governance structures and audit processes.
Organisations without AI systems yet, but planning to develop or deploy them in Vietnam, should build compliance requirements into their development roadmaps. Waiting for implementing decrees is risky; building compliance in from the start is smarter.
Stay informed as implementing decrees are released and early enforcement actions emerge. Related reading on regional AI trends includes South Korea's AI commercialisation push, Asia's AI talent shortage, and Alibaba hikes AI chip prices as Asia demand surges. What's your read on Vietnam's move? Will other Southeast Asian nations follow? Drop your take in the comments below.