Two laws, two deadlines.
Law No. 134/2025/QH15 on Artificial Intelligence and Law No. 91/2025/QH15 on Personal Data Protection both apply today. The transition periods close in 2027. We work from Ho Chi Minh City, on site when it helps.
What the law requires
Risk classification
Law No. 134/2025/QH15 requires AI systems to be classified by risk. The class determines which other obligations apply, so it is the first thing to get right.
High-risk obligations
The high-risk tier carries additional duties. If a system lands there, the burden of proof sits with you, and it has to be documented rather than asserted.
Incident reporting
Incidents involving AI systems have to be reported. Someone has to recognise an incident when it happens, and there has to be a route to report it.
Data breach notification
Under Article 23 of Law No. 91/2025/QH15, a personal data breach likely to harm the data subject is notified to the competent authority within 72 hours of detection, with a written record.
Dates
- 1 January 2026: Law No. 91/2025/QH15 in force.
- 1 March 2026: Law No. 134/2025/QH15 in force.
- 1 March 2027: end of the 12-month transition for organisations generally.
- 1 September 2027: end of the 18-month transition for finance, healthcare and education.
The law states the obligations; the detail follows in implementing decrees. The defensible position now is a recognised standard applied and documented, so that when the detail arrives the gap is small and the evidence already exists.
Which applies to you
- Deadline
- 1 September 2027: the end of the 18-month transition.
- Method
- MAS FEAT and the MAS AI Risk Management Guidelines. Supervisory expectations for financial institutions in this region, and how we work rather than Vietnamese requirements.
Where to start
Method: ISO/IEC 42001, NIST AI RMF, and the MAS guidelines for financial institutions. These are how we work, not Vietnamese requirements.
Primary texts
Cited by number and date, from the official texts.
Law No. 134/2025/QH15 on Artificial Intelligence
National Assembly, 10 December 2025. In force 1 March 2026.
Transition periods, as provided by this law: 12 months, 1 March 2027, for organisations generally. 18 months, 1 September 2027, for finance, healthcare and education.
Law No. 91/2025/QH15 on Personal Data Protection
National Assembly, 26 June 2025. In force 1 January 2026.
Official texts: chinhphu.vn, the Government of Vietnam portal.
Public regulatory timelines, last reviewed September 2026. Not legal advice; verify your obligations with counsel.
Start with the readiness check.
One conversation to establish which obligations apply to you and by when. No obligation, no pitch.