Circular No. 126/2026/TT-BQP on List of high-risk civil cryptographic products

CIRCULAR

Promulgating the List of high-risk civil cryptographic products under the management of the Minister of National Defence

          Pursuant to Law No. 05/2011/QH13 on Cipher;

          Pursuant to Law No. 05/2007/QH12 on Product and Goods Quality, which is amended and supplemented by Law No. 35/2018/QH14 and Law No. 78/2025/QH15;

          Pursuant to Law No. 68/2006/QH11 on Standards and Technical Regulations, which is amended and supplemented by Law No. 35/2018/QH14 and Law No. 70/2025/QH15;

          Pursuant to Law No. 116/2025/QH15 on Cybersecurity;

          Pursuant to the Government’s Decree No. 37/2026/ND-CP, detailing a number of articles and measures to organise and guide the implementation of the Law on Product and Goods Quality;

          Pursuant to the Government’s Decree No. 22/2026/ND-CP, detailing a number of articles and measures to organise and guide the implementation of the Law on Standards and Technical Regulations;

          Pursuant to the Government’s Decree No. 01/2022/ND-CP, defining the functions, tasks, powers and organisational structure of the Ministry of National Defence, which is amended and supplemented by Decree No. 03/2025/ND-CP;

          Pursuant to the Government’s Decree No. 09/2014/ND-CP, defining the functions, tasks, powers and organisational structure of the Vietnam Government Information Security Commission;

          At the proposal of the head of the Vietnam Government Information Security Commission;

          The Minister of National Defence promulgates the Circular promulgating the List of high-risk civil cryptographic products under the management of the Minister of National Defence.

          Article 1. Scope of regulation

          This Circular provides the List of high-risk civil cryptographic products under the management of the Minister of National Defence together with HS code in conformity with the List of Vietnam’s exported and imported goods, and corresponding quality management requirements.

          Article 2. Subjects of application

          1. Organisations and individuals that manufacture, trade in, or import high-risk civil cryptographic products on the List of high-risk civil cryptographic products promulgated together with this Circular.

          2. Agencies, units, organisations and individuals that are involved in the quality management of high-risk civil cryptographic products on the List of high-risk civil cryptographic products promulgated together with this Circular.

          Article 3. List of high-risk civil cryptographic products

          List of high-risk civil cryptographic products and corresponding quality management requirements are provided as follows:

          1. List of high-risk civil cryptographic products under the management of the Minister of National Defence is provided in the Appendix to this Circular.

          2. Corresponding quality management requirements for high-risk civil cryptographic products is provided in the Appendix to this Circular.

          3. For high-risk civil cryptographic products, the testing results serving as the basis for conformity certification must be carried out by testing organisations that are designated by the Minister of National Defence or recognised in accordance with the law on standards and technical regulations and the law on product and goods quality, and that have testing scope corresponding to the relevant national technical regulations.

          The recognition of testing results must comply with the law on standards and technical regulations.

          Article 4. Principles for the management of high-risk civil cryptographic products under the management of the Minister of National Defence

          1. The quality management of civil cryptographic products on the List of high-risk civil cryptographic products must comply with the law on product and goods quality; the law on standards and technical regulations; the Ministry of Science and Technology’s regulations on conformity certification, conformity declaration and quality inspection of products and goods; and corresponding national technical regulations.

          2. Civil cryptographic products on the List of high-risk civil cryptographic products promulgated together with this Circular that are simultaneously subject to 2 or more national technical regulations must fully meet the corresponding national technical regulations; and for which conformity assessment, conformity certification, and conformity declaration are carried out according to the risk level and corresponding quality management requirements specified in the List of high-risk civil cryptographic products promulgated together with this Circular, corresponding national technical regulations, and the provisions of the law on product and goods quality, and the law on standards and technical regulations; ensuring no duplication of conformity assessment contents for the same technical requirement that has already been assessed under corresponding national technical regulations.

          3. In case national technical regulations promulgated before the effective date of this Circular contain different provisions on quality management requirements for products and goods on the List of high-risk civil cryptographic products promulgated together with this Circular, the provisions of this Circular shall prevail.

          4. In case a national technical regulation is newly promulgated, amended or supplemented, or replaces another national technical regulation on the List of high-risk civil cryptographic products; or a national technical regulation is newly promulgated for additional application to civil cryptographic products on the List of high-risk civil cryptographic products promulgated together with this Circular, the provisions in the document promulgating such national technical regulation shall be applied from the effective date of that national technical regulation.

          Article 5. Transitional provisions

          1. In case legal documents, national technical regulations, or HS codes on the List of Viet Nam’s exported and imported goods referred to in this Circular are amended, supplemented or replaced, the amending, supplementing or replacing documents shall be applied, unless otherwise provided by transitional provisions in such documents.

          2. For civil cryptographic products on the List of high-risk civil cryptographic products promulgated together with this Circular which have been licensed and circulated on the market, within 24 months from the effective date of this Circular, they must satisfy the corresponding quality management requirements specified in the Appendix to this Circular.

          Article 6. Effect

          This Circular takes effect on September 2, 2026.

          Article 7. Organisation of implementation

          1. The head of the Vietnam Government Information Security Commission, heads of agencies and units, and related organisations and individuals shall implement this Circular.

          2. The Vietnam Government Information Security Commission shall inspect, urge and guide the implementation of this Circular; and assume the prime responsibility for, and coordinate with related agencies and units in, proposing competent authorities amendments and supplementations to the List of high-risk civil cryptographic products under the management of the Minister of National Defence to meet state management requirements in each period.

          3. Any problems arising in the course of implementation should be reported to the Ministry of National Defence (via the Vietnam Government Information Security Commission) for timely guidance.

The Minister of National Defence

GENERAL PHAN VAN GIANG

* The Appendix to this Circular is not translated.