Vietnam's AI Law Is Live — With Penalties That Make the EU Look Lenient

Vietnam didn’t wait for the rest of the world to figure out AI regulation. On March 1, 2026, Law No. 134/2025/QH15 — the Law on Artificial Intelligence — took legal effect, making Vietnam the first country in Southeast Asia to impose a comprehensive, cross-sector AI regime. Less than three months elapsed between the National Assembly passing it and it becoming law. The EU, by comparison, gave itself years.

And the penalties? Up to 10% aggravated surcharges on violations — significantly steeper than anything in the EU AI Act. If you’re a NZ tech company selling AI-enabled services into Vietnam, these rules already apply to you. Most don’t know it.

🔍 THE BOTTOM LINE

Vietnam has the first comprehensive AI law in Southeast Asia, with enforcement penalties that exceed the EU’s. If you sell AI tools into Vietnam, you’re already subject to compliance requirements.

What the Law Covers

What is Vietnam’s AI Law? It’s a risk-based legal framework (Law No. 134/2025/QH15) that regulates the research, development, provision, deployment, and use of AI systems in Vietnam. It applies to domestic and foreign entities whose AI systems are used in Vietnam, with an exemption only for defense, security, and cryptography systems governed under separate laws. It took effect March 1, 2026.

The law borrows Europe’s risk-based approach but runs it on a compressed timetable with harsher penalties. Three risk tiers:

High-risk — AI systems that could cause “significant harm” to life, health, legitimate rights, national interests, or security. Think medical diagnosis AI, hiring algorithms, law enforcement tools.
Medium-risk — AI that can confuse, influence, or manipulate users who cannot recognise they’re interacting with AI or AI-generated content. Think chatbots pretending to be human, deepfakes, personalised persuasion engines.
Low-risk — Everything else.

Providers must classify their systems before deployment. Medium and high-risk AI requires notification to the Ministry of Science and Technology via a new national AI portal before the system goes live, along with supporting technical documentation.

What’s Banned Outright

The law prohibits several AI activities entirely:

Using AI to commit acts already banned by other laws
Deploying AI-generated images, video, or audio of real people in ways designed to systematically deceive or manipulate and cause serious harm
Exploiting the vulnerabilities of children, the elderly, people with disabilities, ethnic minorities, or others with limited capacity
Creating or spreading fabricated content that seriously damages national security, social order, or safety
Misusing data in violation of Vietnam’s personal data protection, cybersecurity, and intellectual property laws
Disabling human oversight mechanisms or concealing required information and labels

Deepfakes get specific attention: AI-generated audio, images, and videos must be marked in a machine-readable format. When AI simulates a person’s appearance or voice, deployers must clearly label the content so viewers can distinguish it from genuine material.

The Penalty Problem

Here’s where Vietnam’s law diverges sharply from the EU model it’s inspired by: enforcement teeth.

Violations carry up to 10% aggravated surcharges — not on revenue, but calculated as penalties that compound on top of base fines
For comparison, the EU AI Act’s maximum fines are €35 million or 7% of global annual turnover
Vietnam’s approach is simpler and arguably harsher per-violation: a flat surcharge structure that applies regardless of company size

Several law firms and industry groups have warned that secondary regulations and technical standards are still being drafted, leaving companies uncertain about what compliance actually requires in practice. The law is live. The implementation details are not.

The Digital Sovereignty Play

Vietnam’s AI law doesn’t introduce new data-localisation mandates on its own — but it sits on top of an existing stack that already makes Vietnam one of the region’s more restrictive data environments:

The 2018 Cybersecurity Law requires certain online service providers to store data on Vietnamese users in-country and maintain a local presence
A 2023 decree on personal data protection tightens consent requirements and mandates impact assessments for cross-border data transfers
A separate Law on Data, in force since mid-2025, classifies data into categories with varying localisation requirements

For NZ companies, the combined effect is significant: if your AI system processes Vietnamese user data, you’re navigating at least four overlapping regulatory regimes simultaneously.

The NZ Business Impact

This is where it gets real for NZ. Vietnam’s digital economy is worth roughly $43 billion and growing fast. NZ tech exporters — particularly in SaaS, edtech, and fintech — are increasingly selling into this market.

The compliance requirements that now apply:

Risk classification before deploying any AI system in Vietnam
Notification to Vietnam’s Ministry of Science and Technology for medium and high-risk systems
AI content labelling — any AI-generated content visible to Vietnamese users must be marked
Human oversight — systems must maintain human oversight mechanisms; disabling them is prohibited
Data compliance — already strict, now compounded by AI-specific requirements

Most NZ businesses operating AI tools in Vietnam are unaware of these obligations. That’s not a hypothetical — it’s the current state of affairs.

The Bigger Picture

Vietnam’s move is part of a broader pattern. Across Asia Pacific, countries are building AI regulation faster than the West:

Singapore launched its agentic AI governance framework in January 2026 (the world’s first) — see our coverage of Singapore’s agentic AI framework
China has its algorithmic recommendation regulations and generative AI rules already in force
South Korea has AI basic legislation advancing
Japan has soft governance guidelines but is moving toward harder rules

The pattern is clear: Asia Pacific isn’t waiting for the EU to finish its implementation. It’s building regulation for its own markets, on its own timelines, with its own enforcement philosophies. For NZ, which trades predominantly with Asia, this matters more than whatever Brussels eventually decides.

❓ Frequently Asked Questions

Q: Does this law apply to NZ companies? Yes. The law explicitly covers foreign entities whose AI systems are used in Vietnam, regardless of where the company is based. If Vietnamese users interact with your AI, you’re subject to this law.

Q: What are the biggest risks for NZ companies? Non-compliance penalties (up to 10% surcharges), data localisation requirements from overlapping laws, and the fact that secondary regulations are still being drafted — meaning the full compliance picture isn’t clear yet.

Q: How does this compare to the EU AI Act? Same risk-based philosophy, but Vietnam enacted and enforced much faster (3 months vs years) and with harsher per-violation penalties. Vietnam also has stricter data sovereignty requirements layered underneath.

Q: What should NZ businesses do? Audit any AI systems serving Vietnamese users. Begin risk classification. Register with the national AI portal if deploying medium or high-risk systems. And watch for the secondary regulations — they’re coming.

🔍 THE BOTTOM LINE

Vietnam just became the most aggressive AI regulator in Southeast Asia — with a law that’s live, penalties that sting, and compliance requirements that already apply to NZ companies selling AI into the country. Most haven’t noticed. That’s the real risk.

Sources

Vietnam Ministry of Science and Technology — AI Law takes effect, anchors national governance framework (March 2026)
Law No. 134/2025/QH15 — Law on Artificial Intelligence 2025
Agentic Tribune — Vietnam Enacts Sweeping AI Law, Testing Data Control and Digital Sovereignty (March 2026)
Lexology — APAC AI Regulation Tracker