Vietnam’s Law on Artificial Intelligence (No. 134/2025/QH15) establishes a regulatory sandbox for AI testing and includes sector-specific provisions for finance, healthcare, and other industries. But the sandbox is not operational yet. The operational rules required by Article 21 have not been issued, and no sandbox applications can be submitted until they are. The sector-specific picture is different: the State Bank of Vietnam has already released a draft circular on AI in banking, making finance the first sector with AI-specific regulation beyond the general law.
This article maps what exists, what is pending, and what practitioners in each sector should do now.
What Does Vietnam’s AI Regulatory Sandbox Look Like?
Article 21 of the AI Law establishes a “controlled testing environment” where organizations can test AI systems under regulatory supervision with partial or full exemptions from standard compliance requirements. The sandbox is designed to support innovation while maintaining safety guardrails, particularly for high-risk systems that would otherwise require conformity assessment before deployment.
The statutory framework is clear. What is missing is every operational detail.
What We Know from the Law
Article 21 authorizes the Government to establish the sandbox, set participation criteria, define testing conditions, and determine exemption scopes. Article 25 complements this with “innovation promotion” mechanisms including preferential policies for AI organizations, tax incentives, and startup support. Decision 367/QD-TTg (March 3, 2026) includes sandbox operational rules in the work program for the main implementing decree. [Source: Law 134/2025/QH15, Art. 21, Art. 25; Decision 367/QD-TTg]
What Is Not Yet Known
No application process exists. No duration, conditions, or participation criteria have been published. No sandbox has been established. The implementing decree currently in consultation is expected to contain the sandbox operational rules, but no timeline for publication has been announced. The Law on Digital Technology Industry (No. 71/2025, effective January 1, 2026) also has sandbox provisions that may complement or overlap with the AI Law sandbox. The relationship between these two frameworks is unclear pending implementing regulations. [Source: OneTrust, March 13, 2026; DataGuidance, March 11, 2026]
How Does Vietnam’s Sandbox Compare?
The EU AI Act requires member states to establish at least one AI regulatory sandbox by August 2, 2026 (Art. 53-54). Spain launched the first EU sandbox in 2022. Vietnam’s sandbox exists in statute but cannot function until the implementing decree arrives. For a full comparison, see our Vietnam vs EU AI Act comparison.
What AI Rules Apply to Financial Services in Vietnam?
Finance is the most regulated sector for AI in Vietnam. Three layers of regulation create a regulatory stack that practitioners must account for simultaneously.
Layer 1: The AI Law (General)
All AI systems in financial services must comply with the general AI Law provisions: risk classification (Art. 9), transparency (Art. 11), and liability (Art. 29). Financial AI systems that handle credit decisions, insurance underwriting, or fraud detection are likely high-risk under the forthcoming PM decision, based on the draft criteria and the sector’s 18-month transition period (Art. 35). The extended transition signals regulatory awareness that financial AI carries elevated risk. [Source: Law 134/2025/QH15, Art. 6, Art. 9, Art. 35]
Layer 2: SBV Draft Circular on AI in Banking
The State Bank of Vietnam (SBV) launched a public consultation on a draft circular for AI in banking in February 2026. This is the first sector-specific AI regulation from a Vietnamese financial regulator. The draft requires:
- Banks and e-wallet providers must notify customers in advance when AI systems interact with them directly (chatbots, automated decisions)
- Banks must notify customers before using AI for emotion recognition or biometric classification
- Banks are prohibited from using AI to exploit customer weaknesses or pressure them into unsuitable financial products
- Human oversight is mandated for AI systems in banking
- Impact assessments are required for high-risk banking AI applications
- Operational safety, data management, incident handling, and risk classification rules are included
- A transitional compliance period is built in
The circular explicitly references the AI Law and international standards. It has not been finalized. Source: [DataGuidance, February 16, 2026; Vietnam Law Magazine, February 21, 2026; OpenGov Asia, February 21, 2026]
Layer 3: Fintech Regulation (Decree 94/2025/ND-CP)
Vietnam’s first comprehensive fintech regulation took effect in 2025. Decree 94 establishes licensing procedures for fintech companies, a regulatory sandbox for testing new financial models, and data and cybersecurity compliance requirements. It covers e-wallets, online lending, and blockchain-based tools. AI-powered fintech products fall under both the AI Law and Decree 94. Source: [Le Tran Law, November 19, 2025]
What Is CIC Doing with AI Credit Scoring?
The National Credit Information Center (CIC) is modernizing Vietnam’s credit scoring system with AI. CIC manages a database of over 54.7 million customers and presented “Reshaping Vietnam’s Credit Scoring System with Artificial Intelligence” at the Vietnam Leadership Forum in January 2026. On March 17, CIC launched the K40 Personal Credit Score Report, and the day before, launched a P2P lending credit information connection system under Decree 94. CIC also signed a cybersecurity cooperation agreement with the Ministry of Public Security’s Cyber Security Department (A05) on March 17. [Source: vietnam.vn via Thoi Bao Ngan Hang, January 22, 2026; March 12, 2026; March 18, 2026]
What AI Rules Apply to Healthcare in Vietnam?
Healthcare AI operates under the general AI Law with a longer transition period (18 months, until September 1, 2027) and several sector-specific regulatory touchpoints.
Regulatory Framework
No standalone AI medical device classification framework exists in Vietnam. The general AI Law risk classification applies, but sector-specific implementing guidance for health AI is pending (Art. 6(4)). Decree 102 (2025) regulates digital medical data, covers AI-processed health data, and has extraterritorial application. Resolution 72-NQ/TW identifies digital transformation in healthcare as a strategic priority for 2026-2030. Source: [Baker McKenzie via Lexology, June 9, 2025; vietnam.vn, February 22, 2026]
Vietnam in the Global Health AI Network
Vietnam joined the HealthAI Global Regulatory Network in October 2025 as a “Pioneer Country.” The National Health Information Center (NHIC) signed a strategic cooperation agreement with HealthAI, aligning Vietnam with global health AI regulatory standards. This positions Vietnam to adopt international best practices for health AI safety and effectiveness as its regulatory framework develops. Source: [HealthAI Agency, October 27, 2025]
VinBrain: Vietnam’s Flagship Health AI Company
VinBrain’s DrAid platform is the most prominent Vietnamese health AI product. DrAid Chest XR received FDA clearance on September 2, 2022, making it the first AI product for X-ray diagnostics in Southeast Asia with FDA clearance. It screens for 52 abnormalities with 91% accuracy and is deployed to over 100 hospitals. DrAid CT Liver Cancer Detection is also in deployment. Source: [NVIDIA case study, February 7, 2023; Vietnam News, October 3, 2022]
The healthcare generative AI market in Vietnam was valued at USD 20 million in 2025, driven by digitalization of healthcare infrastructure, electronic medical records, and telemedicine. [Source: Ken Research, December 2025]
What Other Sector-Specific AI Provisions Exist?
E-Commerce
The E-Commerce Law 2025 (No. 122/2025, effective July 1, 2026) creates dual oversight for AI-powered e-commerce. Platforms using AI for recommendations, pricing, or content moderation must comply with both the E-Commerce Law and the AI Law. This applies to livestreaming platforms with commerce features, social commerce networks, and affiliate marketing platforms. The e-commerce sector is valued at USD 26-28 billion (2025) and projected to reach USD 60 billion by 2030. Source: [ConventusLaw, February 19, 2026; Vietnam Briefing, December 16, 2025]
Agriculture
Vietnam’s AI in agriculture market was valued at USD 10.41 million in 2025, projected to reach USD 43-48 million by 2033-2034 (CAGR 18.6%). Agriculture accounts for approximately 12% of GDP and 30% of the workforce, making agricultural AI a national priority. Dien Bien province established a Center for Innovation and Application of AI in Agriculture in January 2026. No sector-specific AI regulations for agriculture have been identified in available English or Vietnamese sources as of March 2026. General AI Law provisions apply, with most agricultural AI systems likely falling into the low-risk tier. [Source: IMARC Group, 2026; vietnam.vn, January 15, 2026]
Education
Education AI systems receive the extended 18-month transition period (until September 1, 2027) alongside healthcare and finance. The AI Law requires educational AI to be “appropriate for age characteristics” and to prevent risks (Art. 6(3)). No sector-specific AI regulation for education has been identified in available sources as of March 2026.
Defense and Security
AI systems used exclusively for national defense, security, or cryptographic purposes are exempt from the AI Law entirely (Art. 1). These are governed by separate legislation.
How Do Sector Rules Interact with the General AI Law?
Every sector-specific regulation layers on top of the AI Law, not as a replacement. A bank deploying an AI credit scoring system must comply with all of the following simultaneously:
- AI Law (Law 134/2025) for risk classification, transparency, liability, and prohibited practices
- SBV circular (when finalized) for banking-specific AI requirements
- Decree 94/2025 for fintech-specific licensing and sandbox rules
- PDPL (Law 91/2025) for personal data protection, including AI-processed financial data
- Cybersecurity Law 2025 (No. 116/2025, effective July 1, 2026) for data localization and security
This multi-layer stack is unique to Vietnam. No other ASEAN jurisdiction has this density of AI-related regulation across general, sector-specific, data protection, and cybersecurity dimensions. For practitioners, the compliance planning challenge is understanding which layer adds which obligation and which enforcement body oversees which provision.
For a full breakdown of the implementing decrees shaping each layer, see the Vietnam Implementing Decrees Tracker.
What Should Companies Do Now?
Despite the gaps in implementing regulations, several actions are available immediately.
- Map your AI systems to sectors. Identify which of your AI applications fall into the 18-month transition sectors (healthcare, education, finance) versus the 12-month general deadline (March 1, 2027). This determines your compliance timeline.
- Monitor the SBV circular. If you operate in banking or fintech, the SBV draft circular is the nearest sector-specific regulation. Prepare for customer notification requirements, human oversight mandates, and impact assessments.
- Prepare documentation now. Technical documentation and operational logs (Art. 14) will be required for high-risk systems. Building these workflows takes months. Start before the implementing decree forces a deadline.
- Audit for prohibited practices. Article 7’s six categories are enforceable now. Check whether any of your AI applications could exploit customer vulnerabilities, block human oversight, or generate undisclosed AI content.
- Do not wait for the sandbox. The sandbox has no timeline. Build your compliance program assuming full obligations will apply. If the sandbox becomes available later, it is a bonus, not a plan.
For the complete overview of Vietnam’s AI Law, see our Vietnam AI Law guide. For the risk classification system that determines your obligations, see Vietnam AI Risk Classification.
Reg Intel is not a law firm and does not provide legal services. This content is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for jurisdiction-specific guidance.
Last verified: March 26, 2026
Reg Intel is not a law firm and does not provide legal services. This content is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for jurisdiction-specific guidance.
Last verified: March 26, 2026