VietnamDecree implementing the AI Law, serious incident reporting and handling
Decree No. 142/2026/ND-CP, art. 19
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Breach notice
- Audit expectation
- none
As of .
What it requires
- As a deployer or user, record a serious incident promptly, take the measures needed to limit its consequences and notify the provider; as a provider, apply the technical measures needed to prevent, limit and remedy it.
- File a preliminary report through the one-stop AI portal within 72 hours of confirming an urgent serious incident (loss of life or serious harm to health, serious disruption of public or essential services or effect on national security, order or safety, or a serious infringement of rights that cannot be controlled), and within five working days of confirming any other serious incident.
- Treat an incident as confirmed once you have enough initial information to establish that it happened and probably stems from a fault of the AI system, without waiting for a full investigation of the technical cause.
- If you are a deployer and cannot reach the provider, make the report yourself.
- Keep the system logs, data and information on the incident, and send the competent state agency a formal report on the remedy within 15 days of the preliminary report.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Article 19(4) names the record directly: a provider and a deployer must keep system logs, data and information related to the incident for verification, assessment and remedy. It states no content or period for what is kept and names no one with a right to read it.
- Kind
- Explicit
- As of
- Provision
- art. 19(4)
- Trigger
- security_incident
What this law does
A serious incident includes an event in the operation of an AI system that causes loss of life or serious harm to a person's health. A deployer and a user must promptly record a serious incident, take the measures needed to limit its consequences and notify the provider. A provider must apply the technical measures needed to prevent, limit and remedy the consequences of the incident.
A provider or deployer must file a preliminary report through the one-stop AI portal within 72 hours of confirming an urgent serious incident, meaning one under points a and d of Article 19(1) or an uncontrollable one under point c. For any other serious incident the preliminary report is due within five working days of confirmation.
The time of confirmation runs from when the reporting person has enough initial information to establish that the incident really happened and probably stems from a fault of the AI system, without waiting for a full investigation of the technical cause. A deployer that cannot reach the provider must make the report itself. A provider and a deployer must keep the system logs, data and information on the incident for verification, assessment and remedy.
They must send the competent state agency a formal report on the remedy within 15 days of the preliminary report. The Decree takes effect on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, deploys a chatbot, generates content with AI, trains models or crawls the web.