Vietnam’s AI Strategy in the Agentic Era

From AI Application to AI-Native Transformation

Vietnam has entered a new phase of AI governance. Under Decision 1671/QĐ-TTg (issued in August 2026), the updated National AI Strategy to 2030, with a Vision to 2045, marks a decisive shift from peripheral research and application toward comprehensive national transformation. Rather than treating AI as an external tool to adopt through organisation and operations, the strategy embeds AI as a core capability, shifting toward “AI by design.”

This strategic direction is anchored in a coordinated legal framework comprising the Laws on Artificial Intelligence, Data, Digital Transformation, Cybersecurity, Digital Technology Industry, and Personal Data Protection. Within this architecture, the National AI Strategy links international cooperation directly to national strategic autonomy:

• Supply Chain Resilience: Actively diversifying partners, platforms, technologies, and vendor ecosystems to prevent critical dependency on any single market, model, or provider.
• Technological Sovereignty: Enforcing provisions in the Law on AI aimed at mastering core technologies, protecting digital sovereignty, and advancing domestic technical self-reliance.

Despite these legislative ambitions, a fundamental tension remains: Vietnam continues to depend on foreign technologies across critical layers of the AI stack.

Strategic Autonomy in a Mixed AI Stack

Advanced AI remains anchored to globally concentrated, capital-intensive capabilities: high-end GPUs, semiconductor fabrication, hyperscale cloud infrastructure, foundation models, and specialized software frameworks. Consequently, research frames Vietnam’s path not as an attempt at complete technological isolation, but as an exercise in strategic pragmatism and controlled interdependence amid intensifying US–China technological competition.

In particular, Vietnam increasingly operates through mixed AI stacks: foreign hardware and models combined with Vietnamese data, infrastructure and applications.

Research on Vietnam’s AI infrastructure shows how domestic hosting can still depend on foreign chips, software and expertise.

Within this architecture, strategic autonomy cannot realistically mean autarky. Instead, the operative metric is substitutability: can Vietnam replace a given model, cloud provider, chip supplier, or software dependency with an alternative of equivalent quality and reliability within an acceptable timeframe and budget? The solution depends on cultivating a dynamic, resilient ecosystem.

Building a Domestically Anchored but Open AI Ecosystem

• Domestic Anchors (SOEs and Large Private Firms): Domestic firms can lead where national-scale infrastructure, secure platforms, and long-term capabilities matter. State-owned enterprises (SOEs) such as Viettel and VNPT can anchor telecommunications, secure cloud, compute, and cybersecurity. In parallel, large private firms such as FPT, CMC, and CT Group can integrate technologies, adapt models, and scale enterprise solutions. The Au Lac AI Alliance exemplifies this coordinated approach, aligning with the Ministry of Science and Technology’s focus on major Vietnamese firms as central domestic AI actors.
• FDI Partnerships (Capability Transfer): Foreign Direct Investment (FDI) firms remain essential for chips, frontier models, capital, and global networks, where domestic capability is still nascent. Their contribution, however, should be evaluated by the capabilities left behind: engineers trained, R&D conducted locally, domestic suppliers integrated, and technologies made interoperable.
• MSMEs and Startups (Specialisation and Agility): Vietnamese Micro-, Small, and Medium-sized Enterprises (MSMEs) and startups can specialise in domain-specific capabilities such as vertical AI, local datasets, agent orchestration, middleware, and cybersecurity—a trajectory supported by analyses of Vietnam’s startup ecosystem. Complementing this base, foreign MSMEs can supply niche technologies and diversify external dependencies.

Agentic AI Poses Challenges

Agentic AI makes this dynamic ecosystem model even more critical. Because agents can plan, access databases, call external tools, and execute real-world actions with varying levels of human supervision, economic and operational value shifts towards areas where Vietnam has substantial scope to develop domestic capabilities: local data curation, workflow integration, APIs, agent orchestration, cybersecurity, and domain-specific applications.

However, agentic systems also expose acute regulatory gaps:

• The Threshold for Reassessment: The Law on AI establishes a three-tier risk model (high, medium, and low) and requires reassessment whenever system integration or modified functionality introduces new risks. Decree 142/2026/NĐ-CP operationalises this framework through classification, conformity assessments, incident reporting, and regulatory sandbox procedures—including renewed assessment when “significant changes” affect a high-risk system. Furthermore, Decision 33/2026/QĐ-TTg designates 46 categories of high-risk systems across sectors such as education, healthcare, banking, justice, and transport. Yet for agentic AI, the central unresolved question is when added tools, permissions, data privileges, or transaction authorities constitute a sufficiently “significant change” to trigger formal reclassification or reassessment, even whilst the underlying foundation model remains completely unchanged.
• The Practicality of Human Oversight: Regional analyses increasingly highlight the accountability and cybersecurity vulnerabilities associated with agentic AI, particularly across social media. While Vietnam’s Law on AI mandates oversight proportionate to impact, and Decree 142 and Decision 33 establish concrete human-control obligations for high-risk systems, the framework does not yet define what proportionate oversight looks like for general-purpose agents whose capabilities evolve post-deployment. Requiring upfront human approval for every discrete action risks paralysing operational productivity and generating prohibitive compliance costs.

Compliance Costs as an Autonomy Risk

Under Decree 142, significant changes to high-risk systems can trigger renewed conformity assessment. Large firms are generally better placed to absorb repeated legal reviews, documentation requirements, monitoring costs and technical compliance obligations. Smaller firms, by contrast, may face disproportionate burdens as each new capability or integration potentially triggers additional regulatory scrutiny. For MSMEs, such regulatory iteration problems are a central challenge.

This picture creates three gaps: 1. uncertainty over when iterative changes trigger reclassification or renewed assessment; 2. fixed compliance costs that weigh disproportionately on smaller firms; and 3. a scale-up cliff when a successful pilot expands commercially.

There have been warnings  that process-heavy implementation could impair competitiveness and questions about regulatory capacity.

Ultimately, these gaps produce a regulatory-autonomy dilemma: if compliance costs remain too high, smaller domestic innovators will struggle to survive, leaving well-capitalised domestic incumbents and large foreign platforms to absorb the market. This erosion of ecosystem diversity risks pushing local enterprises towards turnkey foreign platforms, inadvertently deepening technological lock-in.

Policy Recommendations

To mitigate these risks and harness agentic capabilities, Vietnam should pursue four coordinated policy interventions:

1. Codify Substitutability in Public Procurement: Vietnam should make substitutability an explicit statutory objective. Public procurement criteria must mandate open APIs, data portability, multi-cloud interoperability, frictionless model switching, and credible vendor exit arrangements. As the nation’s anchor AI consumer, the government should actively back capable domestic firms where national security and sovereignty demand control, whilst keeping tender architectures sufficiently modular for MSMEs and specialised domestic suppliers to participate.
2. Clarify Agentic Risk Triggers via Targeted Guidance: Regulators should issue clear, practical guidance specifying the operational thresholds—such as expansions in autonomous decision-making, external tool execution, sensitive data access, transactional authority, or operating scale—that necessitate reclassification or renewed conformity assessment. Oversight mandates must be calibrated proportionately: requiring mandatory human approval for irreversible or high-consequence actions, whilst permitting automated logging, monitoring, and exception-based escalation for bounded, reversible tasks. Singapore’s Model AI Governance Framework for Agentic AI offers a valuable reference through its emphasis on bounded authority and proportionate accountability.
3. Lower Compliance Overheads through Shared Regulatory Infrastructure: The state should deploy shared testing facilities, regulatory sandboxes, subsidised cybersecurity auditing services, and standardised risk-assessment templates to reduce the cost of compliance for smaller actors. Crucially, the sandbox regime under Decree 142 must provide a transparent “pilot-to-scale” pathway, ensuring that empirical testing results, telemetry logs, and risk assessments generated during controlled experimentation count directly towards subsequent formal conformity assessments.
4. Leverage Regulation to Build a Domestic AI-Assurance Industry: Compliance requirements can be converted into an engine for domestic capability building. National requirements for algorithmic evaluation, adversarial red-teaming, real-time agent monitoring, and automated compliance verification can catalyse a high-value Vietnamese AI-assurance sector, drawing together local universities, large domestic technology leaders, specialised MSMEs, and international technical partners.

Conclusion: Autonomy through Ecosystem Resilience

In sum, the AI Law, Decree 142, Decision 33 and Decision 1671 together create a layered framework of statutory principles, implementation procedures, high-risk designation and strategic direction. But Vietnam’s strategic autonomy should not depend on whether every chip, cloud service or model is domestically produced. It should depend on whether firms can integrate global technologies, switch suppliers, preserve domestic capability and maintain competition.

Agentic AI makes this challenge more urgent because both value and risk increasingly reside in the connections between models, tools, data and real-world actions. Vietnam’s long-term technological autonomy will depend on whether those connections remain contestable, governable and substitutable.

The views and recommendations expressed in this article published in November 2026 are solely those of the author and do not necessarily reflect the views and position of the Tech for Good Institute.