Vietnam tightens AI and data laws, leaving ASEAN divided

The Philippines exemplifies the fragmented AI governance landscape within ASEAN, with regulatory efforts dispersed across multiple agencies that often have overlapping mandates rather than a cohesive national framework. This scattered approach mirrors the broader regional pattern where ASEAN provides non-binding guidelines, such as the 2024 ASEAN Guide on AI Governance and Ethics and the 2025 expanded guidance on Generative AI, leaving implementation largely to the discretion and capacity of individual member states. Consequently, while the Philippines and its neighbors are moving toward AI regulation, the lack of unified enforcement mechanisms results in a patchwork of policies that vary significantly in scope and rigor.

ASEAN’s AI governance is heavily influenced by global regulatory superpowers, with the European Union’s binding AI Act serving as a prominent model that contrasts with the more innovation-driven approaches of the United States and China. Member states, including the Philippines, adapt these external frameworks according to their domestic priorities and institutional capacities, creating a mosaic of regulatory strategies across the region. This dynamic interplay between global influences and local contexts underscores the complexity of establishing consistent AI oversight in Southeast Asia.

The reliance on soft-law instruments within ASEAN, while offering flexibility, engenders uneven levels of protection and accountability for AI stakeholders across member countries. Without enforceable laws, the risk-based governance principles articulated in regional guidelines translate into disparate outcomes, where individuals, firms, and public institutions may experience vastly different safeguards depending on national implementation. This regulatory divergence highlights the challenge of balancing sovereignty with the need for coherent AI governance in a rapidly evolving technological landscape.

By mid-2026, Vietnam has aggressively tightened its data sovereignty framework through the draft Law on Data Security, which permanently bans cross-border transfers of 'core data' and requires Ministry of Public Security (MPS) approval for 'important data' transfers. This law classifies data into four tiers—ordinary, internal, important, and core—with thresholds for important data including citizen information covering 100,000 or more individuals, a scale that encompasses many multinational consumer platforms operating in Vietnam. This categorization effectively broadens the scope of data localization, compelling foreign companies to navigate stringent controls over vast swaths of user data.

The Ministry of Public Security’s expanded authority mandates that all outbound transfers of important data must be preceded by detailed impact assessments, while core data transfers require full prior approval, intensifying compliance burdens for multinational firms. Under existing laws, dossiers must be submitted within tight deadlines—15 days for important data—and the new draft appears to further tighten these requirements, creating a complex regulatory environment. This shift has raised concerns among businesses about operational feasibility and regulatory clarity.

Vietnam’s rapid legislative push, marked by the introduction of the fourth major data statute within two years, underscores Hanoi’s assertive approach to data sovereignty. However, this flurry of overlapping laws has sparked criticism from within the government’s own review process, warning that instead of clarifying the legal landscape, the new Law on Data Security may exacerbate legal ambiguities and compliance uncertainties. Such concerns highlight the delicate balance Vietnam faces between strengthening national security and maintaining an attractive environment for foreign investment.

Vietnam’s National Data and Digital Transformation Strategies for 2026–2030, approved under the guidance of Deputy Prime Minister Dung, set an ambitious agenda to fully digitize public services and administrative records by 2030, aiming for 100% digitization of eligible procedures and universal electronic health records. Central to this vision is a robust emphasis on AI development, with targets to cultivate at least 150 “Make in Vietnam” AI products and equip public servants with AI tools, thereby embedding artificial intelligence deeply into governance and public administration.

The strategies envision transforming data into a strategic national resource by building a unified, secure, and interconnected data ecosystem featuring national and sector-specific databases, shared-use platforms, and advanced computing infrastructure governed by uniform standards. By 2030, Vietnam plans to enact legal reforms including mandatory data audits for large agencies, establish three national data centers, and foster a vibrant data economy with over 1,000 data enterprises and multiple data exchanges, positioning data as a key driver of economic growth and digital transformation.

Looking beyond 2030, Vietnam aspires by 2045 to rank among the world’s top 30 countries in data governance and AI development, aiming to become a major regional hub for cross-border data storage and processing. This long-term vision includes full integration of data analytics and AI into governance frameworks while ensuring national data sovereignty and security, reflecting a strategic commitment to not only lead Southeast Asia’s digital economy but also to secure a prominent global position in the evolving AI and data landscape.

Vietnam’s 2026–2030 digital blueprint places AI and data at the core of national development and economic growth, seeking to leverage these technologies to enhance digital infrastructure and elevate the country as a leading digital economy in the region. This strategic prioritization underscores a shift from traditional growth models to innovation-driven progress, signaling Vietnam’s intent to harness AI and data as foundational pillars for sustainable and inclusive development.

By early 2026, Vietnam boldly enacted Law 134/2025/QH15, a state-led, top-down AI regulatory framework that stands out in Southeast Asia for its assertive approach to sovereign control over data flows and AI risks. This law sharply contrasts with ASEAN’s more voluntary, principle-based guidelines, potentially sparking a regional regulatory competition as investors might gravitate toward less regulated markets, risking a 'race to the bottom' in AI governance.

Vietnam’s AI law introduces a nuanced three-tier risk-based classification system that governs AI research, development, deployment, and use across domestic and foreign entities, with stringent oversight on high-risk applications in critical sectors like healthcare and education to safeguard human rights, data security, and safety. This human-centric framework also explicitly promotes national interests and sovereignty, while encouraging innovation, digital inclusion, and infrastructure investment through public-private partnerships.

Despite its comprehensive regulatory scope, Vietnam’s AI law notably omits key socio-economic and environmental safeguards, such as protections for workers displaced by AI automation and the significant environmental footprint of AI infrastructure—particularly the massive water consumption by data centers, which can reach 25.5 million liters annually per megawatt. This gap raises concerns about the law’s long-term sustainability and social equity implications amid rapid AI expansion.

On August 13, 2026, Vietnam set a regional precedent by issuing Southeast Asia's first binding enforcement directive that prohibits all government bodies from uploading classified documents to public AI platforms, mandating instead the exclusive use of two government-approved domestic AI systems for legal review. This move effectively excludes foreign AI platforms from official use, as the Ministry of Science and Technology requires these platforms to be domestically owned, utilize Vietnamese-language models, and localize all data and infrastructure within Vietnam, ensuring sovereign control over sensitive information.

The directive enshrines a strict human-in-the-loop governance model, where AI serves solely as a support tool rather than a decision-maker. Every AI-generated output must be traceable, verifiable, and cross-referenced against source legal documents before any authorized official can act on it, reflecting the foundational AI governance philosophy articulated by then-Minister Nguyen Manh Hung in Vietnam’s AI Law of December 2025. Minister Vu Hai Quan emphasized pragmatism, urging officials not to wait for perfection but to implement immediate, actionable regulatory steps, signaling a shift toward operational enforcement over theoretical frameworks.