Vietnam's Draft AI Law: EU-Style Risk Rules, Local Accountability
Vietnam has released a draft AI law modeled on the EU's risk-based framework. The Ministry of Information and Communications (MIC) proposes clear risk tiers, tighter controls for high-risk uses, and a national oversight body.
The goal is simple: enable AI growth while protecting rights and safety. The draft is open for public consultation, giving companies and legal teams a window to shape the final text.
Risk-Based Classification
- Unacceptable risk: AI uses that threaten fundamental rights and safety are banned.
- High risk: AI in areas like critical infrastructure, law enforcement, and employment faces strict requirements.
- Limited risk: Focus on transparency and user disclosures.
- Minimal risk: Few obligations beyond basic information duties.
Prohibited Practices
The draft identifies AI practices that pose unacceptable risks and bans them outright. This mirrors the EU approach to protecting fundamental rights and security.
Obligations for High-Risk AI
- Data quality: Training and testing datasets must be appropriate and traceable.
- Transparency: Clear documentation, function descriptions, and user information.
- Human oversight: Defined controls to prevent or correct harmful outcomes.
- Cybersecurity: Strong technical and organizational measures to reduce vulnerabilities.
Transparency for Lower-Risk Systems
Providers must label AI-generated content and disclose when users interact with AI. Information should be concise, accurate, and accessible so users can make informed decisions.
Governance and Oversight
The draft creates a national AI management body to coordinate enforcement, issue guidance, and respond to emerging risks. Centralized oversight should improve consistency and reduce uncertainty for businesses.
Innovation and Ecosystem Support
Vietnam pairs compliance with incentives for research, investment, and adoption. Expect programs that encourage responsible deployment without overburdening low-risk use cases.
What Legal Teams Should Do Now
- Map your AI stack: Inventory systems, use cases, data flows, and vendors. Assign provisional risk tiers.
- Run a gap assessment: Compare current controls to expected high-risk requirements: data governance, documentation, human oversight, and security.
- Update procurement and DPAs: Add AI-specific warranties, data quality standards, incident reporting, and audit rights for third-party systems.
- Build evidence: Maintain technical documentation, risk assessments, testing records, and user disclosures for audit readiness.
- Plan for labeling: Implement user notices and content labels where AI is involved, including generative outputs.
- Prepare governance: Define roles for accountability, oversight procedures, and escalation paths for AI incidents.
EU Alignment and Cross-Border Consistency
By aligning with the EU's structure, Vietnam signals predictable rules for international partners. Companies already working with the EU AI Act will recognize the risk tiers and core obligations.
For reference, see the EU AI Act on EUR-Lex. For local developments and consultation details, monitor the Ministry of Information and Communications.
Consultation Window: Act Early
The draft is open for public feedback. If your organization operates or deploys AI in Vietnam, submit comments on definitions, scoping, and compliance timelines to reduce future friction.
Use this period to prototype compliance artifacts-risk assessments, DPIA addenda, model documentation, and user notices-so you are ready when the final law lands.
Upskilling Your Team
If you are building in-house capability for AI compliance, governance, and audits, consider structured training for legal and risk teams. Explore role-based options at Complete AI Training.
Your membership also unlocks:
