Vietnam's AI Law at 30 Days: What's Actually Changed for Tech Companies

Vietnam's AI Law at 30 Days: What's Actually Changed for Tech Companies

On 1 March 2026, Vietnam became Southeast Asia's first nation to enact a standalone artificial intelligence regulation. Today, 30 days into implementation, the law has created immediate compliance obligations for tech companies operating in the region, though the full enforcement landscape remains opaque.

Unlike the frequently cited beginner's explanations of what the law says, this analysis examines what has actually shifted in Vietnam's AI ecosystem^✦: which requirements activate immediately, which companies face enforcement pressure first, and where the gaps exist between regulatory intent and practical implementation.

The Immediate Compliance Landscape

Vietnam's AI Law applies to both domestic and foreign entities without exception. The first wave of obligations became effective on day one, creating mandatory data handling restrictions that apply now, not in 18 months.

Article 7.3 of the law imposes data collection constraints that fundamentally alter how AI training operates in Vietnam. Organisations can no longer collect, process, or use data to develop, train, test, or operate AI systems in violation of intellectual property laws. This provision has no grace period. A software company scraping Vietnamese websites for model training, a Chinese tech firm using Vietnamese user data for algorithm optimisation, or a Southeast Asian startup processing Vietnamese citizen information without explicit IP compliance all face immediate violations.

The requirement creates a compliance burden with no clear enforcement pathway. Vietnam's Ministry of Public Security has not published enforcement procedures, designated inspection units, or audit protocols as of mid-April 2026. Companies cannot determine whether their historical training datasets meet the standard, nor have they received explicit guidance on data provenance documentation.

Article 28 compounds this uncertainty: organisations must maintain technical documentation, audit logs, training data inventories, and other records to enable authorities to investigate potential violations. What constitutes adequate documentation remains undefined. Does this mean storing training data itself, or metadata about its sources. Can companies claim proprietary model protection when a government audit is requested. Vietnam's government has not issued implementing regulations that would clarify these questions.

This is the law's most immediate pain point. Compliance requires administrative overhead with no clear success criteria.

High-Risk Systems: The 18-Month Pause That Isn't

The law categorises AI systems by risk level: prohibited, high-risk, and general-purpose. High-risk systems must pass pre-market conformity assessments before deployment.

Finance, healthcare, and education sectors received an 18-month compliance window (until 1 September 2027). All other sectors have 12 months (until 1 March 2027). These timelines apply only to AI systems already deployed before 1 March 2026. Any new high-risk system deployed after that date must comply immediately.

In practice, this creates a bifurcated market. A bank operating credit-scoring algorithms deployed in February 2026 can continue operation until September 2027 without formal risk assessment. A lending startup launching a credit model in April 2026 must complete pre-market conformity assessment before activation. The law does not define conformity assessment procedures, recognised testing laboratories, or approval bodies.

This asymmetry incentivises rapid deployment before compliance deadlines, not careful AI governance^✦.

The Computer and Communications Industry Association urged Vietnam to extend timelines in February 2026, stating that the implementation pace left "limited time available for companies to assess requirements and implement necessary compliance measures." Vietnam's government declined to adjust the March 1 start date, signalling commitment to the timeline despite industry concerns.

Where Enforcement Pressure Will Arrive First

The first enforcement actions will almost certainly target data practices, not system governance. Vietnam's Ministry of Public Security has established cybersecurity inspection protocols over decades. The AI Law functions as an extension of existing data protection authority, not a new enforcement regime.

Three categories of companies face highest near-term risk:

1. Foreign AI Model Providers: Companies like OpenAI, Google, Anthropic, and others offering general-purpose AI systems are subject to the law if their systems operate in Vietnam. They must assess whether their training datasets violated Vietnamese IP law. For models trained on internet-scraped data, this assessment is practically impossible at scale^✦. The law creates liability without remediation pathways.

2. Vietnamese Data-Heavy Operators: Fintech companies, e-commerce platforms, and healthcare tech firms processing Vietnamese citizen data face dual compliance burdens. They must comply with the Personal Data Protection Decree (2023) and now the AI Law's data restrictions. Both regulations lack harmonised implementation guidance.

3. Foreign Tech Companies with Vietnamese Operations: Technology subsidiaries of multinational firms operating customer service AI, recommendation systems, or content moderation in Vietnam now require compliance documentation. Companies like Shopee, Grab, and Tiktok must audit their AI systems for IP law violations in training data sources.

Not a single enforcement action has been publicly documented in the first 30 days. This is not reassuring. It suggests that inspection protocols are still being established internally. When enforcement arrives, it will likely target high-profile foreign companies or domestically visible violations first.

The Enforcement Vacuum

Vietnam's government has not yet published implementing regulations for Articles 28 (inspection and audit), 29 (administrative penalties), or 30 (sanctions). These articles define enforcement mechanisms. Their absence creates regulatory arbitrage.

Companies cannot calculate the cost of non-compliance. Penalties range from VND 10 million to VND 500 million (approximately USD 390 to USD 19,500) for organisations, plus potential data processing bans and system suspension orders. The penalty escalation logic is unclear. Is a minor data documentation gap equivalent to deliberate IP law violations in training.

Notably, Vietnam's draft regulations have not been released for public comment. This differs markedly from EU AI Act implementation, where member states conducted extensive stakeholder consultation. The lack of transparency raises questions about whether Vietnamese regulators understand the practical compliance burden they have created.

The Computer Communications Industry Association, representing major US tech companies, explicitly warned Vietnam that "unfinished implementing regulations" posed significant challenges for compliance. No public response from Vietnam's government has been documented.

What Companies Are Actually Doing

Based on available evidence from legal consultancies and industry analysis:

• Documentation audits: Companies are reviewing training data sources to identify potential IP law violations. This process typically requires external data forensics expertise, costing USD 50,000-300,000 per system.
• Governance setup: Compliance teams are establishing AI risk assessment templates aligned with the law's risk categorisation. Many are adopting EU AI Act templates as proxies, since Vietnamese guidance does not exist.
• Market strategy recalibration: Companies are deferring high-risk system launches until implementing regulations clarify approval pathways. This is creating a compliance-driven pause in AI product development in Vietnam.
• Data sourcing changes: AI companies are negotiating IP compliance representations with data providers. This is increasing data acquisition costs across Southeast Asia.

None of these responses have been formally announced. They are occurring through quiet compliance activity, which suggests companies are treating the law as real and imminent, even if enforcement details remain undefined.

The Alignment With China and EU Strategy

Vietnam's law mirrors the risk-based framework established by the EU AI Act, but with added emphasis on data sovereignty^✦ and government oversight. Article 7's IP protection requirements align with China's recent AI governance priorities, which have emphasised state control over training data sources.

This positioning creates geopolitical leverage^✦. Vietnam can argue to Western tech companies that it follows EU-style regulation (legitimising the framework internationally) whilst maintaining the state control mechanisms favoured by China (addressing Beijing's concerns about foreign AI dominance).

For companies, this means the law is unlikely to be softened through lobbying. It represents deliberate policy, not regulatory overreach that will be corrected. The extended compliance timelines appear designed to manage implementation pressure whilst maintaining regulatory credibility.

The Regional Precedent Problem

Southeast Asian regulators are watching Vietnam's implementation closely. If Vietnam's enforcement becomes aggressive and companies perceive the compliance burden as unreasonable, regional adoption of similar models will slow. If enforcement is light and companies navigate the requirements successfully, neighbouring nations will likely adopt comparable frameworks.

This means Vietnam's next 6 months will set the tone for AI regulation across ASEAN. Early enforcement actions, or conversely, early deference to industry concerns, will reverberate through the region's AI policy landscape.

The China vertical AI strategy demonstrates how state control over AI development can serve geopolitical objectives. Vietnam's law borrows this playbook: data sovereignty, government oversight, and IP protection all serve domestic policy goals whilst creating friction for foreign competitors. This is deliberate, and it is working as intended.

Specific Gaps in the Implementation

1. Defining "AI System"

The law does not define the threshold at which software becomes an "AI system." Is a recommendation algorithm an AI system. What about automated email filtering. The lack of clarity creates compliance uncertainty. Companies deploying borderline AI systems cannot determine whether they are subject to the law.

2. Training Data Assessment

The law prohibits training on data that violates IP rights. Companies cannot audit all data sources retrospectively. Realistically, they must accept some residual compliance risk. The law does not provide safe harbours for good-faith compliance efforts. A company that documents its data sourcing practices diligently still faces liability if an outlier violation is discovered.

3. Government Data Sharing

Article 12 permits government agencies to share data with AI companies for model training in the public interest. No criteria define "public interest." This creates potential for selective data access that advantages government-preferred companies. Private companies cannot compete on equal footing.

4. Conformity Assessment Procedures

The law mandates pre-market assessments for high-risk systems. It does not specify who conducts assessments, what standards are applied, or how long approval takes. Companies cannot plan product timelines. This is a hidden cost of the regulation.