VinRobotics’ humanoid robot at Artificial Intelligence Day 2025 (AI4VN 2025). — Photo vnexpress.vn

LAW No. 134/2025/QH15

On Artificial Intelligence

Pursuant to the Constitution of the Socialist Republic of Vietnam, which has a number of articles amended and supplemented under Resolution No. 203/2025/QH15;

The National Assembly promulgates the Law on Artificial Intelligence.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

1. This Law provides the research, development, provision, deployment and use of artificial intelligence systems (below referred to as artificial intelligence activities); rights and obligations of related organisations and individuals, and the state management of artificial intelligence activities in Vietnam.

2. Artificial intelligence activities that exclusively serve the purposes of national defence, security and cipher are not governed by this Law.

Article 2. Subjects of application

This Law applies to Vietnamese agencies, organisations and individuals, and foreign organisations and individuals involved in artificial intelligence activities in Vietnam.

Article 3. Interpretation of terms

In this Law, the terms below are construed as follows:

1. Artificial intelligence means the electronic execution of human intellectual capabilities, including learning, reasoning, perception, judgement, and natural language understanding.

2. Artificial intelligence system means a machine-based system which is designed to perform artificial intelligence capabilities with different levels of autonomy, capable of self-adaptation after deployment; based on explicitly or implicitly set objectives, the system infers from input data to generate outputs such as predictions, content, recommendations or decisions that may influence physical or digital environments.

3. Developer means an organisation or individual that performs the design, construction, training, testing or fine-tuning of the whole or part of an artificial intelligence model, algorithm or system, and has direct control over technical methods, training data or model parameters.

4. Provider means an organisation or individual that puts an artificial intelligence system on the market or into use under its/his/her own name, brand, or trademark, regardless of whether the system is developed by itself/himself/herself or by a third party.

5. Deployer means an organisation or individual that uses an artificial intelligence system under its/his/her control in professional, commercial or service provision activities. This excludes cases of use for personal and non-commercial purposes.

6. User means an organisation or individual that directly interacts with an artificial intelligence system or uses outputs of such system.

7. Affected person means an organisation or individual whole lawful rights and interests, life, health, property, reputation or access to services is/are directly or indirectly affected due to the deployment or outputs of an artificial intelligence system.

8. Serious incident means an event occurring during the operation of an artificial intelligence system that causes or is likely to cause significant damage to life, health, human rights, property, cybersecurity, public order or the environment, or disrupts the operation of information systems critical to national security.

Article 4. Fundamental principles in artificial intelligence activities

1. Artificial intelligence activities are human-centric; guarantee human rights, privacy, national interests, public interests and national security; and comply with the Constitution and laws.

2. Artificial intelligence activities serve humans and do not replace human authority and responsibility; ensure the maintenance of human control and intervention over all decisions and actions of artificial intelligence systems; ensure system safety, data security and information confidentiality; and ensure the ability to inspect and supervise the development and operation of artificial intelligence systems.

3. Artificial intelligence activities ensure fairness, transparency, impartiality, non-discrimination, and no harm to humans or society; ensure compliance with Vietnamese ethical standards and cultural values; and perform accountability for decisions and consequences of artificial intelligence systems.

4. Artificial intelligence activities promote the development of green, inclusive, and sustainable artificial intelligence; promote the development and application of artificial intelligence technologies towards energy efficiency, resource conservation, and mitigation of negative environmental impacts.

Article 5. The State’s policies on artificial intelligence activities

1. To adopt policies to develop artificial intelligence into an important driving force for the country’s growth, innovation and sustainable development.

2. To promote regulatory sandboxes for technologies; to apply management measures proportionate to risk levels and promote the application of voluntary compliance mechanisms.

3. To adopt policies to guarantee rights and create conditions for organisations and individuals to access, learn, and benefit from artificial intelligence; to promote the development and application of artificial intelligence for social welfare, supporting persons with disabilities, the poor and ethnic minority people to bridge the digital divide; and to preserve and promote the national cultural identity.

4. To prioritise investment in, and mobilise social resources for development of, data infrastructure, computing infrastructure, safe artificial intelligence, high-quality human resources, and shared artificial intelligence platforms of national strategic importance.

5. To prioritise the application of artificial intelligence in the management, administration, public service provision, and support for decision making by state agencies in order to improve efficiency, transparency and the quality of services for citizens and enterprises; to promote the widespread application of artificial intelligence in socio-economic sectors and fields in order to improve productivity, service quality and management efficiency.

6. To encourage organisations, networks and social initiatives to promote safety, ethics and reliability of artificial intelligence activities, and build social trust in artificial intelligence development.

7. To promote the application of artificial intelligence in business operations and key socio-economic sectors; to develop the startup and innovation ecosystem; and to promote public-private partnerships.

8. To proactively carry out international integration and cooperation; to participate in building and shaping global governance standards and frameworks; to ensure national interests and sovereignty in artificial intelligence.

Article 6. Application of artificial intelligence in sectors and fields

1. The application of artificial intelligence in sectors and fields must adhere to the risk management principles specified in this Law and comply with relevant laws.

2. For essential sectors that have direct impacts on human life, health, lawful rights and interests, or social order and safety, the application of artificial intelligence shall be subject to stricter risk management as suited to the special characteristics of each of those sectors:

a/ Healthcare: ensuring safety of patients; reliability under practical use conditions; protection of health data in accordance with the law;

b/ Education: ensuring suitability for age characteristics and development of learners; preventing risks in the assessment, classification and exertion of adverse impacts on learners; ensuring data security and privacy.

3. The application of artificial intelligence in scientific research activities must comply with research ethics and scientific integrity, and help prevent fraud and plagiarism during the research and publication process.

4. The Government, ministries and ministerial-level agencies shall, within the ambit of their functions, tasks and powers, specify safety requirements, risk management and deployment conditions for the application of artificial intelligence in the sectors and fields under their management, ensuring compliance with the provisions of this Law.

Article 7. Prohibited acts

1. Taking advantage of or misappropriating artificial intelligence systems to commit illegal acts or infringe upon lawful rights and interests of organisations and individuals.

2. Developing, providing, deploying or using artificial intelligence systems for the following purposes:

a/ To commit acts prohibited by law;

b/ To use forged elements or simulations of real people or real events to intentionally and systematically deceive or manipulate human perceptions and behaviours, causing serious harm to lawful rights and interests of humans;

c/ To exploit weaknesses of vulnerable groups, including children, the elderly, persons with disabilities, ethnic minority people, persons who have lost their civil act capacity or have limited civil act capacity, or persons with cognitive difficulties, to cause harm to themselves or others;

d/ To create or disseminate fake content capable of posing a serious danger to national security, public order and social safety.

3. Collecting, processing or using data to develop, train, test or operate artificial intelligence systems in contravention of the regulations on data, personal data protection, intellectual property and cybersecurity.

4. Obstructing, disabling or distorting mechanisms for human supervision, intervention and control over artificial intelligence systems as specified in this Law.

5. Concealing information required to be made public, transparent or accountable; erasing or falsifying mandatory information, labels or warnings in artificial intelligence activities.

6. Taking advantage of artificial intelligence system research, testing, assessment or verification activities to commit illegal acts.

Article 8. One-stop artificial intelligence portal and national database on artificial intelligence systems

1. The one-stop artificial intelligence portal is a digital platform established to support the receipt and registration of participation in sandboxes; receive notifications regarding classification results for artificial intelligence systems, reports on serious incidents, and periodic reports; publicise information on artificial intelligence systems, conformity assessment results, and violation handling results as specified by law; and connect support programmes, funds, infrastructure and shared data.

2. The national database on artificial intelligence systems shall be built and managed uniformly to serve the management, supervision, and publication of information on artificial intelligence systems in accordance with law.

3. The publicisation, connection and sharing of data on the one-stop artificial intelligence portal and the national database on artificial intelligence systems must ensure information safety and security; serve to protect state secrets, business secrets and personal data.

4. The Government shall provide in detail the mechanism for operation, management and use of the one-stop artificial intelligence portal and the national database on artificial intelligence systems.

Chapter II

RISK-BASED CLASSIFICATION AND MANAGEMENT OF ARTIFICIAL INTELLIGENCE SYSTEMS

Article 9. Classification of risk levels of artificial intelligence systems

1. Artificial intelligence systems are classified according to the following risk levels:

a/ High-risk artificial intelligence systems are those that can cause significant damage to the life, health, lawful rights and interests of organisations and individuals, national interests, public interests and national security;

b/ Medium-risk artificial intelligence systems are those capable of confusing, impacting or manipulating users that are unable to recognise that the interacting entity is an artificial intelligence system or that the content is generated by the system;

c/ Low-risk artificial intelligence systems are those not specified in Points a and b of this Clause.

2. The classification of risks for artificial intelligence systems is determined on the basis of criteria regarding the level of impacts on human rights, safety and security; the fields in which the systems are used, particularly essential fields or those directly related to public interests; the range of users and the magnitude of impacts of these systems.

3. The Government shall detail this Article.

Article 10. Classification and notification of artificial intelligence systems

1. Providers shall classify artificial intelligence systems themselves before putting them into service. Systems classified as medium-risk or high-risk must be accompanied by classification dossiers.

2. Deployers may inherit classification results of providers and shall ensure the safety and integrity of systems during use; in cases of modification, integration or functional changes that give rise to new or higher risks, they shall coordinate with providers in carrying out re-classification.

3. For systems classified as medium-risk or high-risk, providers shall notify classification results to the Ministry of Science and Technology via the one-stop artificial intelligence portal before putting them into service. Organisations and individuals that develop low-risk artificial intelligence systems are encouraged to publicise basic information about such systems in order to enhance transparency.

4. In case it is impossible to determine the risk level, providers may request the Ministry of Science and Technology to provide classification guidance based on technical dossiers.

5. The inspection and supervision shall be carried out according to risk levels of systems:

a/ High-risk artificial intelligence systems shall be inspected periodically or when they show signs of violation;

b/ Medium-risk artificial intelligence systems shall be supervised through reporting, sample testing or assessment by independent organisations;

c/ Low-risk artificial intelligence systems shall be monitored and inspected in case of incidents or feedback, or when necessary to ensure system safety, without giving rise to unnecessary obligations of organisations and individuals.

6. Based on results of inspection and supervision specified in Clause 5 of this Article, upon detecting discrepancies or untruthful declarations, competent agencies shall require re-classification, supplementation of dossiers, or suspension of system use, and simultaneously handle the violations in accordance with law.

7. The Government shall provide in detail contents to be notified, procedures for notification, and technical guidelines for risk classification.

Article 11. Transparency obligation

1. Providers shall ensure that artificial intelligence systems interacting directly with humans are designed and operated in a manner that enables users to recognise they are interacting with such systems, unless otherwise provided by law.

2. Providers shall ensure that audio, image and video content generated by artificial intelligence systems are marked in a machine-readable format under the Government’s regulations.

3. Deployers shall provide clear notifications when providing the public with texts, audio recordings, images or videos generated or edited by artificial intelligence systems if such content is likely to cause confusion regarding the authenticity of events or characters, unless otherwise provided by law.

4. Deployers shall ensure that audio recordings, images or videos generated or edited by artificial intelligence systems to simulate or replicate the appearance or voices of real persons or to recreate actual events are attached with easily recognisable labels to distinguish them from real content.

For products that are cinematographic, artistic or creative works, the labelling specified in this Clause shall be carried out in a suitable manner without obstructiing the display, performance or enjoyment of the works.

5. Providers and deployers shall maintain transparent information under this Article throughout the process of providing systems, products or content to users.

6. The Government shall issue detailed regulations on forms of notification and labelling.

Article 12. Responsibility to manage and handle artificial intelligence incidents

1. Developers, providers, deployers and users of artificial intelligence systems shall ensure safety, security and reliability of such systems, and promptly detect and remedy incidents likely to cause harm to humans, property, data or social order.

2. When a serious incident occurs in an artificial intelligence system, the developer, provider, deployer and users of such system have the following responsibilities:

a/ The developer and provider shall urgently apply technical measures to remedy, suspend or recall the system, and simultaneously notify the competent agency of the incident;

b/ The deployer and users are obliged to record and promptly notify the incident and coordinate with one another during the remediation process.

3. The competent state management agency shall receive, verify and guide the remediation of the incident; when necessary, it may require the suspension, recall, or re-assessment of the artificial intelligence system.

4. Reporting and remediation of incidents shall be carried out via the one-stop artificial intelligence portal.

5. The Government shall specify the reporting and responsibilities of related agencies, organisations and individuals as appropriate to the severity of incidents and scope of impact of artificial intelligence systems.

Article 13. Conformity assessment for high-risk artificial intelligence systems

1. High-risk artificial intelligence systems must undergo a conformity assessment in accordance with this Law before being put into service or when there is a significant change during use. In case there are standards or technical regulations for artificial intelligence systems, conformity assessment shall also be carried out in accordance with the law on standards and technical regulations.

2. Conformity assessment means the confirmation that an artificial intelligence system satisfies the requirements specified in Article 14 of this Law and shall be carried out as follows:

a/ For high-risk artificial intelligence systems on the list of systems requiring conformity certification before being put into service: the assessment shall be carried out by a conformity assessment organisation registered or recognised in accordance with law;

b/ For other high-risk artificial intelligence systems: providers shall assess conformity by themselves or hire conformity assessment organisations registered or recognised in accordance with law.

3. Results of the conformity assessment constitute a condition for a high-risk artificial intelligence system to be permitted to be used; organisations and individuals whose artificial intelligence systems have undergone conformity assessment shall maintain the conformity and publicise information thereon under the Government’s regulations, which serves as a basis for inspecting and supervising the compliance with Article 10 of this Law.

4. The Prime Minister shall promulgate the list of high-risk artificial intelligence systems, including the list of artificial intelligence systems requiring conformity certification before being put into use.

5. Organisations carrying out conformity assessment and verification of artificial intelligence systems shall ensure their independence, possess sufficient technical capacity as specified by law, and be subject to periodic supervision by competent state agencies.

6. The Government shall detail this Article.

Article 14. Management of high-risk artificial intelligence systems

1. Providers of high-risk artificial intelligence systems have the following responsibilities:

a/ To establish and maintain risk management measures and regularly review them when the systems experience significant changes or new risks arise;

b/ To manage training, testing and operation data to ensure quality within technical capabilities and in conformity with the intended use of the systems;

c/ To prepare, update and archive technical dossiers and operation logs to the extent necessary for conformity assessment and post-service inspection; to provide such information to competent state agencies according to the principles of necessity, proportionate to inspection purposes, and non-disclosure of business secrets;

d/ To design the systems to ensure the possibility of human supervision and intervention;

dd/ To perform the transparency obligation and handle incidents under Articles 11 and 12 of this Law;

e/ To perform the responsibility of accountability to competent state agencies regarding the purposes of use, operation principles at the functional description level, main types of input data, risk management and control measures, and other necessary contents for inspection and examination; to provide users and affected persons with public information at a functional description level, operational methods and risk warnings in order to ensure safety in use. Accountability and information provision may not require the disclosure of source codes, detailed algorithms, parameter sets, or information belonging to business or technological secrets;

g/ To coordinate with competent state agencies and deployers in carrying out examination, assessment, post-examination, and system-related incident remediation.

2. Deployers of high-risk artificial intelligence systems have the following responsibilities:

a/ To operate and supervise the systems according to their purposes, scope and classified risk levels, without giving rise to new or higher risks;

b/ To ensure data safety and confidentiality, and the possibility of human intervention during use;

c/ To maintain compliance with standards and technical regulations on artificial intelligence during system operation;

d/ To perform the transparency obligation and handle incidents under Articles 11 and 12 of this Law;

dd/ To perform the responsibility of accountability to competent state agencies regarding the system operation, risk control measures, incident handling, and other necessary contents for inspection and examination; to provide users and affected persons with public information at the functional description level, operational methods and risk warnings in order to ensure safety in use;

e/ To coordinate with providers and competent state agencies in carrying out inspection, assessment, post-examination and incident remediation.

3. Users of high-risk artificial intelligence systems shall comply with operation procedures, technical instructions and safety assurance measures; refrain from illegally interfering to change system features; and promptly notify deployers of incidents upon their occurrence.

4. Accountability must be appropriate to technical capabilities of systems and may not disclose business secrets as specified by law.

5. Providers and deployers are encouraged to participate in civil liability insurance or apply other suitable measures to guarantee the performance of obligations for timely incident remediation and compensation for damage.

6. Foreign providers whose  high-risk artificial intelligence systems are provided for use in Vietnam must have lawful contacts in Vietnam; in case their systems are subject to mandatory conformity certification before use, they must have a commercial presence or an authorised representative in Vietnam.

7. The Government shall detail this Article.

Article 15. Management of medium-risk and low-risk artificial intelligence systems

1. Medium-risk artificial intelligence systems shall be managed as follows:

a/ Providers and deployers shall ensure transparency under Article 11 of this Law;

b/ Providers shall explain the systems’ use purposes, operation principles at a functional description level, main input data, and risk management and system safety measures when so requested by state agencies during inspection or examination, or when there are signs of risks or incidents; the explanation does not require the disclosure of source codes, detailed algorithms, parameter sets or business or technological secrets;

c/ Deployers shall explain the operation, risk control, incident handling, and protection of lawful rights and interests of organisations and individuals when so requested by competent state agencies during inspection, examination or incident handling;

d/ Users shall comply with regulations on notification and labelling of artificial intelligence systems.

2. Low-risk artificial intelligence systems shall be managed as follows:

a/ Providers shall give explanations when so requested by competent state agencies in case there are signs of law violation or impacts on lawful rights and interests of organisations and individuals;

b/ Deployers shall give explanations when so requested by competent state agencies in case there are signs of law violation or impacts on lawful rights and interests of organisations and individuals;

c/ Users have the right to use them for lawful purposes and take personal responsibility before the law for their use of such systems.

3. The State shall encourage organisations and individuals that deploy medium-risk and low-risk artificial intelligence systems to apply technical standards on artificial intelligence.

...

(To be continued)

<Source: Official Gazette Issue Nos 21-24/2026>