Short answer: Vietnam is building artificial intelligence governance on a risk-based approach: not regulating every AI application alike, but tightening where systems can seriously harm people and society. The current foundation already sits in the Digital Technology Industry Law 71/2025/QH15 — human-centric principles, dedicated management of high-risk AI systems and labelling of AI-generated products — while a more detailed frame continues to be completed.
Risk classification: where regulatory weight falls
The risk approach tiers AI systems by potential impact: the high-risk group — systems touching human safety and core legal rights and interests, typically in healthcare, credit finance, recruitment, education, law enforcement and critical infrastructure — bears the strictest governance on training data, transparency, human oversight and accountability. Lower-risk groups such as customer-service chatbots or internal support tools mainly carry transparency duties: users must know they are interacting with AI. Businesses deploying AI should self-classify their systems on this logic now, because the governance file for high-risk systems — impact assessments, bias testing, decision logs — takes time to build and will be the first thing asked when the detailed frame takes effect.
Transparency, labelling and current liability
Two duties already have a current basis and need no wait for a separate AI law. First, labelling and transparency for AI-generated content and products under Law 71/2025 in statutory cases, especially content easily confused with real-world recording. Second, where AI processes personal data or supports automated decisions about individuals, the Personal Data Protection Law 91/2025/QH15 frame applies in full: lawful bases, impact assessments and data-subject rights around automated decisions. On liability for AI-caused harm, current law allocates by role chain — developer, deployer, user — on the base of existing civil liability and contract; a deploying business cannot disclaim responsibility on the ground that a machine made the decision.
Compliance preparation for AI deployers
- Inventory all AI systems in use and self-classify by risk level.
- For high-risk systems: training-data files, bias testing, human decision-oversight mechanisms.
- Label generative AI content at public touchpoints.
- Write AI liability clauses into solution purchase contracts with providers.
Frequently asked questions
Which AI counts as high-risk, and is any AI banned?
Under the risk-based direction, high-risk means AI systems affecting human safety and core rights and interests in fields such as healthcare, credit, recruitment, education and critical infrastructure. A detailed prohibition catalogue is still being completed as the governance frame is built; businesses should self-classify by impact level and apply the highest governance standard to systems touching individual rights.
What transparency duties apply to generative AI (labelling)?
Law 71/2025 requires labelling of AI-generated products in statutory cases and transparency principles when users interact with AI systems. Compliance practice includes: clearly notifying customers they are speaking with AI, labelling AI-generated content at publication points, and keeping records of models and data used for important products.
Who is liable when AI causes harm?
Under the current frame, liability allocates by role and contract on the base of general civil liability: the deployer answers for putting the system into operation and supervising it; the developer answers under the supply contract and product faults; no party is excused merely because an AI made the decision. AI solution contracts must allocate these layers expressly.
What compliance should an AI-deploying business prepare?
Four things: an inventory and risk classification of every operating AI system; governance files for high-risk systems covering data impact assessment, bias testing and human oversight; labelling and transparency at user touchpoints; and liability clauses in contracts with AI providers. These are the capabilities the coming detailed frame will test first.
This article has been quality-reviewed by the FLAW AI Legal Council