Vietnam Artificial Intelligence Law: Cybersecurity requirements and penalties businesses should know
- Thanh Hoang
- 4 hours ago
- 14 min read
Disclaimer: This article is provided for general informational and reference purposes only. It does not constitute legal advice. Applicable obligations and penalties may vary depending on the specific conduct, type of data, role of the business, industry, and severity of the consequences. Businesses should review the original legal documents and consult legal counsel, an internal legal department, or a compliance specialist before making compliance decisions.
Vietnam’s Artificial Intelligence Law does not only regulate the development and use of AI. It is also directly connected to cybersecurity, data protection, access control, third-party risk management, and incident response.
Law No. 134/2025/QH15 was promulgated on December 10, 2025, took effect on March 1, 2026, and consists of 8 chapters and 35 articles. It establishes a dedicated legal framework for the development, provision, deployment, and use of artificial intelligence systems in Vietnam.
For businesses, compliance with the AI Law should not be limited to labeling AI-generated content. A comprehensive compliance program should also answer the following questions:
What data is the AI system processing?
Are employees uploading customer data to public AI tools?
Who can access AI models, APIs, and internal data repositories?
What actions can the AI system perform automatically?
How does the AI vendor store and use business data?
Can the organization detect prompt injection or system abuse?
Can the system be stopped and investigated when an incident occurs?
An AI system may function accurately but still expose the organization to violations of the AI Law, personal data protection rules, cybersecurity obligations, and other sector-specific regulations if it is not properly secured.
Is Vietnam’s Artificial Intelligence Law related to cybersecurity?
The answer is yes, directly.
The law prohibits the unlawful collection, processing, or use of data for the development, training, testing, or operation of AI systems in violation of rules on data, personal data protection, intellectual property, and cybersecurity.
It also prohibits conduct such as:
Taking control of or misappropriating AI systems.
Disabling or interfering with human oversight.
Concealing mandatory information.
Using AI to infringe the lawful rights and interests of organizations or individuals.
Using AI to manipulate, deceive, or cause serious harm.
From a technical perspective, a modern AI system often consists of multiple layers:
An AI model.
A chatbot or application interface.
APIs.
Internal data repositories.
Vector databases used for retrieval-augmented generation.
User and service accounts.
Third-party plugins and tools.
Cloud infrastructure.
Logging and monitoring systems.
AI agents with permission to perform actions.
A vulnerability in any of these components may result in data leakage, account compromise, manipulated outputs, or unauthorized actions.
For this reason, secure AI deployment should be treated as part of the organization’s cybersecurity program rather than as a standalone innovation project.
Which businesses need to pay attention?
The law does not only affect companies that develop their own AI models.
An organization should assess its obligations and risks when it:
Uses chatbots for customer service.
Uses AI to review job applications.
Integrates AI into CRM or ERP systems.
Uses AI coding assistants.
Allows employees to use generative AI tools.
Uses AI to analyze customer data.
Uses AI for scoring, evaluation, or decision-making.
Connects AI agents to email, calendars, files, or business systems.
Purchases AI solutions from external vendors.
Even when an organization only purchases an AI solution, it still needs to control the intended use, data inputs, access permissions, automation level, and incident responsibilities.
For example, an employee who uploads a contract to a public chatbot for summarization may expose confidential business information or personal data. An AI agent connected to email and CRM systems may be abused to distribute sensitive information or alter records after a prompt injection attack.
The 3 AI risk levels
Vietnam’s Artificial Intelligence Law classifies AI systems into three levels:
High-risk AI systems.
Medium-risk AI systems.
Low-risk AI systems.
Classification is based on factors such as potential impact on human rights, safety, security, the number of affected users, and the scale of consequences.
Providers are responsible for classifying their systems and notifying the competent authority when a system falls into the medium-risk or high-risk category.
The risk level should not be determined only by the name of the technology. The same model may produce very different risks when deployed for different purposes.
An internal chatbot used to search company policies usually creates less risk than an AI system used for:
Credit scoring.
Candidate screening.
Biometric identification.
Medical decision support.
Student performance assessment.
Customer classification.
Control of critical devices.
Decisions affecting individual rights or benefits.
For high-risk AI systems, the law introduces mandatory conformity assessment requirements before deployment and emphasizes incident management and remediation.
Businesses may also review IPSIP’s article on high-risk AI systems subject to stricter regulation.
8 common cybersecurity risks when using AI
1. Data leakage through AI chatbots
Employees may unintentionally upload the following information to AI tools:
Customer lists.
Employee records.
Unpublished contracts.
Source code.
Financial reports.
Login credentials.
Personal data.
Trade secrets.
If the organization does not know where the data is stored, whether it is used to improve the model, or who can access it, sensitive information may leave the organization’s control.
Businesses should also review IPSIP’s analysis of data leakage risks when using AI.
2. Prompt injection
Prompt injection is a technique that uses malicious input to make an AI system ignore its original instructions or perform unintended actions.
This risk becomes particularly serious when AI is connected to:
Email.
Internal documents.
Databases.
CRM systems.
Administrative tools.
Payment systems.
Business APIs.
Prompt injection may be direct, where a user enters a malicious command, or indirect, where harmful instructions are embedded in websites, emails, documents, or external data sources accessed by the AI.
3. System prompt and RAG data leakage
AI systems may expose:
Internal instructions.
Application configuration.
Content stored in RAG repositories.
Data belonging to other users.
Secrets embedded in prompts.
Details about connected tools and permissions.
Organizations should not rely only on instructions such as “do not disclose confidential information.” Access controls must also be enforced at the application, API, and database layers.
4. Unsafe AI output handling
AI-generated output should not be trusted by default.
If AI output is sent directly into:
Operating system commands.
Database queries.
HTML.
Email systems.
Code execution tools.
Internal APIs.
an attacker may manipulate the system into performing unauthorized actions.
AI output should therefore be validated, sanitized, and restricted before it is consumed by downstream systems.
5. Data poisoning
Training data or RAG content may be modified to manipulate AI behavior.
An attacker may:
Insert fake documents.
Modify internal policies.
Embed hidden instructions in files.
Corrupt reference data.
Manipulate AI search results.
Businesses should control data sources, modification rights, version history, and the integrity of documents used by AI systems.
6. API key exposure
AI API keys are commonly exposed through:
Source code.
Git repositories.
Configuration files.
Automation scripts.
Email or messaging applications.
Employee devices.
An attacker may use a stolen key to access services, generate unauthorized charges, retrieve data, or impersonate the application.
7. Excessive AI agent permissions
AI agents may be authorized to:
Read and send emails.
Create or delete files.
Update CRM records.
Call internal APIs.
Query databases.
Initiate payment requests.
Manage user accounts.
If these permissions are too broad, a malicious prompt or configuration error may cause serious consequences before a human can intervene.
8. Shadow AI
Shadow AI refers to employees using AI tools that have not been assessed or approved by the organization.
The business may not know:
Which vendor receives the data.
Which personal account is being used.
How long the data is retained.
Whether the vendor uses the data for training.
Whether data can be recovered when an employee leaves.
Businesses may review IPSIP’s article on the risks of Shadow AI.
One AI incident may violate multiple laws
Businesses should not assume that conduct involving AI will be assessed only under the Artificial Intelligence Law.
In practice, one incident may simultaneously involve:
The Artificial Intelligence Law.
The Personal Data Protection Law.
Cybersecurity legislation.
The Data Law.
Intellectual property law.
The Civil Code.
Administrative penalties in the information technology sector.
Criminal law, where criminal conduct is involved.
Scenario | Potential legal exposure |
An employee uploads customer data to a public AI tool | Internal policy violations, personal data protection obligations, and confidentiality responsibilities |
A chatbot exposes customer records | Personal data penalties, compensation claims, and remediation obligations |
An AI agent is compromised | Responsibility for system security, access control, and incident response |
Personal data is purchased or sold for AI training | Serious penalties under personal data protection law |
Data is transferred abroad through an AI vendor without proper compliance | Penalties related to cross-border personal data transfers |
AI is used to create fraudulent deepfakes | Administrative penalties, compensation, or criminal liability |
Copyrighted data is used unlawfully | Intellectual property disputes and liability |
Human oversight is not maintained | Risks related to AI governance obligations and liability for resulting harm |
What are the penalties for violating the Artificial Intelligence Law?
Businesses should avoid using one single number and describing it as the universal “AI Law penalty.”
Law No. 134/2025/QH15 is not a standalone penalty schedule under which every AI-related violation receives the same fine.
Depending on the conduct, an organization may be required to:
Remedy the violation.
Restrict the operation of the AI system.
Suspend or terminate an AI service.
Withdraw or correct generated content.
Compensate affected parties.
Pay penalties under sector-specific legislation.
Face criminal liability if the conduct constitutes an offense.
To determine the applicable penalty, the following questions must be answered:
What specific conduct occurred?
What role did the business perform?
What type of data was affected?
Was data sold or transferred across borders?
What actual damage occurred?
Was there intent, concealment, or unlawful profit?
Which sector-specific enforcement rule applies?
Penalties related to Personal Data Protection
Vietnam’s Personal Data Protection Law No. 91/2025/QH15 was promulgated on June 26, 2025, and took effect on January 1, 2026.
This law is particularly relevant to AI systems because many of them process customer files, employee information, behavioral data, audio, images, and biometric information.
Under Article 8 of the Personal Data Protection Law, organizations may face the following maximum fines.
1. Buying or selling personal data
The maximum fine for buying or selling personal data may be up to 10 times the revenue obtained from the violation.
For AI businesses, this risk may arise when they:
Purchase customer datasets from unclear sources.
Acquire third-party data for model training.
Sell or exchange user data.
Commercialize personal data unlawfully.
2. Cross-border transfers of personal data
Organizations that violate requirements relating to cross-border personal data transfers may face a maximum fine of up to 5% of the previous year’s revenue.
This issue is especially important when businesses use:
Foreign chatbots.
AI APIs hosted outside Vietnam.
International cloud platforms.
Overseas analytics or logging services.
Vendors that rely on subprocessors in multiple jurisdictions.
Businesses should not only review the location of the vendor’s headquarters. They should also identify where data is stored, backed up, processed, and accessed.
3. Other personal data violations
For other personal data protection violations, the maximum fine may reach VND 3 billion for organizations.
The maximum fine applicable to individuals is generally half the amount applicable to organizations for the same conduct.
In addition to administrative penalties, individuals or organizations may face criminal liability and may be required to compensate affected parties where damage occurs.
These figures represent maximum penalties. They do not mean that every violation will automatically receive the highest possible fine. The actual penalty will depend on the nature, severity, consequences, aggravating circumstances, and applicable implementing rules.
AI scenarios that may trigger Data Protection penalties
Employees Upload Customer Data to a Chatbot
An employee uploads a customer list to a public AI tool for analysis.
If the business lacks a lawful basis, fails to inform affected individuals, does not control the purpose of processing, or causes an unlawful cross-border transfer, several legal obligations may arise at the same time.
An AI system exposes user records
A chatbot is connected to an internal data repository but is incorrectly configured, allowing one user to retrieve another user’s information.
In addition to technical remediation, the organization may need to determine the scope of affected data, preserve evidence, perform notification obligations, and compensate affected individuals if damage occurs.
Using data of unclear origin for AI training
A business purchases a user dataset for model training without verifying how the data was collected or whether it can lawfully be used.
This may create serious risk if the activity is considered the unlawful buying or selling of personal data.
An AI vendor transfers data overseas
A business contracts with an AI vendor without knowing which countries process the data, which subprocessors are involved, or how long the data is retained.
The fact that the vendor processes the data does not automatically eliminate the responsibilities of the organization that controls or provides the data.
The real cost is not limited to fines
For many organizations, the fine may not be the largest consequence.
An AI-related incident may also result in:
Investigation and incident response costs.
Legal advisory costs.
Business interruption.
Suspension of an AI product.
Customer notification costs.
Compensation claims.
Contractual disputes.
Customer loss.
Reputational damage.
System redevelopment costs.
Loss of competitive advantage due to exposed trade secrets.
If the AI system is involved in financial, recruitment, healthcare, or essential service decisions, a security failure may directly affect the rights and interests of a large number of individuals.
Turning legal obligations into cybersecurity controls
Compliance requirement | Recommended cybersecurity control |
AI system inventory | Maintain an inventory of tools, models, APIs, data, and responsible owners |
Risk classification | Assess impact, sensitive data exposure, and potential harm |
Data protection | Use encryption, access control, DLP, and input filtering |
Transparency | Provide AI disclosures, retain logs, and manage versions |
Human oversight | Require approval for high-impact actions and maintain emergency stop mechanisms |
Incident management | Establish detection, containment, investigation, recovery, and notification procedures |
Vendor management | Review contracts, APIs, data locations, and subprocessors |
Accountability | Maintain assessment records, testing results, and remediation evidence |
How should businesses protect AI data?
Businesses should divide data into at least three categories.
Data approved for AI use
This includes public information or data specifically approved for a defined AI tool and purpose.
Data restricted to internal AI systems
This may include business documents, operational data, and restricted information protected by enterprise accounts, encryption, and access controls.
Data that must not be entered into public AI tools
This may include:
Passwords.
API keys.
Sensitive personal data.
Customer records that have not been properly processed.
Trade secrets.
Critical source code.
Unpublished financial information.
Data restricted by contract.
A written policy alone is not sufficient. Businesses should also consider technical controls such as:
Data Loss Prevention.
AI proxy or secure gateway solutions.
Browser controls.
Single sign-on.
Blocking unapproved personal AI accounts.
Sensitive data masking.
Activity logging.
Alerts when users upload files to AI systems.
Do businesses need to Pentest AI systems?
It would be inaccurate to state that every business is legally required to pentest every AI tool.
However, penetration testing is an important way to verify whether security controls work in practice, especially when the system:
Processes personal data.
Accesses internal information.
Connects to business systems.
Can perform automated actions.
Serves a large number of users.
Affects individual rights.
Falls into a high-risk category.
Operates in finance, healthcare, education, or critical infrastructure.
AI penetration testing may assess:
Prompt injection.
Jailbreak techniques.
System prompt leakage.
Unauthorized access to RAG data.
Access control bypass.
API key leakage.
Plugin abuse.
AI agent compromise.
Unsafe output handling.
Supply chain attacks.
Logging and alerting capabilities.
Emergency shutdown mechanisms.
Businesses may review IPSIP’s article on AI system penetration testing and the report Securing AI Systems: A Playbook for Security Leaders.
How does AI Pentesting support compliance?
A penetration test is not a legal certification and does not prove that an organization is fully compliant.
However, testing results may help the business:
Identify vulnerabilities before exploitation.
Verify access control mechanisms.
Assess data leakage risks.
Test resistance to prompt injection.
Identify excessive AI agent permissions.
Evaluate logging and traceability.
Prioritize remediation activities.
Demonstrate that the organization proactively assessed risk.
When an incident occurs, assessment records, penetration testing reports, and remediation evidence may support discussions with senior management, customers, business partners, auditors, or competent authorities.
The key point is that testing must be followed by remediation. A report that identifies vulnerabilities without an action plan will not materially reduce risk.
AI incident response process
AI incidents may include:
A chatbot disclosing confidential data.
A successful prompt injection attack.
Malicious documents being inserted into a RAG repository.
An AI agent sending emails or deleting data without authorization.
A stolen API key.
A compromised vendor account.
Data being transferred to an unexpected third party.
AI-generated content causing serious consequences.
The response process should include the following stages.
Detection
Monitor logs, alerts, abnormal behavior, and user reports.
Containment
Suspend the model, disable plugins, revoke API keys, lock accounts, or reduce AI agent permissions.
Evidence Preservation
Retain prompt history, outputs, access logs, configuration data, and model version information.
Impact Assessment
Determine what data was exposed, who was affected, and what actions were performed.
Remediation
Close the vulnerability, replace keys, correct permissions, clean data sources, and retest the system.
Recovery
Return the system to operation only after confirming that the risk has been controlled.
Compliance Improvement
Update policies, contracts, employee training, and monitoring procedures.
AI security and compliance checklist
1. Governance
Maintain an inventory of all AI systems.
Assign an owner to each system.
Document the intended purpose.
Classify the risk level.
Identify Shadow AI.
Establish an AI governance committee or responsible function.
2. Data protection
Define which data may be used with AI.
Identify the lawful basis for personal data processing.
Confirm data storage locations.
Review cross-border data transfers.
Define retention periods.
Control access to RAG repositories.
Confirm whether vendors use customer data for model training.
3. Identity and access management
Use centralized authentication.
Enable multi-factor authentication.
Assign permissions by role.
Apply the principle of least privilege.
Manage and rotate API keys.
Revoke access when employees leave or change roles.
4. Application security
Test for prompt injection.
Validate and sanitize inputs.
Validate AI-generated outputs.
Limit AI agent permissions.
Require human approval for high-impact actions.
Separate testing and production environments.
Manage third-party plugins, libraries, and models.
5. Monitoring and incident response
Log prompts, outputs, and actions.
Monitor unusual behavior.
Configure data leakage alerts.
Maintain emergency shutdown capabilities.
Establish an AI incident response process.
Conduct AI incident simulations.
Preserve remediation evidence.
6. Vendor management
Assess vendor security before signing a contract.
Identify data processing locations.
Review subprocessors.
Define incident notification timelines.
Require vendor support during investigations.
Define data deletion and return requirements.
Reassess vendors periodically.
Where should businesses start?
Businesses can implement AI security and compliance in three stages.
Stage 1: Gain visibility
Inventory all AI tools.
Identify the data being used.
Detect Shadow AI.
Identify systems with significant access permissions.
Stage 2: Establish controls
Issue an AI usage policy.
Classify data.
Implement access controls.
Manage API keys.
Enable logging.
Control vendors.
Build an incident response process.
Stage 3: Validate effectiveness
Conduct security assessments.
Perform AI penetration testing.
Test for data leakage.
Run incident simulations.
Reassess systems after significant changes.
Preserve evidence of remediation.
Businesses may also review IPSIP’s guidance on AI governance for Vietnamese enterprises.
How can IPSIP help businesses secure AI systems?
Compliance with the AI Law and personal data protection requirements cannot be achieved through policy documents alone. Businesses also need to determine whether technical security controls can actually prevent attacks and data leakage.
IPSIP can support businesses in assessing components related to AI systems, including:
Web applications and APIs.
Authentication and authorization mechanisms.
Data repositories and RAG systems.
Resistance to prompt injection.
System prompt leakage risks.
API key management.
AI agent permissions.
Third-party plugins and integrations.
Logging and alerting capabilities.
Incident response procedures.
Assessment results can help the organization:
Identify vulnerabilities before an incident occurs.
Prioritize remediation based on risk.
Reduce personal data leakage risks.
Verify the effectiveness of security controls.
Create technical records for governance and compliance.
Strengthen trust with customers and partners.
Businesses can review IPSIP’s cybersecurity assessment services for enterprises.
Conclusion
Vietnam’s Artificial Intelligence Law shows that AI adoption cannot be separated from cybersecurity and data protection.
An AI system deployed without adequate controls may expose an organization to:
Data leakage.
Business interruption.
Compensation claims.
Administrative penalties.
System suspension.
Customer disputes.
Reputational damage.
In particular, the Personal Data Protection Law provides maximum penalties of up to 10 times the revenue obtained from the unlawful buying or selling of personal data, up to 5% of the previous year’s revenue for certain cross-border data transfer violations, and up to VND 3 billion for other violations committed by organizations.
Businesses should not wait until an incident occurs before assessing their AI systems. AI inventory, data classification, access control, vendor assessment, penetration testing, and incident response exercises are essential steps for reducing technical, legal, and business risks.
---------------------
Referral
Luật Trí tuệ nhân tạo số 134/2025/QH15: https://vanban.chinhphu.vn/?classid=1&docid=216334&pageid=27160&typegroupid=3
Quyết định số 33/2026/QĐ-TTg về Danh mục hệ thống AI có rủi ro cao: https://vanban.chinhphu.vn/?classid=1&docid=218658&pageid=27160&typegroupid=5
Luật Bảo vệ dữ liệu cá nhân số 91/2025/QH15: https://vanban.chinhphu.vn/?classid=1&docid=214590&pageid=27160
Giới thiệu các nội dung chính của Luật Trí tuệ nhân tạo: https://xaydungchinhsach.chinhphu.vn/nhung-noi-dung-dang-chu-y-cua-luat-tri-tue-nhan-tao-119260212091614393.htm
Luật Bảo vệ dữ liệu cá nhân: quy định về xử phạt: https://xaydungchinhsach.chinhphu.vn/nghiem-cam-mua-ban-du-lieu-ca-nhan-muc-xu-phat-vi-pham-hanh-chinh-trong-linh-vuc-bao-ve-du-lieu-ca-nhan-119250728102154903.htm
OWASP Top 10 for Large Language Model Applications:
https://owasp.org/www-project-top-10-for-large-language-model-applications/
OWASP GenAI Security Project: https://genai.owasp.org/
NIST AI Risk Management Framework (AI RMF 1.0):
MITRE ATLAS™ – Adversarial Threat Landscape for Artificial Intelligence Systems: https://atlas.mitre.org/
Legal disclaimer: This article is provided for general reference purposes only. It is not legal advice and does not replace a review of the original legal documents. The penalties mentioned above are maximum penalties under personal data protection regulations and are not default penalties for every AI-related violation. Businesses should consult legal counsel or a compliance specialist to determine the obligations applicable to each specific AI system.
Comments