Vietnam: National Assembly adopted the Law on Artificial Intelligence including quality of service requirement

On 10 December 2025, the National Assembly adopted the Law on Artificial Intelligence (AI). The Law applies to Vietnamese and foreign entities operating in the country, excluding AI used solely for defence, security, or cipher purposes. It introduces a risk-based classification of AI systems into high, medium, and low-risk categories, with classification criteria to be set by the Government. The Law establishes quality of service requirements across the AI lifecycle. Article 4 sets out the basic principles governing AI activities, requiring systems to be human-centred, legally compliant, and respectful of human rights, privacy, public and national interests, and national security. AI must operate under human control, allow for human intervention, and ensure system safety, data security, and information confidentiality. The provision also requires transparency, fairness, non-discrimination, accountability for system outcomes, and alignment with ethical standards and Vietnamese cultural values, while encouraging environmentally sustainable and energy-efficient AI development. Specific obligations depend on the risk category. Under Article 14, providers of high-risk AI systems must establish and regularly review risk management measures and ensure the quality of training, testing, and operational data in line with the system’s intended use. Article 12 assigns responsibility for incident management to developers, providers, deployers, and users, who must ensure safety and reliability and promptly detect, report, and remedy incidents. Serious incidents trigger obligations to apply technical remedies, suspend or recall systems, and notify competent authorities, which oversee incident handling through a single AI portal and may require suspension or reassessment of systems. Article 15 sets out the management regime for medium- and low-risk AI systems. Medium-risk systems are subject to transparency and accountability obligations, requiring providers and deployers to explain system purpose, operation, and risk controls to authorities when requested, without disclosing source code or protected information, while users must comply with notification and labelling rules. For low-risk systems, accountability obligations apply only in cases of suspected legal violations or impacts on legitimate rights, with users remaining responsible for lawful use. The Law also encourages the voluntary application of AI technical standards for medium- and low-risk systems.