You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 21, 2025

AI Regulations Come into Focus in Vietnam’s Draft Law on Digital Technology Industry

Subscribe to Updates

Vietnam’s Ministry of Information and Communications has released the latest version of its draft Law on the Digital Technology Industry (DTI Law), marking a significant step toward comprehensive regulation of digital technologies and notably addressing artificial intelligence (AI). The draft law was deliberated in the National Assembly on January 6, 2025, and is expected to be adopted in May 2025. Once in effect, the law will modernize Vietnam’s existing information technology regulatory framework.

Background

Vietnam has been steadily building its regulatory framework for AI since January 2021, when the prime minister issued Decision No. 127/QD-TTg on the National Strategy for Research, Development, and Application of Artificial Intelligence until 2030. While various ministries have been tasked with issuing guidance documents and technical standards, Vietnam still lacks a comprehensive legal framework specifically addressing AI and digital technologies. The draft DTI Law aims to fill this gap by providing a structured approach to regulating the digital technology industry.

Scope and Definitions

The draft DTI Law establishes a broad framework governing digital technology industry activities, initiatives for developing the digital technology sector, and rights and obligations of organizations and individuals in the industry. The draft law also proposes the creation of various incentives, primarily in the form of tax benefits, for encouraging foreign direct investment, talent acquisition and development, and industry growth.

The draft law introduces several important definitions, particularly around AI, which is defined as digital technology that simulates human intelligence to generate content, forecasts, suggestions, and decisions based on human-determined goals. The draft distinguishes between different categories of AI systems:

  • High-risk AI systems: Those posing risks to health, safety, rights, and legitimate interests.
  • High-impact AI systems: Distinguished by their broad scope, large user base, and significant computational resources for training.
  • Standard AI systems: Basic systems that apply AI for automated analysis and decision-making. The draft DTI Law notably contains a “whitelist” of AI systems that are not considered high-risk if they are (1) designed to perform a task within a narrow scope, (2) intended to improve the outcomes of previously completed human activities, and (3) aimed at detecting and recommending deviations from previous results.

Requirements and Restrictions

The draft law implements several requirements for AI deployment, such as:

  • Principles for AI development, provision, implementation, and use, which must:
    • Serve human prosperity and happiness, be human-centered, and enhance productivity and work efficiency; ensure inclusive, fair, and nondiscriminatory access; respect ethical values, human rights, and interests; and protect privacy;
    • Ensure transparency, explainability, accountability, and control over AI algorithms and models, and not replace or surpass human control;
    • Ensure security and confidentiality;
    • Manage risks throughout the AI lifecycle;
    • Promote responsible innovation and encourage international cooperation; and
    • Apply environmentally friendly and energy-saving measures in the development, provision, and use of AI.
  • Mandatory labeling: All digital technology products created by AI systems must be clearly labeled for identification purposes.
  • Prohibited activities: The draft law explicitly prohibits the provision, implementation, or use of AI systems for:
    • Manipulation and fraud;
    • Discriminatory applications;
    • Invasion of privacy;
    • Human rights violations; and
    • Activities infringing on organizational or individual interests.

Next Steps

Although the final version of the DTI Law may differ from this draft, organizations operating or planning to operate in Vietnam’s digital technology sector should review their AI systems, prepare for compliance, and assess potential opportunities for receiving investment incentives.

For AI research and development, attention should be paid to the regulatory developments led by the Ministry of Science and Technology (MOST), which has also issued guiding principles for research and development of AI systems as well as standards on AI lifecycle processes, quality requirements, and sustainability. MOST is also revamping the Law on Science, Technology, and Innovation—the latest draft of which was released in December 2024 and includes guidance on research and development of AI systems.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

January 4, 2024
On December 25, 2023, Thailand’s Personal Data Protection Committee (PDPC) issued two notifications under sections 28 and 29 of the Personal Data Protection Act 2019 (PDPA) that address essential aspects and criteria for the cross-border transfer of personal data. These notifications are scheduled to come into effect on March 24, 2024. Key points in the notifications are outlined below. Adequate Data Protection Standards (Section 28) Unless otherwise provided by the PDPA, the destination country or international organization that receives the transferred personal data must have “adequate data protection standards,” as determined by the following factors: Legal measures and mechanisms. The destination country or international organization must have legal measures or mechanisms aligned with the personal data protection laws in Thailand. Specifically, the obligations of data controllers need to include providing appropriate security measures, implementing personal data protection measures that are suitable and that enable the exercise of data subjects’ rights, and establishing effective legal remedial measures. Regulatory authority. The presence of an agency or organization entrusted with the duties and authority to enforce laws and regulations related to personal data protection is also a critical factor. In addition, this notification empowers the Office of the PDPC to refer cases, either independently identified or proposed by a data controller, to the PDPC for adjudication. The PDPC retains the discretion to make decisions on a case-by-case basis or to establish a list of destination countries or international organizations that it considers to have adequate data protection standards. Binding Corporate Rules and Appropriate Safeguards (Section 29): In the realm of global data exchange, two prominent mechanisms have emerged as key enablers of secure and compliant transfer of personal data: Binding corporate rules (BCRs). Implementation of BCRs involves enforcing an approved policy for safeguarding personal data transferred among affiliated businesses or within the
Read More
January 2, 2024
Myanmar’s Ministry of Commerce (MOC) has released updated information regarding the registration fees for online retail businesses. The fees and criteria, which are included in the MOC’s Export/Import Newsletter No. 17/2023 dated December 28, 2023, are laid out below. Registration Fees The official registration fees vary depending on the applicant type: Companies or other commercial organizations: MMK 70,000 (approx. USD 33.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Small and medium enterprises (SMEs): MMK 50,000 (approx. USD 24) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Individual applicants: 30,000 MMK (approx. USD 14.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Validity Period Registrations approved from January 1, 2024, will be valid for two years from the date of grant. The requirement for online retail businesses to register their operations was announced in July 2023. Based on statements from the MOC, online retail businesses need to complete their registration by late January 2024 to avoid potential enforcement actions. Regarding SMEs, the MOC will also evaluate their SME registration certificate issued by the Agency Office under the Small and Medium Enterprises Development Law 2015. For assistance completing the registration process, or for more details on any aspect of online retail operations in Myanmar, contact Tilleke & Gibbins at [email protected].
Read More
December 15, 2023
As part of its membership in Lex Mundi, Tilleke & Gibbins has published an updated edition of its Guide to Doing Business in Thailand for 2023. This guide outlines the key factors for starting and operating a business in the Thai market. Issues covered include: Investment incentives Financial facilities Exchange controls Import and export regulations Structures for doing business Requirements for the Establishment of a Business Operation of the Business Cessation or Termination of the Business Labor legislation, relations, and supply Tax Immigration requirements This publication is part of Lex Mundi’s Country Guides series prepared by member firms in more than 100 jurisdictions worldwide. The guides serve as a useful resource for planning international business strategy and researching new markets. The full Guide to Doing Business in Thailand is available through the button below.
Read More
December 15, 2023
Vietnam’s new Law on Electronic Transactions No. 20/2023/QH15 (LOET 2023) was promulgated by the National Assembly on June 22, 2023, and will replace the existing Law on Electronic Transactions No. 51/2005/QH11 (LOET 2005) when it enters into effect on July 1, 2024. The LOET 2023 is aimed at facilitating transactions carried out in an electronic environment in all sectors. Derived from the fundamental principles of the LOET 2005, the LOET 2023 is similarly considered a framework law, developed based on the Model Law on E-Commerce of the United Nations Commission on International Trade Law (UNCITRAL). The main points of interest of the LOET 2023 are summarized below. 1. Scope of Application Unlike the LOET 2005, which explicitly excludes certain areas such as the issuance of certificates of land use rights and birth certificates from the scope of application, the LOET 2023 covers all areas without exception. However, the LOET 2023 will still not interfere with the regulations of substantive laws that stipulate the content, conditions, and forms of transactions in their respective areas (Article 1.2). The LOET 2023 also provides that it will only be applicable if other laws either allow or remain silent on the electronic execution of transactions; otherwise, if another law specifically does not permit a transaction to be carried out electronically, such law shall apply (Article 1.3). This emphasizes that the applicability of the LOET 2023 depends on the electronic readiness of specific sectors. 2. Enabling E-Transactions in All Sectors For traditional transactions or contracts to be legally valid, they typically require written documentation, the signatures of the involved parties, and the seals of organizations or companies, if required by substantive laws or common practice. Additionally, certain sectors mandate further steps like notarization or certification, such as in property transactions like house sales or inheritance
Read More