Vietnam Enforces Southeast Asia's First AI Law

A Risk-Based Framework With Real Teeth

On 1 March 2026, Vietnam quietly made history. Its Law on Artificial Intelligence came into force, making the country the first in Southeast Asia to enforce a comprehensive, risk-based regulatory framework for AI. The law covers domestic and foreign operators alike, classifying AI systems into three tiers: high-risk, medium-risk, and low-risk.

High-risk systems, including those used in healthcare, finance, and education, face the strictest controls. Real-time biometric surveillance is banned without explicit government approval. Foreign AI providers must appoint a local legal representative. And a new National AI Database will require registration of all high-risk systems operating in the country.

The law was passed by Vietnam's National Assembly on 10 December 2025 and drew heavily from the European Union's AI Act, but adapted for a developing economy with different priorities.

What the Law Actually Requires

Businesses already running AI systems get a 12-month grace period, with full compliance required by 1 March 2027. For sectors deemed especially sensitive, including finance, healthcare, and education, the deadline extends to 18 months, or 1 September 2027.

A National AI Commission is set to be established by 1 July 2026 to oversee enforcement. The Ministry of Science and Technology will lead centralised governance, and a national AI computing centre is planned to support Vietnamese-language large language models and public data resources.

"The law represents a significant shift in how Vietnam approaches technology governance, moving from reactive oversight to proactive, risk-based regulation that mirrors international best practice." - Tran Thi Thu Hang, Senior Associate, Baker McKenzie Vietnam

Sandbox mechanisms are also built in. Vietnam wants to attract investment, not just regulate it. The law includes tax incentives for AI research, support for startups, and a national AI development fund to channel public and private capital into data centres and computing infrastructure.

Why Vietnam Moved First

Vietnam's decision to regulate before its wealthier neighbours is not accidental. The country has positioned itself as a technology manufacturing hub for years. Samsung, Intel, and dozens of smaller firms operate major facilities there. AI regulation is part of a broader strategy to climb the value chain from assembly to innovation.

The timing also matters regionally. Singapore has voluntary AI governance frameworks but no binding law. Thailand is drafting AI legislation. Indonesia finalised its AI roadmap in 2025 but has not passed enforceable rules. South Korea enacted its AI Basic Act in 2024, making it the closest regional comparison, but Vietnam's law goes further in several areas, particularly on biometric surveillance and mandatory risk classification.

"Vietnam has been fast out of the box. By moving early, the country is positioning itself not just as a compliant market but as a credible destination for responsible AI investment." - David Brown, Managing Partner, Duane Morris Vietnam

The EU Comparison and Where It Diverges

The parallels with the EU AI Act are obvious. Both use risk-based classification. Both ban certain AI practices outright. Both require transparency in high-risk deployments. But Vietnam's version has important differences.

First, the law explicitly promotes national AI sovereignty. The government plans to develop Vietnamese-language LLMs and build public computing infrastructure, a priority that reflects both practical needs and strategic ambition. Second, the compliance timelines are tighter than the EU's phased approach, which stretches to 2027 for most provisions.

Feature	Vietnam AI Law	EU AI Act	South Korea AI Basic Act
Effective date	1 March 2026	Phased, 2024-2027	January 2025
Risk classification	3 tiers	4 tiers	High-risk focus
Biometric surveillance ban	Yes, without approval	Yes, with exceptions	Limited
Foreign provider obligations	Local representative required	EU-based representative	Voluntary compliance
National AI fund	Yes	No (member state level)	Yes
Sandbox provisions	Yes	Yes	Yes

What This Means for Businesses

For companies operating AI in Vietnam, the compliance clock is ticking. The 12-month grace period sounds generous, but the requirements are substantial. Businesses must conduct risk assessments, register high-risk systems, appoint compliance officers, and document their AI decision-making processes.

Foreign AI providers face an additional layer: the mandatory local representative requirement. This is a clear signal that Vietnam intends to enforce the law against overseas operators, not just domestic ones. Companies like Google, Microsoft, and ByteDance, all of which have growing AI footprints in Vietnam, will need to ensure their systems comply.

• All high-risk AI systems must be registered in the National AI Database before deployment
• Transparency requirements mandate that users are told when they are interacting with an AI system
• AI-generated content in media and communications must be clearly labelled
• Companies must conduct and document regular impact assessments for high-risk deployments
• Violations can result in fines, suspension of AI operations, or revocation of operating licences

Regional Ripple Effects

Vietnam's move will put pressure on its neighbours. ASEAN has been discussing AI governance frameworks for years, but progress has been slow and largely voluntary. A binding national law from one of the bloc's fastest-growing economies changes the dynamics.

Thailand's draft AI legislation, expected later in 2026, will likely reference Vietnam's framework. The Philippines and Malaysia are also watching closely. For multinational companies operating across the region, the patchwork of different national approaches is becoming the core compliance challenge.

The AIinASIA View: Vietnam's AI law is the most consequential piece of technology regulation to come out of Southeast Asia in years. Not because it is perfect, but because it exists. The region has spent too long relying on voluntary frameworks and aspirational guidelines while AI deployment accelerated. Vietnam has drawn a line. The law is clearly modelled on the EU approach, but adapted with a developing-economy pragmatism that includes sandbox provisions, startup incentives, and a national computing centre. The real test will be enforcement. If Vietnam can demonstrate that regulation and innovation coexist, it will set the template for the rest of ASEAN. If enforcement stalls, the law becomes another paper exercise. The next 18 months will tell us which.

Does Vietnam's AI law apply to foreign companies?

Yes. The law applies to both domestic and foreign entities operating AI systems in Vietnam. Foreign AI providers must appoint a local legal representative and comply with the same risk classification and registration requirements as Vietnamese companies.

How does Vietnam's AI law compare to the EU AI Act?

Both use risk-based classification and ban certain AI practices. However, Vietnam's law has tighter compliance timelines, includes a national AI development fund, and places stronger emphasis on national AI sovereignty, including plans for Vietnamese-language large language models.

What happens if a company does not comply?

Companies that fail to comply face penalties including fines, suspension of AI operations, and potential revocation of operating licences. The National AI Commission, to be established by July 2026, will oversee enforcement.

Which AI systems are classified as high-risk?

High-risk classifications cover AI used in healthcare, finance, education, law enforcement, and critical infrastructure. These systems face the strictest requirements, including mandatory registration, regular impact assessments, and enhanced transparency obligations.

Vietnam just set the regulatory pace for an entire region. Will its neighbours follow the same playbook, or chart their own course? Drop your take in the comments below.