Document facts
Issuing body: Government of Vietnam (signed by Deputy Prime Minister Ho Quoc Dung, on the proposal of the Minister of Science and Technology)
Document number: Decree 401/2026/ND-CP on administrative penalties for violations in the digital technology industry (replaces Articles 74 and 76 of Decree 15/2020/ND-CP, as amended by Decrees 14/2022/ND-CP and 211/2025/ND-CP; implements the Law on Digital Technology Industry, Law 71/2025/QH15)
Signed: November 4, 2026
Effective: December 22, 2026
Status: Not yet in force; the Ministry of Science and Technology is charged with guiding implementation (Article 30) and no implementing guidance has been published yet
Unofficial English summary for reference only. Not a legal translation and not legal advice. The Vietnamese text linked at the end of this page is authoritative.
What the document does
Decree 401/2026/ND-CP is a decree outlining penalties across four chapters and 30 articles. It defines the administrative violations, the forms and levels of penalties, the remedial measures and the penalty-imposing authorities for the digital technology industry under the Law on Digital Technology Industry, Law 71/2025/QH15, which took effect on January 1, 2026. Its stated objective is to give that law teeth: the industry’s duties come from the law and its implementing rules, and this decree only sets the penalties for their violation.
The decree’s scope turns on three points. It applies to Vietnamese and foreign organizations and individuals, including state agencies acting outside their assigned governmental duties, foreign organizations with digital-industry activity on Vietnamese territory, and business households, which are fined as individuals (Article 2). The fine figures in Chapter II are stated for organizations; fines for individuals are half the organization figure for the same act (Article 4(2)). Violations in other areas of state administration that touch the digital technology industry are not covered here; they are handled under their own penalties decrees (Article 1(2)).
On timing, one discrepancy in the official reporting needs to be stated plainly. A Government portal digest dated November 6, 2026 gave the effective date as November 22, 2026. Article 28(1) of the decree itself says December 22, 2026, and three independent outlets report the same date. This explainer follows the text: the decree takes effect on December 22, 2026, and nothing in it is operative before that date. The exact repeal wording of Article 28(2) should also be re-confirmed against the official gazette when it appears, because the legal-database rendering of that clause drops the article numbers; Article 29 of the same text confirms the provisions concerned are Articles 74 and 76 of Decree 15/2020, and this explainer relies on that confirmation.
The prescription period for a digital-industry violation is one year (Article 5), except for two years for the incentive-fraud provision of Article 10(2), the semiconductor provision of Article 16(1)(c) and the used-product provisions of Article 17(1) and (2). Article 3(5) adds an important carve-out: no administrative penalty applies where liability is exempted or excluded in controlled testing under Article 22 of the Science, Technology and Innovation Law, Law 93/2025/QH15. Handling of violations in the electronic environment follows Decree 118/2021/ND-CP as amended (Article 6). The Ministry of Science and Technology is charged with guiding and organizing implementation under Article 30, and no implementing guidance had been published at the time of writing. No fine in this explainer is being imposed today.
What changes in practice
Article 4 sets the ceilings: a maximum fine of VND 100 million for an individual, and twice that, VND 200 million, for an organization. The ten violation groups of Chapter II, Articles 8 to 17, specify the financial penalties.
Database duties are addressed first (Article 8). Late online supply, updating, connection, or sharing of data with the digital-technology-industry database incurs a warning. Incomplete, inaccurate or technically non-compliant supply that is not corrected on time carries VND 10 to 20 million. Not supplying, connecting or sharing at all carries VND 30 to 60 million. The remedy is to supply, update, connect and share complete and accurate data meeting the technical requirements.
Prohibited acts (Article 9) carry the decree’s heaviest general penalties. Unlawfully obstructing lawful digital-industry activity, including hardware and software research, development, production, testing, and services, or supporting prohibited activity through digital products and services, carries VND 90 to 140 million. Using digital products or services to commit acts prohibited by the digital-technology-industry law carries VND 140 to 170 million. Exploiting digital-industry activity to infringe national interests, national defense and security, public order, public interests, human and citizens’ rights, social ethics, health or life carries VND 170 to 200 million. Confiscation and expulsion of foreign individuals may be imposed as supplementary penalties, and the remedies include recall or removal of the offending digital products and services and disgorgement of unlawful gains.
Incentive fraud is a key focus of the decree. False information or invalid documents in dossiers for incentives for digital-product production and digital-service provision (Article 10) carry VND 30 to 60 million generally, rising to VND 60 to 100 million for used production-line and equipment import dossiers, VND 90 to 140 million for key digital products, software, AI systems and AI data-center projects, and VND 150 to 200 million for large-scale key digital-product projects and large AI data-center projects. Fraud in dossiers for high-quality digital-talent incentives (Article 11) carries VND 30 to 60 million. Fraud in dossiers for innovative-startup support (Article 13) and for preferences in leasing or procuring digital products and services with state budget funds (Article 14) carries VND 90 to 140 million each. Semiconductor dossiers (Article 16) follow the same pattern: VND 90 to 140 million for chip design, research and development, packaging and testing, auxiliary products, used-equipment import, training and research funding, customs priority and corporate-income-tax incentives, rising to VND 150 to 200 million for large-scale chip projects. The remedy throughout is disgorgement of unlawful gains, plus re-export or destruction of used equipment where applicable.
Controlled testing, the sandbox regime for digital-technology products and services (Article 12), has its own penalty structure. Late reporting incurs a warning. Incomplete or inaccurate reporting not corrected on time carries VND 10 to 20 million. Not reporting at all carries VND 30 to 60 million. Fraudulent licensing, extension or plan-adjustment dossiers carry VND 60 to 100 million. Fraud aimed at obtaining administrative-liability immunity or exemption, or not starting testing within 90 days of the license taking effect, carries VND 90 to 140 million. The top bracket, VND 150 to 200 million, covers testing outside the licensed scope, testing after suspension or completion, missing risk controls or warnings, no test-data management, no periodic risk assessment, no complaint channel, or non-cooperation with the licensing authority. Several of these are pure omissions.
Violations related to concentrated digital-technology zones (Article 15) are subject to fines of VND 90 to 140 million for fraudulent recognition dossiers or for building technical infrastructure off the approved schedule, and VND 150 to 200 million for operations inconsistent with the recognized objectives, functions, criteria, scale, or operating conditions, unapproved expansion, continuing to operate after no longer meeting recognition criteria, or activity outside the zone’s recognized function.
Violations involving used digital products (Article 17) are subject to fines of VND 100 to 140 million for misuse of licensed banned-list goods or failure to handle them as required, and VND 140 to 170 million for unauthorized processing of banned-list goods for foreign traders, domestic sale after such processing, or unauthorized import. Confiscation may be imposed, and remedies include re-export or destruction plus disgorgement.
Enforcement authority rests with the authorities named in Articles 18 to 27. People’s Committee chairpersons can fine up to VND 100 million at commune level and VND 200 million at provincial level. Directors of provincial Departments of Science and Technology can fine up to VND 160 million, and the Director of the Department of Digital Technology and Artificial Intelligence up to VND 200 million. People’s Police officers can fine from VND 20 million while on duty, with the maximum fine increasing by rank. Border Guard, Coast Guard, Customs, Market Surveillance and inspectors hold the remaining authority, which is allocated by violation type under Article 26.
Article 29 governs transition. Violations under Articles 74 and 76 of Decree 15/2020 that occurred and ended before December 22, 2026 but are detected afterwards continue to be handled under those articles. Digital-industry violations that began before that date but are still ongoing are handled under Decree 401. Penalty decisions already issued or fully enforced before December 22, 2026 follow the old rules even if the sanctioned party complains afterwards.
What changed from the previous rules
Decree 401 replaces the digital-technology penalty provisions of Decree 15/2020/ND-CP, specifically Articles 74 and 76 of that decree as amended by Decrees 14/2022/ND-CP and 211/2025/ND-CP. The comparison, verified against both texts, shows a mix of continuity and a significant expansion.
What carried over unchanged: the fine ceilings are the same, VND 100 million for an individual and VND 200 million for an organization, and the standard practice that fines for individuals are half those specified for organizations in Chapter II. Penalties for violations related to concentrated zones are nearly unchanged in scale: operating a concentrated IT park that deviates from its objectives or functions incurred fines of VND 170 to 200 million under old Article 74(5), while operating a concentrated digital-technology zone that does not meet its recognized objectives, functions, criteria, scale, or operating conditions is subject to fines of VND 150 to 200 million under new Article 15. Failing to finish concentrated-zone infrastructure on schedule carried VND 100 to 140 million under old Article 74(4), and the same bracket applies to building zone infrastructure behind schedule under new Article 15. Penalties for used-product violations also continue: misuse of used IT products on the banned list incurred fines of VND 100 to 140 million under old Article 76, and the same range applies under new Article 17, with a new higher tier of VND 140 to 170 million added for unauthorized import and unauthorized processing for foreign traders.
The major part of the decree introduces new provisions. The old Article 74 was a single article covering IT industry development, with its procurement-fraud provision limited to one narrow act, false information to obtain investment, lease or priority in state-funded procurement, at VND 20 to 30 million. Decree 401 replaces that single provision with a comprehensive incentive-fraud framework across Articles 10, 11, 13, 14 and 16, covering key digital products, AI systems, AI data centers, semiconductors, startups, digital talent and state-budget procurement, with fines up to VND 200 million. Article 8’s provisions on database duties, Article 9’s list of prohibited acts, Article 12’s sandbox provisions, and the two-year prescription for Articles 10(2), 16(1)(c) and 17 have no counterpart in the old text. The sandbox-liability exemption of Article 3(5) is also new. The scope is narrower in one sense and wider in another: Decree 401 covers only the digital technology industry, while Decree 15/2020’s wider post, telecom, radio-frequency, IT, network-security and e-transaction penalties remain in force for their own fields.
Who is affected
In practice the decree affects any organization seeking public support for digital-industry activity in Vietnam. Digital-product manufacturers, software and digital-content producers, AI-system developers and AI data-center investors are among the most exposed, especially any project claiming the key-product, AI data-center or large-scale incentives in Articles 10 and 16. Semiconductor and chip firms involved in design, research and development, production, packaging, testing, and auxiliary products, as well as importers of used production lines and equipment, are subject to the same penalty ranges. Controlled-testing participants and the authorities licensing them are covered by Article 12. Operators and investors in concentrated digital-technology zones are covered by Article 15. Digital-industry startups and any firm claiming digital-talent, procurement-preference or local-budget support are covered by Articles 11, 13 and 14. Foreign organizations and individuals with digital-industry activity on Vietnamese territory are covered by Article 2, including foreign traders using Vietnamese processors for used digital goods.
Notes for investors and operators
For investors, the decree converts the Digital Technology Industry Law from a statement of duties and incentives into a quantified risk, with its financial impact focused squarely on the incentive system itself. The fines are moderate by international standards, with a VND 200 million ceiling for organizations, but supplementary confiscation and remedial orders, such as requiring repayment of unlawful gains (disgorgement), re-export, destruction, and recall of products, can cost far more than the fine. The compliance work the decree rewards is mostly procedural and documentary: complete and accurate incentive dossiers, complete database submission, timely sandbox reporting, risk controls, and complaint channels in controlled testing, and licensed import and processing of used digital goods.
The decree should also be read alongside its two companions. Decree 363/2026/ND-CP, effective November 11, 2026, stipulates penalties for violations in the data field (see our explainer on Decree 363), and Decree 330/2026/ND-CP, effective August 19, 2026, addresses cybersecurity and personal-data violations. Together, the three decrees outline the full range of administrative penalties data, digital, and AI businesses operating in Vietnam may face.
What businesses should do next: before December 22, 2026, check whether the organization supplies, updates, connects, or shares data with the digital-technology-industry database (Article 8): providing late, incomplete, or missing data now incurs penalties, and the required remedy is to supply complete, accurate, and technically compliant data. Audit every incentive dossier filed or to be filed for key digital products, AI systems, AI data centers and semiconductor projects (Articles 10 and 16): false information or invalid documents in those dossiers incur the decree’s highest penalties, up to VND 200 million for organizations, and unlawful gains must be repaid (disgorged). Sandbox participants should confirm testing started within 90 days of the license taking effect, and that risk controls, participant risk warnings, test-data management, and complaint channels are in place (Article 12): failure to meet several of these requirements incurs fines of VND 150 to 200 million. Importers and processors of used digital products should verify whether the goods are on the prohibited import list and whether the import or processing is licensed (Article 17): unlicensed import or domestic sale after processing is subject to fines in the VND 140 to 170 million range, along with confiscation. Note the two-year prescription period for Articles 10(2), 16(1)(c) and 17 (Article 5) and the transition rule (Article 29): conduct that started before December 22, 2026 and continues past that date will be judged under Decree 401. Watch for the Ministry of Science and Technology’s implementation guidance under Article 30, which had not been published at the time of writing.
Sources and the official text
LuatVietnam (legal database), full Vietnamese text of Decree 401/2026/ND-CP, reviewed in its entirety; confirms the document number, issuing body, signer, signing date of November 4, 2026 and effective date of December 22, 2026 under Article 28(1). No Thu Vien Phap Luat document page and no Official Gazette URL were available at the time of writing. https://luatvietnam.vn/cong-nghiep/nghi-dinh-401-2026-nd-cp-xu-phat-vi-pham-hanh-chinh-trong-cong-nghiep-cong-nghe-so-454988-d1.html
Government portal, weekly roundup of Government and Prime Minister directions, November 1 to 7, 2026 (official publication; the Decree 401 item confirms the document number, signatory and subject matter). https://baochinhphu.vn/chi-dao-dieu-hanh-cua-chinh-phu-thu-tuong-chinh-phu-noi-bat-tuan-1-7-11-2026-102261106160718084.htm
Government portal, daily digest of November 6, 2026 (the source of the November 22, 2026 effective-date statement, treated in this explainer as a typo contradicted by Article 28(1) of the decree text and corroborated by three independent outlets reporting December 22, 2026). https://baochinhphu.vn/chi-dao-dieu-hanh-cua-chinh-phu-thu-tuong-chinh-phu-ngay-6-11-2026-102261106193235232.htm
Decree 15/2020/ND-CP, Articles 74 and 76, as amended by Decree 14/2022/ND-CP (the regime replaced by Decree 401 and used for comparison in the “What changed from the previous rules” section; legal database and official text reproductions). https://thuvienphapluat.vn/phap-luat/truong-hop-trien-khai-hoat-dong-khu-cong-nghe-thong-tin-tap-trung-khong-dung-muc-tieu-bi-phat-bao-nhieu-tien-986364-7722.html
About this explainer: VoltViet prepared this summary in English from the official Vietnamese text so that investors and operators can follow what the document does. It is a reading aid, not a translation of record and not legal advice. Where any wording here differs from the Vietnamese text, the Vietnamese text governs. For decisions with legal or financial consequences, rely on the official text linked above and take advice from a qualified Vietnamese lawyer.
Related reading
More explainers from the Policy & Law desk, and reporting from the Tech & AI desk.
