Makes public services decisions, in Vietnam

Decree No. 13/2023/ND-CP

Law No. 34/2025/QH15 (PDPL)

Law No. 134/2025/QH15, art. 12 · Read the law's page

• If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.
• If a serious incident occurs in your AI system and you are its deployer or user, record the incident, notify it promptly, and coordinate with the other parties during the remediation process.
• Report and handle the incident through the one-stop artificial intelligence portal.
• Continuously keep your AI system safe, secure, and reliable, and promptly detect and remedy any incident capable of harming people, property, data, or social order, regardless of the system's risk tier.
• The Law states no number of hours or days for this report and leaves the deadline to a Government decree. Decree No. 142/2026/ND-CP sets 72 hours from confirmation for an urgent serious incident and five working days from confirmation for any other.

Law No. 134/2025/QH15, art. 28 · Read the law's page

• During an inspection or examination of your AI activity in Vietnam, provide the inspecting authority with technical dossiers, trace logs, training data and other necessary information needed to determine the cause of a violation or incident or to apportion responsibility.
• Provide that information in compliance with the law on protecting state secrets, data, personal data and intellectual property.

Law No. 134/2025/QH15, art. 7 · Read the law's page

• Do not use an AI system with forged or simulated real people or events to intentionally and systematically deceive or manipulate people's perceptions or behaviour in a way that seriously harms their rights.
• Do not use an AI system to exploit a vulnerable group, including children, the elderly, people with disabilities, or people with limited cognitive or civil-act capacity, in a way that causes them harm.
• Do not collect, process, or use data to develop, train, test, or operate an AI system in violation of Vietnam's data, personal data protection, intellectual property, or cybersecurity law.
• Do not obstruct, disable, or distort the human-oversight mechanisms this Law requires over your AI system.

Law No. 134/2025/QH15, arts. 9-10, 13-14 · Read the law's page

• Classify your AI system's risk level (high, medium, or low) before putting it into service, based on its potential impact on rights, safety, security, and public interest, and the scale and context of its use.
• For a medium-risk or high-risk AI system, prepare a classification dossier and notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into service.
• For a high-risk AI system, complete a conformity assessment before putting it into service or after a significant change, and maintain that conformity throughout operation.
• Re-classify an AI system's risk level when a modification, integration, or functional change gives rise to a new or higher risk.

Circular No. 05/2026/TT-BKHCN · Read the law's page

• Binds state management agencies and any organization or individual that develops, provides, deploys or uses an AI system serving state management or the provision of public services; other Vietnamese and foreign organizations and individuals working with AI in Vietnam are encouraged, not required, to apply it.
• Identify in advance the harmful scenarios an AI system could cause and build preventive measures against them.
• Set quality criteria for the AI system's data, model and outputs, and build internal testing, validation and verification mechanisms before deployment.
• Build human oversight and intervention mechanisms proportionate to the AI system's impact, and keep the ability to intervene in its decisions and actions.

Decree No. 142/2026/ND-CP, art. 19 · Read the law's page

• As a deployer or user, record a serious incident promptly, take the measures needed to limit its consequences and notify the provider; as a provider, apply the technical measures needed to prevent, limit and remedy it.
• File a preliminary report through the one-stop AI portal within 72 hours of confirming an urgent serious incident (loss of life or serious harm to health, serious disruption of public or essential services or effect on national security, order or safety, or a serious infringement of rights that cannot be controlled), and within five working days of confirming any other serious incident.
• Treat an incident as confirmed once you have enough initial information to establish that it happened and probably stems from a fault of the AI system, without waiting for a full investigation of the technical cause.
• If you are a deployer and cannot reach the provider, make the report yourself.
• Keep the system logs, data and information on the incident, and send the competent state agency a formal report on the remedy within 15 days of the preliminary report.

Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15 · Read the law's page

• Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
• For a medium-risk or high-risk system, prepare a risk classification dossier, keep it for as long as the system operates, and notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into use.
• Re-classify the system when a significant change or a deployer's modification, integration or change of function or purpose creates a new or higher risk, and where the new level is higher notify the competent state agency within 15 working days of finishing the review and apply the matching risk-management measures at once.
• For a high-risk system, complete a conformity assessment before putting it into use through a conformity assessment organization where the system is on the list needing certification, or yourself with a technical dossier where it is not, and repeat it when a significant change affects the earlier result.
• Publish the conformity assessment result on the one-stop AI portal before putting a high-risk system into use and when a re-assessment updates it.
• As provider of a high-risk system, set up and maintain a risk-management system with human oversight and intervention suited to the risk level, and give deployers the information they need on purpose, safe operating conditions, identified risks and risk measures.
• As deployer of a high-risk system, operate it within the purpose, conditions and limits the provider sets, and where you find a risk of serious harm limit the risk within your control and notify the provider and the competent state agency.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page

• As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
• As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
• When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
• Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10 · Read the law's page

• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026, and Decree No. 331/2026/ND-CP, which sets the classification criteria, has applied since 19 August 2026.
• Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.
• At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.
• At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.
• This duty does not describe a system the Prime Minister has placed on the list of information systems critical to national security: that class carries the full Article 10(1) and 10(2) obligation set plus its own appraisal, certification and annual self-inspection regime under Articles 9 and 11, gated on a government designation rather than a declared activity.