From the journal

Vietnam Implements AI Law Risk Classification Rules Via Decree 142, Effective May 2026

On 30 April 2026, Vietnam's government issued Decree No. 142/2026/ND-CP implementing the Law on Artificial Intelligence, effective 1 May 2026. The Decree establishes a three-tier AI risk classification system, mandatory labelling of AI-generated content, and incident-reporting timelines of 72 hours for serious incidents. The Decree applies to foreign organisations and individuals conducting AI activities in Vietnam, regardless of where they are incorporated.

3 min read

On 30 April 2026, the Government of Vietnam issued Decree No. 142/2026/ND-CP detailing provisions and measures for implementing the Law on Artificial Intelligence. The Decree took effect on 1 May 2026. It applies to providers, developers, deployers, and users of AI systems operating in Vietnam, including foreign organisations and individuals engaged in AI-related activities in the country, regardless of where they are established.

The Decree establishes a three-tier risk classification: high-risk, medium-risk, and low-risk AI systems. Providers must complete a risk assessment and determine the applicable tier before placing an AI system into operation in Vietnam. The Ministry of Science and Technology is responsible for publishing technical classification criteria and labelling format guidance. AI-generated content must carry a clear label, with the specific display format left to deployers pending ministry guidance. Incident reporting requires a preliminary report within 72 hours of discovering a serious incident, and within five working days for other incidents.

Foreign companies providing, developing, or deploying AI systems to users in Vietnam fall within scope regardless of where the company is incorporated. Providers must complete risk assessments and satisfy the applicable tier requirements before deployment. Companies in financial services, healthcare, education, and media face immediate attention given the frequency of AI use cases in those sectors. Deployers of AI systems generating content for Vietnamese audiences must implement labelling now, because the obligation is already in force even while ministry format guidance remains pending.

Technical classification criteria from the Ministry of Science and Technology have not yet been published. Until that guidance is issued, providers must assess risk based on the Decree's general criteria, which may produce inconsistent results across the market. The labelling format guidance is also pending, creating a period of partial implementation where the labelling obligation exists but the prescribed format has not been specified. Companies should document their classification rationale now to demonstrate good-faith compliance ahead of the technical guidance.

Licentium advises technology companies on AI regulatory obligations across Southeast Asia and on cross-border AI deployment strategy. Our team and partner network are available to assist companies assessing whether their AI systems fall within Decree 142's scope and preparing for risk classification, incident response, and labelling obligations. Work we undertake includes AI regulatory compliance in Vietnam and ASEAN jurisdictions, risk classification assessments, incident response procedure design, and privacy and data law integration for AI systems.

Source: Government of Vietnam, Decree No. 142/2026/ND-CP implementing the Law on Artificial Intelligence, 30 April 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.