The Luật Công nghiệp công nghệ số (Law on Digital Technology Industry, No. 71/2025/QH15) has been in force since 1 January 2026. It promises a long list of incentives: support for key digital products, semiconductor projects and AI data centres, priority in public procurement, regulatory sandboxes, a national digital-industry database. Until now it had no matching penalty regime of its own. On 4 November 2026 the Government filled that gap with Nghị định 401/2026/NĐ-CP, Quy định xử phạt vi phạm hành chính trong lĩnh vực công nghiệp công nghệ số (administrative sanctions in the digital technology industry). Deputy Prime Minister Hồ Quốc Dũng signed it on behalf of the Government. The signed copy was published on the Government portal on 6 November, and Báo Chính phủ reported it the same afternoon.
The decree takes effect on 22 December 2026. It runs to 4 chapters and 30 articles and was drafted by the Bộ Khoa học và Công nghệ (Ministry of Science and Technology, MOST).
The headline numbers
- Ceiling: 200 million đồng for an organisation, 100 million đồng for an individual (Điều 4). Every amount in the decree is the organisation rate; individuals pay half for the same act.
- Main penalties: a warning or a fine. Additional penalties: confiscation of the goods or means used, and expulsion of foreign nationals (Điều 3).
- Remedial measures: forced reporting or data connection, withdrawal or takedown of a digital product or service (or “appropriate technical measures”), re-export or destruction of goods, and surrender of illegal profits.
- Limitation period: one year as a rule, two years for the import-related offences (Điều 5).
The ceiling was contested during drafting. When the Ministry of Justice published the appraisal file in June, Hải Phòng argued that 200 million đồng would not deter large tech groups, and Tây Ninh asked for fines tied to a percentage of revenue. MOST kept the cap. It said 200 million is the maximum the Luật Xử lý vi phạm hành chính allows for this field, and it relies instead on profit surrender and confiscation to make violations unprofitable. The June draft also listed licence suspension as an additional penalty. The final text does not.
What is actually punished
Read the ten offence articles together and the target becomes clear: people who game the incentive system. Six of them (Điều 10, 11, 13, 14, 15 and 16) punish false information, invalid documents or fraud in applications:
- Key digital products, software production, AI system development and AI data centres (Điều 10): 30–60 million for ordinary incentives, 90–140 million for the “key product” and AI data-centre packages (including local-budget capital support and customs priority status), and 150–200 million where the project is a large-scale key-product or AI data-centre project. Faking the criteria to import used production lines for digital R&D costs 60–100 million, and the equipment can be confiscated or forcibly re-exported.
- Semiconductors (Điều 16): 90–140 million for false claims to chip-design training funds, used-equipment import rights, factory support, customs priority or corporate-income-tax incentives for electronics. Large-scale chip projects face 150–200 million.
- Talent policies (Điều 11, 30–60 million), innovative start-ups (Điều 13, 90–140 million) and state procurement preference for domestic digital products (Điều 14, 90–140 million).
- Concentrated digital technology parks (Điều 15): 90–140 million for faked recognition files or missed infrastructure deadlines. Running a park outside its approved function, expanding it without approval, or keeping it open after it stops meeting the criteria costs 150–200 million.
In every case the firm also has to give back the benefit it obtained.
The sandbox, the database and the “prohibited acts”
Điều 12 turns the controlled-testing (sandbox) regime into enforceable duties. A late report earns a warning. An inaccurate report that is not corrected costs 10–20 million, and no report at all costs 30–60 million. The top band of 150–200 million covers testing outside the licensed scope or after a suspension. It also covers failing to warn participants of risks, having no data-governance process against unauthorised access to participants’ personal data, skipping periodic risk assessments, and not publishing a complaints contact. Testing that qualifies for the liability exemption in Điều 22 of the Luật Khoa học, công nghệ và đổi mới sáng tạo (No. 93/2025/QH15) is expressly not sanctioned (Điều 3 k5). Lying to obtain that exemption, however, costs 90–140 million.
Điều 8 covers the digital-technology-industry database. A late online submission earns a warning. Incomplete or inaccurate data left uncorrected costs 10–20 million, and not submitting or connecting at all costs 30–60 million. Repeat failures are fined once, as an aggravating circumstance, and the limitation clock only starts on the day correct data is finally filed.
Điều 9 is the broadest article. Deliberately obstructing lawful hardware, software or digital-service work, or knowingly supplying a digital product to someone committing a prohibited act, costs 90–140 million. Using a digital product to commit a prohibited act (where no sector-specific decree applies) costs 140–170 million. “Exploiting” digital-industry activity to harm national security, public order, citizens’ rights or social morality costs 170–200 million. On top of the fine, regulators can confiscate the tools, order a product to be withdrawn or taken down, and expel foreign individuals.
Điều 17 handles the list of banned used digital products, which MOST re-issued last week in Thông tư 63/2026/TT-BKHCN. Misusing licensed imports or skipping required handling costs 100–140 million. Unlicensed processing for foreign traders, selling processed goods domestically, or importing banned items without permission costs 140–170 million, together with confiscation, re-export or destruction.
What it replaces, and who enforces it
The decree repeals Điều 74 and Điều 76 of Nghị định 15/2020/NĐ-CP (the posts, telecoms, IT and e-transactions sanctions decree, as amended by Nghị định 14/2022 and 211/2025). Those were the old IT-industry development and banned-used-IT-import provisions. Under the transition rules (Điều 29), violations that ended before 22 December but are discovered later are still handled under the old articles. Violations that are still continuing on that date fall under the new decree.
Enforcement is spread widely. Chairs of commune People’s Committees can fine up to 100 million and provincial chairs up to 200 million. Provincial Directors of Science and Technology can fine up to 160 million. MOST inspection teams and the head of the new Cục Công nghệ số và Trí tuệ nhân tạo (Department of Digital Technology and AI) can fine up to the full 200 million. Police can act on most articles (an officer on duty up to 20 million). Customs, border guards and the coast guard are limited to the import-related offences, and market surveillance only to Điều 17.
What it means in practice
- Incentive applicants (software firms seeking tax breaks, chip-design start-ups, AI data-centre investors, local suppliers bidding on state IT contracts) now face a defined fine plus clawback for padded applications. That is on top of losing the incentive itself.
- Sandbox participants should treat their approved test plan as a compliance document. The heaviest band is for straying outside it or neglecting participant protection.
- All digital-industry businesses should expect database reporting duties to be enforced from 22 December. The fines are modest, but the remedial order and the “continuing violation” rule mean the problem does not go away until the data is filed.
Open questions
The fixed cap still looks small next to incentives worth billions of đồng. Deterrence will depend on how aggressively profit surrender is used. The “prohibited acts” in Điều 9 are defined by cross-reference to the Law, so the boundary with cybersecurity, data-protection and press sanctions decrees will be tested case by case. Điều 9 k2 applies only where no specialised decree covers the act. The database itself also needs MOST’s implementing rules on what must be reported and when.
Sources
- Nghị định 401/2026/NĐ-CP, signed text (Cổng Thông tin điện tử Chính phủ)
- Government legal-document portal, list of new documents
- Báo Chính phủ: Vi phạm hành chính trong lĩnh vực công nghiệp công nghệ số bị phạt tới 200 triệu đồng (6/11/2026)
- VnEconomy: Cần rà soát lại mức phạt tối đa 200 triệu đồng trong lĩnh vực công nghiệp công nghệ số (12/6/2026, draft stage)
This post is general information, not legal advice.