Vietnam’s Decree 401 on Digital Technology Industry Penalties

Vietnam’s Decree 401/2026/ND-CP takes effect on 22 December 2026. It sets maximum administrative fines of VND 200 million for organisations and VND 100 million for individuals. The decree covers industry reporting, prohibited conduct, regulatory sandbox trials, incentive claims and restricted imports of used digital technology products.

Who does Vietnam’s Decree 401 apply to?

Decree 401/2026/ND-CP on administrative penalties for violations in the digital technology industry applies to Vietnamese and foreign organisations and individuals that commit a violation covered by the decree, subject to any applicable international treaty that provides otherwise. It covers companies established in Vietnam, their branches and representative offices, and foreign organisations carrying out digital technology industry activities in Vietnam. Household businesses and households are subject to the penalty rates for individuals.

The decree implements administrative penalties in areas governed by Vietnam’s Law on Digital Technology Industry. Companies developing, supplying or deploying AI systems should also check their obligations under Vietnam’s separate Law on Artificial Intelligence.

What are the fines under Decree 401?

An organisation can be fined up to VND 200 million for a violation. For the same violation, an individual faces half the organisational fine, up to VND 100 million. The table shows selected violations and the applicable organisational fines.

The incentive, start-up and procurement examples concern conduct below the threshold for criminal prosecution. Authorities may also order the surrender of unlawful gains from prohibited conduct. In specified cases, they can require businesses to recall or remove the products or services involved or apply appropriate technical measures.

What happens if a company reports late or misses a filing?

A late industry database submission or sandbox report can draw a warning. Organisations face fines of VND 10–20 million if they provide incomplete or inaccurate information and fail to correct it by the authority’s deadline. For industry database reporting, the same range applies to technical deficiencies in data connection or sharing that the organisation fails to fix by that deadline.

Failure to submit required information, file a sandbox report or use the prescribed method to connect to or share data with the industry database can draw a fine of VND 30–60 million. Authorities can also order organisations to supply accurate, complete information and meet applicable technical requirements.

What can trigger a fine during a regulatory sandbox trial?

An organisation can face a fine of VND 150–200 million for operating outside its approved trial plan or for specified failures to protect participants. These include failing to warn participants about risks, establish controls for trial data or assess risks periodically.

Failing to start the trial within 90 days of the licensing decision taking effect can attract a fine of VND 90–140 million. An exception applies if force majeure or an objective obstacle prevents the trial from starting and the licensing authority gives written approval.

Can authorities recover unlawful gains or require equipment to be re-exported?

Yes. Authorities can require businesses to surrender unlawful gains from specified digital technology or semiconductor incentive violations. Violations involving certain used-equipment import applications or restricted products can also lead to confiscation, re-export or destruction where the law requires it.

If a penalty decision orders re-export or removal from Vietnam, the business generally has 30 days from receipt of the decision to comply. An exception applies if the competent authority grants an import licence within that period. Before shipping used equipment, companies should verify its classification, whether an import exception applies and what uses the authorisation permits.

Does Decree 401 apply to violations that began before 22 December 2026?

Yes, if the violation is still ongoing on 22 December 2026. The previous rules continue to apply to conduct covered by the repealed provisions of Decree 15/2020/ND-CP, as amended, if it ended before that date and is discovered later or is still under review when Decree 401 takes effect. The repealed provisions covered specified IT industry development violations and used IT products on the prohibited import list.

How long do authorities have to impose a penalty?

The general limitation period is one year. A two-year period applies to specified violations involving used-equipment import applications and the import, use or processing of used digital technology products on the prohibited list.

For ongoing violations, the period starts when an authorised official detects the conduct. For completed violations, it starts when the conduct ends. For specified reporting and data-sharing failures, the violation ends once the organisation supplies complete, accurate information or connects to or shares data as required.

What should businesses check before 22 December 2026?

• Reporting: Assign owners for required submissions, data sharing and corrections. Keep dated evidence of compliance.
• Incentives: Check that claims about project scale, eligible activities and equipment use match supporting records across funding, investment and customs filings.
• Sandbox trials: Compare live operations with the approved trial plan. Document participant notices, data controls and risk reviews.
• Used equipment: Check import restrictions and any applicable exception before shipment. Share authorisation conditions with procurement and logistics teams.
• Open compliance issues: Identify any ongoing violations and keep dated evidence of corrective action.