The Digital Technology Industry Law No. 71/2025/QH15, effective from 1 January 2026, places a controlled testing mechanism for new digital products and services inside a statute for the first time, instead of scattering pilots across separate programmes. Artificial intelligence ventures, data platforms and other novel digital products can be trialled within defined limits before the permanent legal framework is complete. This article sets out the participation conditions at framework level, what is already clear and what still awaits guiding documents, the user-protection commitments an FDI applicant must build into its file, and the route from a successful trial to commercial launch.
Participation conditions for the digital sandbox at framework level
The spirit of the testing mechanism in Law 71/2025/QH15 is to let genuinely new digital products and services, especially artificial intelligence applications, operate on a trial basis with limited customers, duration and features under regulator supervision, generating real-world evidence that helps complete the permanent rules. Framework-level conditions include: the product is new and not yet fully regulated; the enterprise files a trial plan stating objectives, scope, foreseeable risks and control measures; and the enterprise commits to baseline duties on safety, data protection and user rights for the whole trial period, including an exit arrangement if the trial is stopped early.
One limitation must be stated transparently at the time of writing: detailed parameters such as the maximum trial duration, the step-by-step approval sequence and the exact dossier list still await implementing guidance for the law. Enterprises should therefore not copy the banking sandbox parameters under Decree 94/2025/ND-CP into a digital technology proposal, because the two mechanisms sit in different regulatory systems. A prudent design keeps the trial plan adjustable: features separated into modules, trial user data segregated, and partner contracts containing change clauses that track the guidance documents expected to be issued after the law takes effect.
Bounded relief from liability and user-protection commitments
Controlled testing does not mean blanket immunity. At principle level, the enterprise gains flexibility against rules that do not yet fit the new model within its approved plan, but core duties on personal data protection, information security and compensation for actual user harm are not removed. For an artificial intelligence product, the user-protection commitment must show three things: users are told they are interacting with a system under trial; a human can intervene where an automated output materially affects user interests; and there is a working channel to complain and to request an explanation of the results the system produces about that user.
FDI enterprises should also plan for the cross-border compliance dimension: an artificial intelligence model trained or partly operated abroad must still satisfy requirements for data generated in Vietnam once it enters a domestic trial. The trial file should map data flows, storage locations, who can access the data, and how the product will be withdrawn from the trial market if the regulator orders a stop. Experience from financial sandboxes shows that plans describing the worst-case scenario and the enterprise’s own handling of it are rated more highly than plans presenting only user-growth projections and optimistic adoption curves.
Frequently Asked Questions
What participation conditions does the controlled testing mechanism for AI and new digital products under the 2025 Digital Technology Industry Law include?
At framework level there are three condition groups: first, the product or service is a new digital technology offering that current law does not yet regulate completely, such as a novel artificial intelligence application; second, the enterprise submits a trial plan stating objectives, a limited customer and feature scope, foreseeable risks and control measures; third, it commits to baseline duties on data protection, information security and user rights. The detailed dossier list and approval sequence still await implementing guidance for Law 71/2025/QH15, so applicants should prepare files in an open structure that can be supplemented quickly once that guidance appears.
What are the trial duration and the scope of liability relief inside the digital technology sandbox?
The law places testing within an approved time limit and scope, while the specific duration figures and the detailed scope of relief remain matters for the forthcoming guiding decree at the time of writing; enterprises should not import numbers from the banking sandbox. In principle, relief covers only rules that do not yet fit the new model, within the approved plan, and never extends to liability for actual harm to users or to personal data breaches. Trial clauses in customer contracts should describe this bounded character accurately, instead of promising customers a level of legal protection broader than the mechanism actually provides.
What user-protection commitments must an FDI enterprise trialling an AI product make?
Core commitments include telling users clearly that the product is in a trial phase and that they are interacting with an artificial intelligence system; keeping a human review point for automated decisions that materially affect users; providing complaint and explanation channels; and protecting trial data under personal data law, with no use of trial data beyond the approved plan. An FDI applicant must also describe cross-border data flows and name the party accountable in Vietnam when users seek support or compensation, because a foreign parent operating the model does not remove the local accountability expected during a domestic trial.
By what pathway is a product that passes the trial commercialised?
Commercialisation runs through evaluation of trial results: the enterprise compiles operating data, incidents and user feedback so the regulator can allow formal deployment, require model adjustments, or terminate the trial. A product that passes may be commercialised only within the evaluated scope; expanding features or customer groups beyond that scope can require a fresh procedure. Because guidance on result evaluation is still being completed, enterprises should keep trial records in an auditable form from day one rather than reconstructing them retrospectively when the trial period is about to end.
Prepare your digital sandbox plan with FLAT Law Firm
FLAT Law Firm works with technology companies and FDI investors on trial plans under the Digital Technology Industry Law 71/2025/QH15: deciding which features belong inside the trial scope, drafting user-protection commitments for artificial intelligence products, writing trial clauses in customer contracts that stay within the real limits of the relief, and organising trial data for the commercialisation evaluation. Contact FLAT Law Firm to have your plan reviewed against what the framework law already provides, with the points still awaiting guidance flagged honestly, before the file is submitted.
