Vietnam Enacts Risk-Based AI Law, Following EU Model While Asserting Digital Sovereignty

Vietnam has officially enacted a new AI law that establishes a risk-based regulatory framework for artificial intelligence—the first comprehensive AI legislation in Southeast Asia. The law closely follows the EU AI Act's structure but adds explicit provisions for digital sovereignty, signaling Vietnam's intent to control AI development within its borders while aligning with global standards.

The timing is notable. Vietnam's law arrives as the EU AI Act's compliance deadlines approach (August 2026), US federal AI policy remains fragmented, and China continues to roll out sector-specific AI regulations. Vietnam is positioning itself as a regional AI governance leader, with potential ripple effects across ASEAN.

What's Actually In The Law

Vietnam's AI law adopts the EU's risk-based approach, categorizing AI systems into four tiers:

• Unacceptable risk — Social scoring, real-time biometric surveillance, and manipulative AI systems are banned outright
• High risk — AI in critical infrastructure, education, healthcare, law enforcement, and migration must meet strict requirements for transparency, human oversight, and data quality
• Limited risk — Chatbots and AI systems that interact with humans face transparency obligations (users must know they're talking to AI)
• Minimal risk — Everything else is permitted without specific restrictions

This framework mirrors the EU AI Act almost exactly. But Vietnam's version includes an entire section on "digital sovereignty" that doesn't exist in the EU text.

The Digital Sovereignty Twist

While the EU AI Act focuses on risk mitigation and fundamental rights, Vietnam's law explicitly addresses control over AI systems, data, and infrastructure. Key provisions include:

• Data localization requirements — High-risk AI systems processing Vietnamese citizens' data must store that data within Vietnam
• Government oversight of foreign AI models — International AI companies operating in Vietnam face additional compliance requirements and potential restrictions on certain AI applications
• Domestic AI development incentives — The law creates a framework for government support of Vietnamese AI startups and research institutions

This sovereignty angle reflects Vietnam's broader digital policy strategy. The country already requires social media platforms to store Vietnamese user data locally and has strict rules around cross-border data transfers. The AI law extends this approach to AI systems.

Why This Matters Beyond Vietnam

Vietnam is the 15th largest economy in the world and Southeast Asia's third largest. Its AI market is projected to grow rapidly over the next decade, driven by a young, tech-savvy population and an expanding startup ecosystem. When Vietnam sets regulatory standards, the rest of ASEAN pays attention.

Several other Southeast Asian nations—including Indonesia, Thailand, and Singapore—are developing their own AI governance frameworks. Vietnam's approach will likely influence regional discussions. If other ASEAN countries adopt similar sovereignty provisions, international AI companies could face a complex patchwork of data localization and oversight requirements across the region.

For context, Singapore has taken a principles-based approach (the Model AI Governance Framework), while the Philippines is still in early consultations. Vietnam is now the most aggressive regulator in the region.

The Compliance Challenge For AI Companies

If you're deploying AI systems in Vietnam—or planning to—here's what changes:

1. Risk classification required — You need to determine which tier your AI system falls into and document that assessment
2. High-risk systems need compliance infrastructure — This means risk management systems, data quality controls, human oversight mechanisms, and audit trails
3. Data localization for high-risk systems — If your AI processes Vietnamese user data in high-risk applications, that data needs to stay in Vietnam
4. Registration and reporting — High-risk AI providers must register with Vietnam's regulatory authority and submit periodic compliance reports

The law takes effect immediately for prohibited systems (unacceptable risk) and phases in over 12-24 months for high-risk systems. That's a tight timeline, especially for companies that haven't started compliance work.

What This Means For Your Business

Vietnam's AI law has implications beyond companies operating directly in the country:

• If you're building AI products for global markets: Add Vietnam to your compliance roadmap alongside the EU and other jurisdictions. The risk-based framework is similar to the EU AI Act, so much of your EU compliance work will translate—but the sovereignty provisions require additional engineering and operational changes.
• If you're deploying AI in Southeast Asia: Vietnam's approach could become a regional template. Start thinking about data localization, local partnerships, and jurisdiction-specific compliance infrastructure now.
• If you're evaluating where to expand: Vietnam's new regulatory clarity might actually be a positive signal. While compliance adds cost, a clear framework is better than regulatory uncertainty. Companies that invest in Vietnam compliance early may have a competitive advantage.

The Broader Regulatory Wave

Vietnam's law is part of a global trend toward AI-specific regulation. The EU AI Act went into effect last year. China has rolled out regulations for algorithms, deepfakes, and generative AI. Canada and Brazil are advancing comprehensive AI bills. Even in the US—where federal AI legislation has stalled—individual states and agencies are taking action.

The pattern is clear: AI governance is no longer a question of "if" but "how." And each jurisdiction is adding its own priorities to the mix. The EU emphasizes fundamental rights. China focuses on social stability and party control. Vietnam adds digital sovereignty. The result is a complex, multi-layered compliance landscape that AI companies need to navigate.

For startups and funded companies building AI products, this means baking compliance into product design from day one. For enterprises deploying AI, it means investing in governance infrastructure that can adapt to multiple regulatory frameworks. For everyone, it means AI governance is now a core competency, not a legal afterthought.

Looking Ahead

Watch for implementation details over the next few months. Vietnam's regulatory authority will need to publish guidance on risk classification, registration procedures, and enforcement mechanisms. We'll also see whether other ASEAN countries follow Vietnam's sovereignty-focused approach or take different paths.

For AI companies, the key takeaway is simple: regulatory complexity is the new normal. The companies that win will be those that treat compliance as a competitive advantage—building governance into their products, not bolting it on later.

---

Build AI That Works For Your Business

At AI Agents Plus, we help companies move from AI experiments to production systems that deliver real ROI. Whether you need:

• Custom AI Agents — Autonomous systems that handle complex workflows, from customer service to operations
• Rapid AI Prototyping — Go from idea to working demo in days using vibe coding and modern AI frameworks
• Voice AI Solutions — Natural conversational interfaces for your products and services

We've built AI systems for startups and enterprises across Africa and beyond.

Ready to explore what AI can do for your business? Let's talk →