LexLint.ioBeta

Know the law your code answers to.

Law / Vietnam

Law on Artificial Intelligence, incident management and reporting obligation

Law No. 134/2025/QH15, art. 12

In force since .

An AI risk obligations rule binding public and private bodies.

How the hook was established
express
What makes it apply
Place of effect
Obligation class
Breach notice, Governance
Audit expectation
continuous
Who audits it
Self
Where the report goes
Filed with regulator

What it requires

  • If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.NIST AI RMFMANAGE 4.3
  • If a serious incident occurs in your AI system and you are its deployer or user, record the incident, notify it promptly, and coordinate with the other parties during the remediation process.NIST AI RMFMANAGE 4.3
  • Report and handle the incident through the one-stop artificial intelligence portal.NIST AI RMFMANAGE 4.3
  • Continuously keep your AI system safe, secure, and reliable, and promptly detect and remedy any incident capable of harming people, property, data, or social order, regardless of the system's risk tier.NIST AI RMFMANAGE 4.1
  • The Law states no number of hours or days for this report and leaves the deadline to a Government decree. Decree No. 142/2026/ND-CP sets 72 hours from confirmation for an urgent serious incident and five working days from confirmation for any other.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
  • MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
NIST AI 600-1
MIT mitigations Draft
  • 3.6Incident Response & Recovery
  • 4.3Incident Reporting
FINOS AIGF
ETSI EN 304 223
  • 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
  • 5.3.1-3Support for users and affected parties during and after a security incident, set out in contracts.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

What it makes you log

Who may demand the log

Regulator

Logging duty

Article 12(2)(b) names the record directly: a deployer or user of the system is obliged to record the incident, in addition to notifying it promptly. The sibling duty on the developer and provider, art. 12(2)(a), is more implicit-shaped (urgently remedy, suspend or recall the system and simultaneously notify the competent agency, with no word for a log or record), so the explicit logging duty rests on the deployer/user clause specifically. Neither clause states what the incident record must contain.

Kind
Explicit
As of
Provision
art. 12(2)(b)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 12 requires every developer, provider, deployer and user of an artificial intelligence system to keep the system safe, secure and reliable, and to promptly detect and remedy an incident capable of harming people, property, data or social order.

When a serious incident occurs in an artificial intelligence system, the developer and provider must urgently apply technical measures to remedy, suspend or recall the system, and must simultaneously notify the competent state agency of the incident. The deployer and the user of the system must record the incident, notify it promptly, and coordinate with one another during the remediation process.

The competent state management agency receives, verifies and guides the remediation, and may require the system to be suspended, recalled or reassessed when necessary. Reporting and remediation of the incident is carried out through the one-stop artificial intelligence portal.

Article 12 does not itself state a reporting deadline; instead it directs the Government to specify the reporting procedure and the responsibilities of the agencies, organisations and individuals involved, calibrated to the severity of the incident and the scope of its impact. Article 12 addresses the developer, provider, deployer and user of the system and the competent state agency; it does not itself direct any notice to a person affected by the incident.

Decree 142/2026/ND-CP sets the preliminary-report deadline for an urgent serious incident at 72 hours from confirmation. For any other serious incident the Decree makes the preliminary report due within five working days of confirmation.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions, deploys a chatbot, generates content with AI, trains models or crawls the web.

Back to the example  ·  Lint your app

Page updated .