Vietnam’s Artificial Intelligence (AI) law officially took effect on March 1, 2026, establishing strict requirements for documentation, testing, and human oversight for high-risk systems. The regulatory framework, which classifies AI based on potential harm, arrived just days after the Computer and Communications Industry Association—representing firms including Amazon, Apple, and Google—requested an 18-month moratorium to allow companies more time for compliance, fulcrum.sg reported.
Compliance timelines for existing systems
While the legislation is now active, authorities have granted a grace period for AI models already in operation. Systems currently in use have 12 months to meet the new standards, though institutions in healthcare, education, and finance have been given up to 18 months to achieve full compliance. During this transitional phase, the focus remains on ensuring that institutions—such as banks and hospitals—not only secure test results from AI suppliers but also conduct their own independent verification to assess how models perform using local data and languages.
Regulatory approaches across Southeast Asia
Countries in the region are adopting varied strategies to govern AI deployment. Singapore has prioritized supervision over rigid legislation; in 2024, the Monetary Authority of Singapore (MAS) published a set of good practices for the industry following a review of how local banks manage AI risk. While these guidelines are not binding, they inform the standards MAS expects during licensing and inspection procedures.
Other nations are moving toward formal legislation. In Indonesia, the banking regulator, Otoritas Jasa Keuangan (OJK), issued AI governance guidance in April 2025 that covers the entire lifecycle of an AI system. Meanwhile, Malaysia’s digital minister announced on October 5, 2026, that the country’s AI Governance Bill is scheduled to be tabled in Parliament early next year as a cross-sector framework.
Accountability for system failures
Regardless of the regulatory path chosen, the core challenge remains local accountability. Vietnam’s law requires foreign providers of high-risk systems to maintain a local contact point or authorized representative. If a foreign supplier remains unreachable, regulators can hold the domestic institution—such as the bank or hospital using the model—responsible for verifying the system’s safety.
The European Union, which pioneered these types of risk-based AI laws, has similarly faced challenges with implementation, recently deferring certain obligations as technical standards for compliance are still being finalized.
Questions regarding AI implementation
What should an institution do if an AI supplier refuses to share test data?
If a supplier declines to provide documentation or test results, the institution must increase its own internal testing, limit the scope of the AI’s use, or decline to implement the system entirely, as it lacks the necessary information to verify safety.
How does an AI model’s performance in the US or Europe compare to local use?
Supplier documentation often reflects testing conducted on English-language data, which may not accurately predict a model’s performance when processing local files, such as medical notes or loan applications in languages like Bahasa Indonesia or Thai.
Can regulators penalize firms for failing to follow AI guidance?
In systems like Singapore’s, regulators may not have the power to issue fines for departing from "good practice" guidance, but they can use these expectations during licensing and inspection to generate risk profiles, which may subject non-compliant institutions to further scrutiny.
The fundamental question remains: as AI systems increasingly influence critical decisions—such as who receives a loan or who gains priority for medical care—it is not yet clear how effectively regional regulators can enforce liability when a model fails or undergoes an unmonitored update.