EU AI Act, GDPR and Vietnam’s PDPL: what companies building AI must have in place in 2026
Three sets of rules now shape any AI project serving European or Southeast Asian customers: the EU AI Act, whose obligations phase in between 2025 and 2027; the GDPR, which has governed personal data since 2018; and Vietnam’s Personal Data Protection Law, in force since 1 January 2026, alongside Singapore’s PDPA. None of them forbids useful AI. All of them require you to know what your system does with data and to be able to show it.
01The EU AI Act timeline in brief
- February 2025: prohibited practices banned, such as social scoring and manipulative systems.
- August 2025: obligations for general-purpose AI model providers and the governance structure in place.
- August 2026: most obligations apply, including transparency duties and the rules for high-risk systems listed in the Act’s Annex III.
- 2027: remaining high-risk obligations for AI embedded in regulated products.
For most business applications, such as document processing, assistants and recommendations, the Act means transparency (telling people they interact with AI), documentation and risk management proportionate to the use. High-risk categories, such as AI used in recruitment, credit, education or essential services, carry heavier obligations and deserve legal advice before you build.
02GDPR has not gone away
An AI feature that processes personal data is still a processing activity. You need a lawful basis, a purpose, a retention period, a data-processing agreement with every model provider, and a data protection impact assessment when the processing is likely to be high risk. Prompts, logs and embeddings count as data. “The model does not store it” is a question to verify with the provider, not an assumption.
03Vietnam’s PDPL and Singapore’s PDPA
Vietnam’s Personal Data Protection Law, effective January 2026, builds on the 2023 decree: consent requirements, data subject rights, impact assessments for sensitive data and rules on cross-border transfers. Companies with delivery teams in Vietnam must ensure that client data accessed by those teams is covered by contracts and technical controls. Singapore’s PDPA remains principle-based, with the Model AI Governance Framework giving practical guidance that regulators expect companies to follow.
Regulators do not expect perfection. They expect you to know what your system does and to be able to show it.
04The controls that cover most of it
- A data map for every AI feature: inputs, outputs, where data travels, which provider sees it, and for how long it is kept.
- Access control in the retrieval layer, so an assistant answers only from what the user may see.
- Regional hosting or self-hosted models when data must stay in the EU, Singapore or Vietnam.
- Logging and human review for decisions that affect people.
- A short model card per feature: purpose, data, known limitations, evaluation results, owner.
- Transparency in the interface: people know when they talk to AI and how to reach a human.
05What this means for vendors in Asia
European clients increasingly ask their Asian vendors for evidence: processing agreements, security policies, data residency options and the ability to run models privately. Vendors who can show these win the work; those who cannot are quietly removed from the shortlist.
06How Synova helps
Synova is GDPR-aligned, works with clients in France, Switzerland and Denmark, and delivers from Vietnam under contracts that cover the PDPL. Our AI projects start with a data map and ship with a model card, so compliance questions have written answers before anyone asks.
Frequently asked questions
Does the EU AI Act apply to a company outside the EU?
Yes, when the AI system is used in the EU or its output affects people in the EU. Vendors serving European clients should expect to provide documentation and transparency measures.
Is using a public AI model a GDPR problem?
It is a processing activity that needs a lawful basis, a processing agreement with the provider, and a check on where data travels and how long it is kept. Enterprise tiers and regional endpoints usually address this.
What documentation should an AI feature have?
A data map, a short model card (purpose, data, limitations, evaluation results, owner), the processing agreements and, where risk is high, a data protection impact assessment.
