Most of Việt Nam’s 2026 data legislation has arrived as brand-new rulebooks: a decree for data exchanges, one for cybersecurity product licensing, one for civil cryptography. Nghị định 347/2026/NĐ-CP is a different animal. It is a housekeeping decree — a single instrument that amends four unrelated decrees at once — and its headlines in the Vietnamese press have all been about fire-safety inspections. Buried in Điều 1, however, is a small change with real consequences for anyone selling analytics or AI services in Việt Nam.
What the document is
Nghị định 347/2026/NĐ-CP “sửa đổi, bổ sung một số điều” of four earlier decrees. It was issued by the Government on 8 September 2026 and signed by Phó Thủ tướng Thường trực Phạm Gia Túc on the Government’s behalf. It takes effect on 15 September 2026 — a one-week runway, which is unusually short even by the standards of this year’s legislative pace.
The four amended decrees are:
- Nghị định 169/2025/NĐ-CP of 30 June 2025, on science, technology and innovation activities and data products and services;
- Nghị định 105/2025/NĐ-CP of 15 May 2025, detailing the Luật Phòng cháy, chữa cháy và cứu nạn, cứu hộ;
- Nghị định 106/2025/NĐ-CP of 15 May 2025, on administrative penalties in fire prevention, firefighting and rescue;
- Nghị định 282/2025/NĐ-CP of 30 October 2025, on administrative penalties in security, public order and social safety, prevention of social evils, and prevention of domestic violence.
Only the first is a technology instrument. It is also the one the press coverage skipped.
What changes for data and AI services
Nghị định 169/2025/NĐ-CP was the decree that first put “sản phẩm, dịch vụ phân tích, tổng hợp dữ liệu” — data analysis and synthesis products and services — into Vietnamese regulation. Its Điều 27 grades them on four levels: level 1 is analysis done by people using software with no AI; level 2 is people assisted in part by AI; level 3 is fully AI-driven with human supervision; level 4 is fully AI-driven with no human in the loop.
Điều 28 then splits providers into two tiers. The heavier tier needs a Giấy chứng nhận đủ điều kiện kinh doanh: level 3 and level 4 analytics running inside state information systems, services that connect to or share with national or sector databases, and services that use “dữ liệu cốt lõi, dữ liệu quan trọng”. The lighter tier — everyone else, expressly including virtual assistants, generative AI systems, automated video/image/news analysis products with direct user interaction, services processing sensitive personal data of a million people or more, level 3–4 automation covering at least 20 per cent of an industrial sector, and models trained on 10 TB of data or more — only had to file a notice with Bộ Công an “khi thực hiện cung cấp”: when providing the service.
That timing was the loose thread. As originally drafted, khoản 5 Điều 31 of Nghị định 169/2025 imposed only a reporting duty: providers covered by Điều 28 had to send a periodic report on Mẫu BC01 to Bộ Công an, through the Trung tâm dữ liệu quốc gia, before 20 December each year, with figures running from 15 December of the previous year to 14 December of the reporting year, plus ad-hoc reports on request.
Nghị định 347/2026/NĐ-CP rewrites that clause. Under the amended khoản 5 Điều 31, a provider of data analysis and synthesis products or services must send a notification to the Trung tâm dữ liệu quốc gia before it begins operating. The annual BC01 report survives, on the same December deadlines and the same reporting window, now on the form attached to the new decree’s own appendix, and can still be filed in person, by post or online. The shift is from “tell the regulator you are doing this” to “tell the regulator before you do this” — a modest wording change that converts a running-operations formality into a gate at launch.
For services already live on 15 September 2026, the transition rule gives 20 working days from the effective date to file the notification. That puts the practical deadline in mid-October 2026.
Who this affects
The perimeter is wider than “AI companies”. Điều 28’s lighter tier catches any organisation offering a chatbot or virtual assistant to Vietnamese users, any product doing automated analysis of video, images, news or articles where the output could steer users towards misleading content, and any analytics service touching sensitive personal data at scale. Điều 28 khoản 3 does carve out purely internal analytics and anything already governed by other legislation, so a company crunching its own data for its own use is outside the notice duty.
Two practical points follow. First, the notice is a filing, not a licence: nothing in the amendment says the Trung tâm dữ liệu quốc gia has to approve anything before launch, and no waiting period is specified. Second, filing it does not substitute for the certificate where Điều 28 khoản 1 requires one — the two tiers remain distinct, and a level 3 or level 4 service inside a state system still needs the full Giấy chứng nhận under Điều 29’s personnel, facilities and business-plan conditions.
The non-technology amendments
For completeness: the fire-safety changes reallocate acceptance-testing responsibility to project owners and vehicle operators, restate inspection authority for public security agencies and provincial People’s Committees, require three working days’ advance notice of an inspection, standardise the inspection record on template PC03, and add training hours — 24 to 32 — for people holding multiple fire-prevention and rescue roles.
The amendments to Nghị định 282/2025 restructure residence-registration penalties into tiers by the number of unregistered lodgers (2–4 million đồng for one to three people, 4–8 million for four to eight, 8–12 million for nine or more), add a 500,000–1,000,000 đồng fine for failing to re-register a seal within two working days of losing or damaging it, and remove five categories of conduct from the penalty schedule altogether.
Open questions
The decree does not say what the pre-launch notification must contain, whether a template exists for it, or what happens if the Trung tâm dữ liệu quốc gia objects — the appendix supplies Mẫu BC01 for the annual report, not a notice form. Nor is it clear how the new duty interacts with the notification already described in Điều 28 khoản 2, which is addressed to Bộ Công an rather than to the centre and is tied to the moment of provision: whether these are one filing or two is left to practice. And for a service that starts below a threshold and grows past it — a chatbot that crosses a million sensitive-data subjects, a model retrained past 10 TB — the decree offers no guidance on when “trước khi hoạt động” is supposed to have happened. With a 15 September start and a mid-October transition deadline, those answers will have to come from the National Data Centre’s counter rather than from the text.
Sources
- Nghị định số 347/2026/NĐ-CP sửa đổi 4 Nghị định về khoa học, công nghệ; phòng cháy, chữa cháy; an ninh, trật tự; phòng, chống tệ nạn xã hội, bạo lực gia đình — Xây dựng chính sách, Cổng TTĐT Chính phủ
- Chỉ đạo, điều hành của Chính phủ, Thủ tướng Chính phủ ngày 8/9/2026 — Báo Chính phủ
- Từ 15/9/2026, tổ chức cung cấp sản phẩm, dịch vụ phân tích dữ liệu phải gửi thông báo trước khi hoạt động — LuatVietnam
- Quy định mới về trách nhiệm của chủ đầu tư và quy trình kiểm tra phòng cháy, chữa cháy — Báo Chính phủ
- Quy định mới về xử phạt vi phạm hành chính trong lĩnh vực an ninh, trật tự, an toàn xã hội — Báo Chính phủ
- Từ 15/9, áp dụng quy định mới về kiểm tra phòng cháy, chữa cháy — VTV
- Nghị định số 169/2025/NĐ-CP — toàn văn trên Công báo Chính phủ
- Nghị định số 169/2025/NĐ-CP — Cổng TTĐT Chính phủ (vanban.chinhphu.vn)
- Chính sách ưu đãi phát triển hoạt động khoa học, công nghệ và đổi mới sáng tạo về dữ liệu — Báo Chính phủ
This post is general information, not legal advice.