AI Governance 2026: Japan's AI Promotion Act vs Vietnam's New AI Law — A Practical Compliance Guide for Japanese–Vietnamese Businesses

2026 — the year Japan and Vietnam both entered the era of AI legislation

For businesses that develop or deploy AI across Japan and Vietnam, 2026 is a watershed year. Japan's first dedicated AI statute, the AI Promotion Act (Act on the Promotion of Research and Development and the Utilization of AI-Related Technologies), was passed by the Diet on May 28, 2025. Vietnam's first dedicated AI law, the Law on Artificial Intelligence (Law No. 134/2025/QH15), was passed by the National Assembly on December 10, 2025 and took effect on March 1, 2026. Meanwhile, the EU AI Act — the world's first comprehensive AI regulation — continues its phased application (official EU AI Act tracker).

The critical point is that the Japanese and Vietnamese laws rest on fundamentally different design philosophies. Japan takes an innovation-first approach that promotes research, development, and utilization while keeping direct regulation light. Vietnam adopts an EU-style risk-based regulatory framework that imposes explicit obligations on providers and users. Companies operating AI across both countries need to understand the gap between the two frameworks precisely and build a unified governance posture.

Japan's AI Promotion Act: innovation first, light touch

The AI Promotion Act, enacted on May 28, 2025, is Japan's first AI-specific law. As the analysis by international law firm White & Case explains, it establishes a national framework to promote AI research, development, and utilization — and its defining feature is that it does not impose heavy regulatory obligations directly on companies (White & Case alert).

• Core philosophy: innovation first — the state promotes R&D and utilization of AI-related technologies, while addressing AI's negative effects is framed as a society-wide effort
• Role of the state: formulating basic plans, promoting R&D, developing talent, and building international coordination frameworks
• What it means for companies: rather than direct legal obligations, adherence to voluntary instruments such as METI's AI Guidelines for Business is the center of gravity in practice

The think tank Future of Privacy Forum (FPF) similarly describes Japan's framework as an innovation-first blueprint (FPF analysis). That said, the government has signaled it will keep reviewing measures as AI technology evolves rapidly, and more concrete measures for specific risk areas such as deepfakes or copyright may be debated going forward. Light-touch does not mean companies are released from the expectation of proper governance.

Vietnam's new AI law (Law No. 134/2025/QH15): risk-based management

By contrast, Vietnam's Law on Artificial Intelligence, effective March 1, 2026, is a regulatory framework with explicit obligations. Based on the analysis by Japanese research firm B&Company (B&Company review), the five key pillars are as follows (full text of the law):

• Risk classification (Articles 8, 9, 10, 13, 15): AI systems are classified as high, medium, or low risk. High-risk systems require conformity and impact assessments plus incident management; medium-risk systems require self-classification and notification
• Transparency of AI-generated content (Articles 17, 18): users must be informed when they interact with AI, and AI-generated or modified audio, images, and video must be clearly identifiable — directly relevant to generative AI used for content creation and customer engagement
• Human responsibility cannot be replaced (Articles 4, 6, 7, 25): AI may support but not replace human judgment; organizations and users remain responsible for AI-related damages, especially in healthcare, education, finance, and public services
• Long-term development support (Articles 5, 26–31): national computing infrastructure, AI databases, testing platforms, and Vietnamese-language large language models
• Transition measures (Articles 32–34): regulatory sandboxes, financial and investment incentives, and a National AI Development Fund; transition periods of 18 months for healthcare, education, and finance, and 12 months for other sectors

In addition, the government has issued Decree 142/2026/NĐ-CP guiding the law, covering risk classification, compliance mandates, and AI sandbox rules (Viet An Law summary). It is also worth noting that the Law on Digital Technology Industry (Law No. 71/2025/QH15), passed in June 2025, was the first Vietnamese law to name AI as a strategic technology; the new AI law consolidates that previously fragmented framework.

Comparison: Japan, Vietnam, and the EU — three frameworks

What Japanese–Vietnamese businesses should put in place now

For Japanese companies

If you outsource AI development or operations to Vietnamese partners, or deploy AI systems in the Vietnamese market, Vietnam's risk classification and transparency obligations become directly relevant from March 2026 onward. The first step is an inventory of every AI system you use, mapped to the jurisdictions it touches (Japan, Vietnam, EU) and its risk level.

For Vietnamese companies (serving the Japanese market)

Japan currently has no heavy regulatory obligations, but Japanese clients increasingly require AI governance — transparency, human review, data management — as part of procurement. Building operations that comply with your own AI law and align with Japanese guidelines turns compliance into proof of trust in offshore development deals.

• AI inventory: list all AI in use company-wide — chatbots, generative AI marketing, AI-based recruitment screening, automated decision-making
• Risk classification: classify each use case against Vietnam's high/medium/low criteria; prepare conformity assessments for high-risk cases
• Transparency implementation: disclose AI interaction to users and label AI-generated images, audio, and video
• Human oversight: design processes where humans make final decisions, and retain the logs that prove it
• Contract hygiene: add AI governance clauses (responsibility split, data governance, incident reporting) to Japan–Vietnam outsourcing contracts

A 90-day action plan

1. Days 0–30: inventory and jurisdiction mapping — list all AI systems in use or in development, then assign each a jurisdiction and a risk level
2. Days 0–30: transparency check — verify that chatbots and generated content carry AI disclosure and labels; implement what is missing
3. Days 31–60: human-oversight design — embed human review into high-risk use cases and spell out the responsibility split in partner contracts
4. Days 31–60: data governance refresh — align the handling of AI training and inference data with Vietnam's cybersecurity, data, and personal data protection laws
5. Days 61–90: codify and explain — adopt an internal AI governance policy, train staff, and prepare an AI governance brief for customers and investors

The biggest risk in the era of AI legislation is not any single regulation — it is the gap between different frameworks. Companies that grasp the design philosophies behind Japan's and Vietnam's laws early and integrate them into their own governance will earn the trust of both customers and regulators.