Vietnam issues no standalone AI service business licence, but from 1 March 2026 Artificial Intelligence Law No. 134/2025/QH15 builds a duty frame that follows the system’s risk level instead of a licence. Providers must self-classify their AI systems as high, medium or low risk under the law’s criteria and the guidance of Decree 142/2026/ND-CP, and compliance duties track that classification: high-risk systems bear risk management, data quality, technical dossier, activity log, human oversight and pre-use conformity assessment requirements, while low-risk systems mainly carry basic transparency duties. An AI vendor must document this classification, because Vietnamese enterprise customers will demand the result in vendor diligence.
AI services carry no separate licence, but duties follow the risk class
A foreign provider selling AI APIs to Vietnamese businesses touches Vietnamese law at four points even without in-country servers. First, Artificial Intelligence Law 134/2025/QH15 applies to foreign organisations participating in AI activities on Vietnam’s territory, so high-risk duties cannot be avoided by incorporating abroad. Second, service revenue flowing into Vietnam triggers the contractor tax mechanism with the Vietnamese buyer’s withholding duties. Third, where the service falls in notifiable digital service groups under telecom law such as cloud computing, cross-border supply notification duties may apply. Fourth, contracts with Vietnamese customers still carry the data protection and IP indemnity demands the market imposes by negotiation, wherever the governing law clause points.
Foreign providers selling APIs into Vietnam: the real legal touchpoints
At the data layer, the AI provider processes end users’ personal data as a processor: processing only on the customer-controller’s instructions, applying proportionate protection measures, notifying incidents within the contract’s window so the customer can complete its notification duties under Personal Data Protection Law No. 91/2025/QH15, and never using customer data for its own purposes such as training shared models without a separate agreement. End-user transparency duties — telling users they are interacting with AI and labelling AI-generated content in statutory cases — must be expressly allocated in the contract between the provider at platform layer and the customer at application layer, because leaving this blank makes both sides assume the other is doing it.
Data duties where the AI service processes end-user data
A provider wanting durable sales into Vietnam’s enterprise market should pre-package a compliance pack: the risk classification of each service with its basis, risk management and human oversight descriptions for high-risk services, a market-standard data processing annex, commitments on data training and data storage location, and a round-the-clock incident contact. The pack converts legal duties into a sales advantage, because in a market where customers must evidence their own supply-chain compliance, the provider answering with documents beats the provider answering with verbal assurances.
Frequently Asked Questions
What must a foreign company supplying AI APIs to Vietnamese businesses comply with?
Risk classification and corresponding duties under Artificial Intelligence Law 134/2025/QH15, the contractor tax mechanism at the Vietnamese customer’s payment end, cross-border service notification where the service is in a notifiable group, and processor duties in customer contracts.
Must AI services be registered or licensed in Vietnam?
There is no separate AI service licence; management follows the system’s risk classification plus existing sector laws such as telecoms for cloud services, personal data protection, and contractor tax on cross-border revenue.
May an AI provider use customer data to train its models?
Not by default: as processor it acts only on the customer’s instructions under Law 91/2025/QH15; using customer data for its own model training needs an express separate agreement and is the clause enterprise customers negotiate hardest.
This article has been quality-reviewed by the FLAW AI Legal Council