Law on Artificial Intelligence, incident management and reporting obligation

Law No. 134/2025/QH15, art. 12

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 7 months, effective 1 March 2026.

An AI risk obligations rule binding public and private bodies.

As of 20 September 2026.

What it requires

If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.
If a serious incident occurs in your AI system and you are its deployer or user, record the incident, notify it promptly, and coordinate with the other parties during the remediation process.
Report and handle the incident through the one-stop artificial intelligence portal.
Continuously keep your AI system safe, secure, and reliable, and promptly detect and remedy any incident capable of harming people, property, data, or social order, regardless of the system's risk tier.
The Law states no number of hours or days for this report and leaves the deadline to a Government decree. Decree No. 142/2026/ND-CP was issued to implement the Law, and its promulgated text is not read here, so the deadline it sets is not stated.

What it reaches

Obligation class

Breach notice, Governance

Who checks it

Audit expectation

continuous

Who audits it

Self

Where the report goes

Filed with regulator

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 12 requires every developer, provider, deployer and user of an artificial intelligence system to keep the system safe, secure and reliable, and to promptly detect and remedy an incident capable of harming people, property, data or social order.

When a serious incident occurs in an artificial intelligence system, the developer and provider must urgently apply technical measures to remedy, suspend or recall the system, and must simultaneously notify the competent state agency of the incident. The deployer and the user of the system must record the incident, notify it promptly, and coordinate with one another during the remediation process.

The competent state management agency receives, verifies and guides the remediation, and may require the system to be suspended, recalled or reassessed when necessary. Reporting and remediation of the incident is carried out through the one-stop artificial intelligence portal.

Article 12 does not itself state a reporting deadline; instead it directs the Government to specify the reporting procedure and the responsibilities of the agencies, organisations and individuals involved, calibrated to the severity of the incident and the scope of its impact. Article 12 addresses the developer, provider, deployer and user of the system and the competent state agency; it does not itself direct any notice to a person affected by the incident.

Decree 142/2026/ND-CP, reported as covering the Law's risk-classification duties and the one-stop portal, has been issued to implement the Law, and its promulgated text is not read here, so the deadline it sets is not stated.

When LexLint raises it

high_risk_decisions
deploys_chatbot
generates_content
trains_models
crawls_web
automated_outreach

Read the law

Unofficial English translation of the Official Gazette text (LuatVietnam), not the Government Portal's or Official Gazette's own text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app