VietnamDecree implementing the AI Law, risk classification, notification, conformity assessment and risk management
Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
As of .
What it requires
- Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
- For a medium-risk or high-risk system, prepare a risk classification dossier, keep it for as long as the system operates, and notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into use.
- Re-classify the system when a significant change or a deployer's modification, integration or change of function or purpose creates a new or higher risk, and where the new level is higher notify the competent state agency within 15 working days of finishing the review and apply the matching risk-management measures at once.
- For a high-risk system, complete a conformity assessment before putting it into use through a conformity assessment organization where the system is on the list needing certification, or yourself with a technical dossier where it is not, and repeat it when a significant change affects the earlier result.
- Publish the conformity assessment result on the one-stop AI portal before putting a high-risk system into use and when a re-assessment updates it.
- As provider of a high-risk system, set up and maintain a risk-management system with human oversight and intervention suited to the risk level, and give deployers the information they need on purpose, safe operating conditions, identified risks and risk measures.
- As deployer of a high-risk system, operate it within the purpose, conditions and limits the provider sets, and where you find a risk of serious harm limit the risk within your control and notify the provider and the competent state agency.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Articles 6, 9 and 11 to 15 set classification, notification, conformity assessment and risk-management duties. Read in full, none names a log, an operation record or an audit trail as a duty of its own. Article 11(5) requires operation logs only for a system that has just been re-classified as high risk and is still within its 12-month transition period, which this row does not code.
- Kind
- None
- As of
What this law does
A provider must classify its AI system itself before putting it into use, and answers before the law for the accuracy and truthfulness of the result. A system that is not classified as high risk but falls within Article 9 of the Decree is classified as medium risk. Article 9 reaches a system that can confuse, influence or manipulate users because they cannot tell that they are dealing with an AI system or with content it made.
A deployer must work with the provider to re-classify a system when its own modification, integration or change of function or purpose creates a new or higher risk. When re-classification finds a higher risk level, the provider or deployer must notify the competent state agency within 15 working days of finishing the review and apply the matching risk-management measures at once.
A provider must prepare a risk classification dossier for a high-risk or medium-risk system before putting it into use. A provider or deployer must keep the classification dossier for as long as the system operates. A provider of a medium-risk or high-risk system must notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into use.
A provider of a high-risk system must complete a conformity assessment before putting it into use. The provider must repeat the assessment when a significant change affects the original result. A system on the list of high-risk systems that need certification before use must be assessed through a conformity assessment organization. A provider that assesses a high-risk system itself must prepare a technical dossier and answers before the law for the result.
A provider must publish the conformity assessment result on the one-stop AI portal before putting the system into use and when a re-assessment updates it. A provider of a high-risk system must set up and maintain a risk-management system suited to the system's purpose, scope and risk level. The provider must design and maintain a mechanism for human oversight and intervention suited to the system's risk level.
A provider must give the deployer the information it needs on the system's purpose, safe operating conditions, identified risks and matching risk measures. A deployer of a high-risk system must operate it within the purpose, conditions and limits of use that the provider sets. A deployer that finds a system at risk of serious harm must promptly limit the risk within its control and notify the provider and the competent state agency. The Decree takes effect on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, deploys a chatbot, generates content with AI, trains models or crawls the web.