Vietnam has officially designated a specific list of high-risk artificial intelligence systems, mandating strict compliance, conformity assessments, and local presence requirements for developers and operators. According to Decision No. 33/2026/QD-TTg, issued by the Prime Minister on June 30, 2026, these regulations apply to AI applications in sectors including healthcare, education, banking, and transport. The new rules, which take effect August 15, 2026, aim to mitigate risks associated with automated decision-making where human oversight is absent.
Which AI Systems Are Classified as High-Risk?
Under Decision 33, the government identifies high-risk systems based on their potential impact on public services and individual rights. The covered sectors include:
- Education: Systems used for behavioral monitoring, learner ranking, or automated assessment.
- Healthcare: AI-assisted surgical systems and autonomous surgical robots.
- Banking: AI that autonomously executes electronic transactions or makes credit approval decisions.
- Transport: Thirty-one categories, including highly autonomous driving systems and critical infrastructure controls.
- Ethnic Affairs and Religion: Systems used for regulatory approvals, budget allocation, or classifying individuals by ethnicity or religion.
- Judicial Proceedings: Large-scale biometric identification used in public-interest civil cases.
The regulation applies a “risk-based” approach. If a system requires meaningful human intervention before a final decision is made, it may fall outside these strict compliance requirements.
What Are the Compliance Deadlines?
The implementation timeline depends on the sector and the current status of the technology. As outlined in the official guidance, most AI systems must meet all compliance obligations by March 1, 2027. However, a transitional period exists for specific industries. AI systems in healthcare, education, and finance that were already operational before August 15, 2026, have until September 1, 2027, to achieve full compliance.
How Must Providers Demonstrate Conformity?
Decision 33 mandates specific pathways for conformity, depending on the system’s risk profile. According to the regulation, providers must navigate one of three primary paths:
- Third-party certification: Mandatory for the highest-risk systems before they can be deployed.
- Self-assessment: Allowed for certain systems, provided the provider maintains comprehensive risk management and data quality documentation.
- Voluntary engagement: Providers may choose to engage a registered or recognized conformity assessment body to verify their systems.
Foreign providers must also meet local presence requirements, ensuring that there is a reachable entity in Vietnam responsible for the AI system’s performance and adherence to the Law on Artificial Intelligence and Decree No. 142/2026/ND-CP.
Organizations should conduct a thorough audit of their existing AI stack immediately. Mapping your systems against the six sectors listed in Decision 33 is the first step toward avoiding potential liability for damages, which remains strict even if the provider is fully compliant.
Frequently Asked Questions
Does the new law apply to all AI systems in Vietnam?
No. According to Decision 33, the heightened compliance obligations apply only to AI systems specifically included on the government’s high-risk list.
What happens if an AI system is already in use?
Existing systems must be brought into compliance by March 1, 2027. Systems in the healthcare, education, and finance sectors are granted an extension until September 1, 2027.
Are foreign AI providers affected?
Yes. Foreign providers must meet local presence requirements to operate high-risk AI systems within the country.
Are you managing AI deployment in Southeast Asia? Stay updated on shifting regulatory frameworks by subscribing to our legal intelligence newsletter or exploring our archive of technology law updates.
