Vietnam

Article 7 bars developing, providing, deploying, or using an AI system to use forged elements or simulations of real people or events to intentionally and systematically deceive or manipulate human perceptions or behaviour where this causes serious harm, to exploit weaknesses of a vulnerable group such as children, the elderly, people with disabilities, or people with limited cognitive or civil-act capacity, or to create or disseminate fake content capable of posing a serious danger to national security, public order, or social safety.

It separately bars collecting, processing, or using data to develop, train, test, or operate an AI system in a way that contravenes Vietnam's data, personal data protection, intellectual property, or cybersecurity law, and bars obstructing, disabling, or distorting the human-oversight mechanisms the Law requires over an AI system.

Article 12 requires every developer, provider, deployer and user of an artificial intelligence system to keep the system safe, secure and reliable, and to promptly detect and remedy an incident capable of harming people, property, data or social order.

When a serious incident occurs in an artificial intelligence system, the developer and provider must urgently apply technical measures to remedy, suspend or recall the system, and must simultaneously notify the competent state agency of the incident. The deployer and the user of the system must record the incident, notify it promptly, and coordinate with one another during the remediation process.

The competent state management agency receives, verifies and guides the remediation, and may require the system to be suspended, recalled or reassessed when necessary. Reporting and remediation of the incident is carried out through the one-stop artificial intelligence portal.

Article 12 does not itself state a reporting deadline; instead it directs the Government to specify the reporting procedure and the responsibilities of the agencies, organisations and individuals involved, calibrated to the severity of the incident and the scope of its impact. Article 12 addresses the developer, provider, deployer and user of the system and the competent state agency; it does not itself direct any notice to a person affected by the incident.

Decree 142/2026/ND-CP, reported as covering the Law's risk-classification duties and the one-stop portal, has been issued to implement the Law, and its promulgated text is not read here, so the deadline it sets is not stated.

Article 9 classifies an AI system as high, medium, or low risk based on its potential to cause significant harm to rights, safety, security, or public interest, its capacity to confuse users about whether they are dealing with an AI system, and criteria the Government is to detail further, including the field of use and the scale and range of its impact.

Article 10 requires a provider to classify its own system before putting it into service, to prepare a classification dossier for a medium-risk or high-risk system, and to notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before deployment; a deployer inheriting a provider's classification must re-classify if a modification creates a new or higher risk.

Articles 13 and 14 require a high-risk system to undergo conformity assessment, by a registered assessment organization or by the provider itself depending on the system, before being put into service or after a significant change, and require the assessment result to be maintained throughout operation as a condition of continued use.

Decision No. 367/QD-TTg, the government's implementation plan for the Law, is preparing a Prime Ministerial decision listing high-risk AI systems by five criteria, but this list had not been issued as of this review.

Article 11 requires a provider to design and operate an AI system that interacts directly with humans so that a user can recognise they are interacting with such a system, unless the law provides otherwise, and to mark AI-generated audio, image, and video content in a machine-readable format under forthcoming Government regulations.

A deployer must clearly notify the public when providing AI-generated or AI-edited text, audio, images, or video that could cause confusion about the authenticity of an event or a person, and must attach an easily recognisable label to AI-generated or AI-edited content that simulates or replicates a real person's appearance or voice or recreates a real event, with a lighter labeling standard for cinematographic, artistic, or creative works so the label does not obstruct enjoyment of the work.

Both providers and deployers must keep this transparency information current throughout the life of the system, product, or content.

Article 31 defines biometric data as data on physical attributes and unique and stable biological characteristics of a person used to identify that person, and requires an organization, agency, or individual collecting or processing biometric data to apply physical security measures for storage and transmission devices, limit access, maintain a monitoring system to detect infringement, and comply with relevant laws and international standards; a processor causing damage through biometric-data processing is liable.

Article 31 names no facial, voice, or fingerprint example, resting entirely on the general physical-attribute language; whether the definition reaches an identifier derived from a photo, video, or audio recording is unresolved. This provision functions as heightened, category-wide protection rather than a named consent-at-capture rule distinct from the Law's general Article 8 consent duty.

Article 23 requires the personal data controller, the personal data controlling and processing party, or a third party to notify the agency in charge of personal data protection within 72 hours after detecting a violation likely to cause harm to national defense and security and social order and safety, or to infringe upon the life, health, honor, dignity, or property of the personal data subject.

Where a personal data processor detects a violation, it must promptly notify the controller or the controlling and processing party.

The Law on Personal Data Protection (Law No. 91/2025/QH15) is Vietnam's first standalone, comprehensive personal-data statute, replacing Decree 13/2023/ND-CP, which was itself Vietnam's first general personal-data instrument but only a government decree rather than a National Assembly law. A companion implementing decree, Decree 356/2025/ND-CP, took effect alongside the Law on the same date; its provisions are not described here.

The Law's commencement date is confirmed via the Ministry of Public Security's own portal, a government source; the government's own signed PDF of the Law does not yield extractable text, so the substantive article text here comes from a private secondary publisher's English translation (LuatVietnam) rather than from the government's own text, and is not verified against the primary PDF.

A citation of this same enactment as Law No. 34/2025/QH15 is incorrect, per the Government Portal's own page title and the Ministry of Public Security's announcement.

Article 20 enumerates the cases in which cross-border transfer of personal data is permitted; whether its conditions include an adequacy standard, a government approval requirement, or a data-localization element is not established.

A separate penalties article confirms a materially strict enforcement posture: the maximum fine for an organization violating cross-border transfer regulations specifically is 5 percent of the organization's prior-year revenue, distinct from and higher than the Law's general violation fine tier.

The Law names an agency in charge of personal data protection as the enforcement authority, without independently confirming the specific body's name, though the Ministry of Public Security's role publicizing the Law's commencement suggests it sits under that ministry.

Administrative fines confirmed directly reach up to 5 percent of the prior year's organizational revenue for cross-border transfer violations specifically, with a separate, lower general fine tier referenced elsewhere in the same penalties article and not read in full.

A data-subject-rights clause confirms individuals may request the provision and deletion of their personal data, restriction of processing, and may object to processing, and separately may file complaints and denunciations, initiate lawsuits, and request compensation for damage in accordance with law, arming a private plaintiff.

Article 8(3) strictly prohibits producing or using tools to obstruct or disrupt the operation of a telecom network, the Internet, a computer network, an information system, or an e-facility, distributing software that harms such a system, or illegally accessing a telecom network, the Internet, a computer network, an information system, or a database of another person.

The prohibition's own wording turns on access being illegal rather than on defeating a specific security measure, so whether it reaches a scraper reading a public, unauthenticated page is unsettled rather than confirmed either way, and no reported case addresses the point.

Article 9 provides that a breach of the Law is, depending on its nature and seriousness, disciplined, subject to an administrative penalty, or criminally prosecuted, with compensation owed for any loss caused, but the Law itself states no fine amount or imprisonment term for this prohibition, leaving those to administrative decrees and the Penal Code.

Article 54 requires an agency, organization, or individual that manages or provides information and communications products and services, or organizes activities, in the Internet environment to apply measures ensuring safety and privacy for children, defined by Article 1 as a person below the age of sixteen; clause 3 leaves the Government to detail the article's specific requirements, which are not independently confirmed here.

Article 87 assigns the Ministry of Information and Communications responsibility to manage and guide regulations on the press, publication, telecommunications, Internet, and other information channels involving children, and to protect children in the environment of the Internet, computer networks, and telecommunication networks.

Article 105 provides that a violator of the Law is disciplined, administratively sanctioned, or examined for penal liability depending on the nature and severity of the violation.

Article 36 requires a news aggregation website to quote journalistic news sources verbatim and accurately, and to show the name of the author, the name of the press agency, and the time of publication or transmission of the aggregated information.

The aggregated content must not violate the Law's content prohibitions at clause 13, Article 9, and the establishing agency or organization must develop an information management process to examine, monitor, and remove prohibited content on its own initiative or on the request of a competent state agency.

An aggregator must remove an aggregated content item as soon as the quoted source itself removes that content, and the establishment of a news aggregation website by an agency, organization, or enterprise must further comply with regulations of the Government, whose content is not described here.