One Code Per Product: Việt Nam Builds a National Platform to Identify, Authenticate and Trace Goods

Scan the QR code on a bottle of fish sauce or a box of supplements in Việt Nam today and you might land on the manufacturer’s website, a private traceability service, a ministry portal, or nothing at all. The Government now wants one answer to the question “is this product what it says it is?”. On 29 September 2026, Deputy Prime Minister Hồ Quốc Dũng, signing for the Government, issued Nghị định 372/2026/NĐ-CP on identifying, authenticating and tracing the origin of products and goods (định danh, xác thực, truy xuất nguồn gốc sản phẩm, hàng hóa). It takes effect on 1 January 2027.

What the decree is

Nghị định 372/2026/NĐ-CP has 8 chapters and 38 articles, plus an annex on the product identification code. It covers four things:

the Nền tảng quốc gia về định danh, xác thực và truy xuất nguồn gốc sản phẩm, hàng hóa (National Platform for Product Identification, Authentication and Traceability);
identification, authentication and traceability done in the digital environment through that platform;
how the platform and the Cơ sở dữ liệu quốc gia về sản phẩm, hàng hóa (National Product Database) are built, run, connected, shared and used;
the rights and duties of the agencies, businesses and individuals involved.

The Ministry of Public Security (Bộ Công an) drafted the decree through its Trung tâm dữ liệu quốc gia (National Data Center). In October 2025, when drafting began, the ministry said traceability systems were “scattered among ministries and agencies” and that counterfeiting and trade fraud remained a serious, complicated problem. The April 2026 draft had 40 articles. The signed text has 38.

The decree does not replace the existing traceability rules. Traceability procedures still follow Nghị định 37/2026/NĐ-CP, which details the Luật Chất lượng sản phẩm, hàng hóa, and each sector’s own regulations. Nghị định 372 adds the shared digital layer that those rules plug into.

The main changes

1. One UID per product or batch. The core of the decree is the mã UID, a unique identifier that the national platform generates automatically. Legally, it is a digital link that follows national standards and the international GS1 standard, and it can identify a single unit, a batch (lô, mẻ) or a product type. It is carried on a “data carrier” (in practice a QR code or similar) that meets Vietnamese technical standards. The UID does not replace GTIN barcodes, GLN location numbers, or the product and location tracing codes businesses already hold legally. Each UID is attached to exactly one product or batch and linked to one master-data record (dữ liệu chủ) on the platform.

2. A cryptographic identity for every actor. Each UID is linked automatically to the decentralised identifier (DID) of the business or person responsible for it (Article 6). It is also linked to private and public keys and a specialised electronic signature (Article 7), and to digital certificates and digital evidence (Article 8). The decree says the aim is to allow “independent authentication and tracing”, so anyone can check a claim without trusting the party making it.

3. Mandatory for high-risk goods, voluntary for the rest. Depending on risk, identification and tracing work at batch level or down to each unit:

High-risk goods: identifying and authenticating master data and tracing origin are mandatory. The ministry responsible for each sector decides the product list, the roadmap, whether tracing works by batch or by unit, which supply-chain events count as “key events”, and what sector data is required. The decree says this must stay feasible for businesses and suit each industry.
Medium- and low-risk goods: participation is encouraged on a voluntary basis.
Exports: voluntary unless sector law says otherwise. The state encourages exporters to use it to meet importing-country requirements.
Out of scope: goods temporarily imported for re-export, goods in transit, re-exported goods, transhipped goods, and imports held in bonded warehouses for shipment to a third country. The mandatory rules also do not apply to defence, security and cipher-sector goods whose origin must stay confidential.

4. Key events become signed records. Tracing is recorded by creating a digital certificate through the UID at each sự kiện trọng yếu (key event) during production, import, export, distribution and consumption. The decree names invoicing and the moment customs decides to clear the goods as examples. Whoever is responsible for a key event must make sure its certificate is created, unless data confirming that stage is already synced to the National Product Database. If a service provider creates the certificates, a written agreement must set out who does it, the scope, and who is legally liable for the data.

5. Paper certificates go digital, with the value of originals. Quality certificates, certificates of origin, conformity certificates (hợp quy, hợp chuẩn) and similar documents tied to high-risk goods will be digitised, authenticated and synced to the platform on a roadmap that each authority sets. Once created on the platform, these digital certificates have the same validity as the original. Ministries must publish lists of the documents that need to become digital certificates, with timelines.

6. Invoices meet master data. Product names on invoices still follow invoicing law. The UID is used to check the invoiced name against the authenticated master data. Master data is standardised against the Vietnamese product classification (Hệ thống ngành sản phẩm Việt Nam) and the import-export HS nomenclature. The minimum data fields for each product follow khoản 5 Điều 23 of Nghị định 37/2026/NĐ-CP.

Why 1 January 2027 matters

The effective date matches a deadline already in force. Thông tư 31/2026/TT-BCT of the Ministry of Industry and Trade (issued 11 June 2026, effective 1 July 2026) introduced mandatory traceability for high-risk goods under that ministry in two phases, through its VeriGoods system (verigoods.vn). From 1 July 2026, traders register accounts, receive product IDs and authenticate product information. From 1 January 2027, they must complete traceability before goods go on sale. The national platform’s rules therefore start on the same day that MOIT’s phase 2 begins.

Who is affected

The decree applies to state bodies that manage the platform and the database; to everyone who produces, processes, subcontracts, trades, distributes, imports, transports or stores goods; to providers of electronic product-authentication services; and to anyone who uses platform data. In practice:

Manufacturers and importers of high-risk goods should expect sector-by-sector lists and roadmaps from their ministries, and should plan for UID labels, master-data entry and key-event certificates.
Distributors and retailers become responsible for signing the key events they control, such as invoicing.
Traceability software vendors and label printers gain a clearer market: their systems will need to connect to the national platform, and their contracts must allocate data liability.
Consumers should get a single, state-backed way to check a product, instead of dozens of private QR landing pages.

Open questions

Full text not yet public. As of 29 September 2026, the decree had not appeared in the Government’s legal-documents database. This post is based on the Government’s official summary, so details such as the annex, transition rules and any fees still need checking against the signed text.
Two platforms, one deadline. MOIT’s VeriGoods and the new national platform both cover high-risk goods from 1 January 2027. The public summary does not say how they will connect or whether a trader must declare data twice. The decree does require ministries to avoid “repeat declarations”.
The lists don’t exist yet. Mandatory coverage depends on each ministry publishing its high-risk list, key events and roadmap. Until then, how far the decree reaches is unknown.
Cost and access. The April 2026 draft let state agencies use the data for free while others paid service fees. Whether that survived into the final text is not yet public.

Sources

This post is general information, not legal advice.