Vietnam can lead the way in AI regulatory system

Under the AI law, a high-risk AI system is one that is capable of causing significant harm to human life or health, the lawful rights and interests of organisations or individuals, national interests, public interests or national security. Classification is based on the system’s impact on human rights, safety and security, its field of use, the scope of its users and the scale of its effects.

Dang The Duc, managing partner Indochine Counsel and Le Thi Minh Trang, junior associate Indochine Counsel

Decree No.142/2026/ND-CP further considers the degree of automation, the system’s role in final decision-making and the ability of humans to supervise and intervene. Decision 33 lists nearly 50 high-risk AI systems across education, ethnic and religious affairs, healthcare, banking, the legal system, and more.

Classification depends on matching the description and conditions set out for the relevant entry in Decision 33. Decree 142 generally excludes from the high-risk list systems that only collect, process, standardise, classify or translate data, or improve data quality, without directly generating decisions that affect legitimate rights or interests. It also excludes systems subject to substantive, independent human review before a decision takes effect, and more.

Providers must self-classify their AI systems before putting them into use. A high-risk system must be accompanied by a classification dossier, and the provider must notify the Ministry of Science and Technology of the classification result through the National Single Window AI Portal before the system is put into use.

The AI law requires providers to establish and maintain risk management measures, while Decree 142 further requires a risk management system appropriate to the intended purpose, deployment scope and risk level of the relevant AI system. At a minimum, the process must identify and assess risks to human rights, safety, security and public interests. It must also include measures to prevent, limit or control identified risks.

Providers must give deployers sufficient information concerning the system’s intended use, safe operating conditions, identified risks and corresponding controls. Deployers, in turn, must manage risks during deployment and operation in accordance with the system’s intended purpose, deployment scope, risk level and the provider’s technical guidance.

Data governance is a central part of this risk management framework. Providers must manage training, testing and operational data to ensure appropriate quality, having regard to technical capability and the intended purpose of the system. Decree 142 expressly refers to the quality, suitability and representativeness of training, testing and evaluation data, to the extent necessary to limit risks arising from that data.

Every high-risk AI system must undergo conformity assessment before it is put into use, and following any big change that affects the result of the initial conformity assessment, including changes to the system’s purpose, architecture, model, data sources or operating environment.

Decision 33 indicates the assessment method applicable to each listed system. Systems subject to mandatory conformity certification must be assessed by a registered or recognised conformity assessment organisation. For other listed systems, the provider may conduct a self-assessment or appoint an eligible conformity assessment organisation.

In the former case, the provider must prepare a technical dossier and remains legally responsible for the result. Documentation will therefore become important well before the assessment takes place. Where the system requires mandatory conformity certification before operation, foreign providers must have a commercial presence or an authorised representative in Vietnam

Providers must design high-risk AI systems so that human supervision and intervention remain possible. Deployers must ensure safety and data security during operation, maintain human oversight and ensure that persons responsible for supervision can intervene where necessary.

Transparency obligations operate alongside these controls. Providers and deployers must provide specified information concerning the purpose, operating conditions and limitations of AI systems, while certain AI-generated content is subject to notification or labelling requirements.

Compliance deadlines then depend on when the system was put into operation. For high-risk systems already operating before August 15, the deadline is September 2027 for systems in the healthcare, education and banking sectors, and March 2027 for systems in the other listed fields. Systems put into operation during the first six months following August 15 must comply by March 2027.