Vietnam's AI Law Goes Live: The First ASEAN Framework With Real Teeth

Vietnam's AI Law Goes Live: The First ASEAN Framework With Real Teeth

Vietnam has just done something no other ASEAN country has, and the rest of Southeast Asia is paying attention. On 1 March 2026, Vietnam's new AI Law entered its first phase, making Vietnam the first ASEAN member state to enshrine artificial intelligence governance in binding primary legislation rather than guidelines, codes of conduct, or sandbox^✦ regulations. The framework will roll out over four years, with each phase tightening obligations for AI developers, deployers, and importers operating inside Vietnam.

For a region that has mostly preferred soft-law, Vietnam's move reframes the conversation. Jakarta, Kuala Lumpur, Manila, and Bangkok now have a concrete legal model on their doorstep, and the early reactions from regional general counsels suggest most of ASEAN will converge toward something similar, whether they admit it publicly yet or not.

What The Law Actually Requires

Phase one establishes the baseline. Any organisation developing or deploying AI systems inside Vietnam must register high-risk use cases, maintain documented technical and governance records, and designate a named local accountable officer. The Ministry of Science and Technology has published a tiered classification that tracks risk by use case, not by model architecture, which aligns Vietnam directionally with the EU AI Act rather than the lighter-touch approaches in Singapore or Japan. Context for how regional regulators are thinking sits in our earlier coverage of China's mandatory AI agent rules.

Phase two, scheduled for 2027, extends conformity assessments to providers of general-purpose AI models and introduces mandatory transparency markers for synthetic media. Phase three in 2028 adds third-party audit requirements. Phase four in early 2030 activates the full penalties regime, with fines of up to VND 500 million for serious non-compliance and the possibility of revoked operating licences for repeat breaches.

Why Vietnam, Why Now

Hanoi has been blunt about the strategy. Vietnam wants to attract AI capital, data centre investment, and sovereign model partnerships, and sees early legal clarity as a competitive advantage rather than a barrier. The calculation is that multinational AI investors prefer a jurisdiction with clear rules, even strict ones, over an unregulated market where policy risk is opaque. The Vingroup-backed VinAI ecosystem^✦, the foreign chipmakers building fabs in Vietnam's north, and the rising tide of Korean and Japanese AI vendors looking for an ASEAN beachhead all benefit from a written rulebook.

There is also a domestic political logic. Vietnam has watched China's regulatory trajectory closely and has drawn lessons from both what to replicate and what to avoid. The resulting framework is risk-based and ministry-led, not platform-led, and it explicitly treats generative AI^✦, agentic^✦ systems, and synthetic media as distinct regulatory categories.

How It Compares Across ASEAN

| Country | Approach | Status | Key Feature | |---|---|---|---| | Vietnam | Primary legislation | Phase 1 live March 2026 | Four-year phased obligations | | Singapore | Guidelines + Model AI Framework | Live | Sectoral codes, sandbox, MAS FEAT | | Indonesia | Presidential regulation | Expected early 2026 | Ethics-based, ministerial enforcement | | Malaysia | National AI Roadmap | In development | Sectoral guidelines, ILMU-linked | | Thailand | Draft AI Act | Consultation | Risk-based, closer to EU model | | Philippines | AI Use Case Guidelines | Live | Sectoral advisories, DICT-led |

Regional counsel are already drafting alignment^✦ strategies. See also our piece on Malaysia moving from guidelines to legislation for a neighbouring data point. A Vietnamese compliance baseline can be re-used for likely future Indonesian, Thai, and Philippine rules, because each is converging on similar risk categories even if the legal instruments differ.

Vietnam's law is the first ASEAN text that would actually hold up against enforcement in a regulated sector. Everyone else is still optional.

We are rewriting our regional playbook on the basis that Vietnam is now the floor. ASEAN AI compliance means Vietnam-first design.

What Investors and Developers Should Do Now

The practical checklist is straightforward, and every AI team touching Vietnam should have it in motion:

• Map AI use cases against the Vietnamese risk classification and identify which qualify as high-risk under Phase 1.
• Appoint a named accountable officer with authority to respond to regulator queries, and register them with MOST.
• Stand up a documentation pipeline for model cards, data lineage, and post-deployment monitoring, built to survive audit.
• Prepare synthetic media transparency tooling now, even though Phase 2 obligations are a year out.
• Align board reporting so material AI risks feed into enterprise risk committees, not only technology committees.

Frequently Asked Questions

When does Vietnam's AI Law take effect?

Phase one of Vietnam's AI Law entered force on 1 March 2026, with subsequent phases scheduled through to 2030. The rollout is deliberately phased so that regulators, industry, and foreign investors can build compliance capacity before full obligations and penalties activate.

What is regulated under the law?

The law classifies AI systems by use case rather than architecture. It covers development, deployment, and import of high-risk systems, with specific attention to generative AI, agentic systems, synthetic media, and use in sensitive sectors such as healthcare, finance, education, and public administration.

How does Vietnam's approach compare to Singapore?

Singapore uses guidelines, model frameworks, and sectoral sandboxes rather than primary legislation. Vietnam's approach is binding, tiered, and enforced by multiple ministries with financial penalties, which places it closer to the EU AI Act in legal style, though narrower in scope.

What should foreign AI companies do?

Map use cases to Vietnam's risk tiers, appoint a local accountable officer, stand up documentation and audit-ready records, and align product roadmaps so that by 2028 conformity assessment obligations do not become a blocker. Starting preparation now is materially cheaper than racing in Phase 2.

Will other ASEAN countries follow Vietnam's lead?

In substance, almost certainly. Indonesia, Thailand, and the Philippines are all moving toward risk-based frameworks with similar categories. The legal form will vary, but the compliance expectations will converge, which is why Vietnam-first design is becoming the regional default.

Is Vietnam's AI Law a genuine turning point for ASEAN governance, or will enforcement prove uneven once Phase 2 arrives? Drop your take in the comments below.