Chapter 2. Korea's AI Basic Act

Learning objectives

• Explain the differences in legal force among Acts, Enforcement Decrees, ministerial notices and guidelines, and when the AI Basic Act took effect.
• Apply the definitions of AI system, generative AI, high-impact AI, development business operator, utilization business operator, user and affected person to cases.
• Distinguish transparency, safety and high-impact obligations and domestic representative requirements using the Act and Enforcement Decree.
• Explain the relationship among fact-finding investigations, corrective orders and administrative fines, and the nature of the government-announced grace period.
• Break services into functions, assess which obligations apply, and refer uncertainties for confirmation requests or legal review.

Introduction

A startup founder asks, "We do not develop models; we only use an overseas model through its API. Does the AI Basic Act concern us?" The answer is yes. The Act treats companies that provide products or services using another party's AI as AI business operators, alongside companies developing AI themselves. Providing a service with generative AI also carries transparency obligations even if it is not high-impact.

Excessive concern is also common: "Recruitment AI is always high-impact, and high-impact AI must undergo an impact assessment." This is not accurate either. High-impact status requires both a specified area and significant impact, and the wording on impact assessment establishes a duty to endeavor.

All statutory quotations in this chapter are based on the current texts read at the National Law Information Center on the check date. Keep the original Act and Enforcement Decree open beside you as you read. This chapter begins with the hierarchy of legal documents and effective dates. It then covers definitions and scope, high-impact assessment and responsibilities, transparency and safety obligations, domestic representatives and enforcement. Finally, it combines the provisions into an assessment procedure for practicing function-by-function analysis of actual services.

Key concepts

The hierarchy of legal documents and how to read them

AI Basic Act rules are distributed across four layers of documents.

Guidelines are not binding, but indicate the government's enforcement direction. They cannot create duties beyond the statutory wording. Identify the document layer of each source in your assessment memo.

The Act has two axes: promotion (basic plans, the National AI Strategy Committee, AI Safety Institute and industry support) and trust (ethical principles, verification and certification support, and business obligations). The practical focus is on Articles 2, 4, 31–36, 40 and 43.

History and effective dates

The responsible ministry is the Ministry of Science and ICT (MSIT). The Enforcement Decree is final and in force, not at the legislative notice stage. Distinguish promulgation dates, effective dates and provision-specific effective dates. Different provisions within one amendment can take effect on different dates, as stated in the addenda.

Definitions: AI systems and generative AI

The definitions in Article 2 are the starting point for all obligations.

• Artificial intelligence: Electronic implementation of human intellectual abilities such as learning, reasoning, perception, judgment and understanding language.
• AI system: An AI-based system that, with varying levels of autonomy and adaptiveness, infers outputs such as predictions, recommendations and decisions affecting real and virtual environments for given objectives.
• Generative AI: An AI system that imitates the structure and characteristics of input data to generate text, sound, images, video and various other outputs.
• Training data: Data used in AI development, utilization and related activities.

Pay attention to "infers". A program executing fixed rules differs from a system inferring outputs from learned data patterns, but the Act does not define the boundary as a checklist. Ask whether a trained model generates outputs, whether outputs change with inputs, and whether those outputs inform judgments or actions. If uncertain, mark "Potentially applicable" and continue reviewing obligations.

Who is a business operator?

An AI business operator is a corporation, organization, individual, state agency or similar entity conducting business related to the AI industry. There are two categories.

• AI development business operator: A party developing and providing AI.
• AI utilization business operator: A party providing AI products or services using AI supplied by a development business operator.

A user receives an AI product or service; an affected person experiences significant impacts on life, physical safety or fundamental rights from it. Users and affected persons may differ. A recruitment assessment tool's user is the employer's HR officer, while the affected person is the applicant.

Mapped onto the value chain, these roles look as follows.

MSIT's Guidelines for Ensuring AI Transparency interpret the transparency obligations as applying to AI business operators directly providing AI products or services to users, including overseas operators serving Korean users. Conversely, users employing AI as a work or creative tool are not subject to those obligations. This is a guideline interpretation; check the wording of the relevant provision separately to see whether the same conclusion holds for other obligations.

Scope and relationship with other laws

Extraterritorial application (Article 4(1)): Conduct outside Korea is covered if it affects the Korean market or users.

National defense and security exclusion (Article 4(2), Enforcement Decree Article 2): The Act does not apply to AI developed and used solely for national defense or national security as prescribed by the Decree: AI performing only duties designated by the Minister of National Defense, Director of the National Intelligence Service or Commissioner General of the Korean National Police Agency, involving defense information systems and weapons systems, counterterrorism and counterintelligence, or investigations into industrial technology leaks. "Solely" is crucial: products developed or used outside the designated activities are not excluded even if they use the same technology.

Relationship with other laws (Article 5): Special provisions in other laws on AI and related matters take priority; otherwise this Act applies. PIPA also applies to personal information processing, for example, and the Credit Information Use and Protection Act to credit assessment. Chapter 3 explores the intersection with PIPA in detail.

The two requirements for high-impact AI

High-impact AI is an AI system meeting both requirements. First, it must pose a potential significant impact or risk to human life, physical safety or fundamental rights. Second, it must be used in an area listed in Article 2, subparagraph 4.

As of the check date, no additional area under item (k) could be found in the Enforcement Decree. High-impact assessment is like a safe requiring two matching keys: the area key alone cannot open it, nor can the impact key alone. Therefore, a dangerous system outside the statutory areas is not high-impact under this provision. It may still be high-risk under internal organizational risk management (Chapter 5).

Prior review and requests for confirmation of high-impact status

Article 33(1) requires AI business operators to conduct a prior review of high-impact AI classification when providing AI or products and services using it. Review is mandatory; requesting ministerial confirmation is optional "where necessary". Article 25 of the Enforcement Decree sets the procedure.

1. Request: Submit the prescribed confirmation request form with a product or service overview, training data overview, and materials showing the utilization process and outputs, among others.
2. Assessment factors: The minister considers whether use falls within statutory areas; impact, severity and frequency of risks and area-specific characteristics; the operator's prior review; and expert committee advice.
3. Reply: Within 30 days of receipt. If complexity or similar factors prevent this, one extension of up to 30 days is possible, with written notice of the reasons and duration.
4. Reconfirmation: An operator objecting to the reply submits a reconfirmation request within 10 days of receiving it. The minister seeks expert committee advice and replies within 30 days.

The expert committee comprises at least 50 members and may establish five-member subcommittees. Article 33(3) permits the minister to prepare and distribute guidelines on high-impact AI criteria and examples.

Responsibilities of high-impact business operators

Operators providing high-impact AI or products and services using it must implement the measures in Article 34(1).

Article 27 of the Enforcement Decree provides the following detailed rules.

• Publication and trade secrets: Publish key details of subparagraphs 1–4 at offices, business premises, websites or similar places. Trade secrets under the Unfair Competition Prevention and Trade Secret Protection Act may be excluded. Only the trade-secret portions may be excluded; withholding all information is not permitted.
• Recognition of fulfillment by utilization business operators: If an operator receives a system for which the developer implemented measures 1–3, and makes no significant functional change such as substantially changing the original purpose or use, those measures are deemed fulfilled. A substantial change of use removes this recognition.
• Requests for materials: Utilization business operators may request materials needed to fulfill responsibilities from developers, who must endeavor to cooperate.
• Recognition of fulfillment under other laws (Act Article 34(3), Enforcement Decree Schedule 1): Quality management under the Digital Medical Products Act, autonomous vehicle performance certification, compliance with Credit Information Act explanation duties and procedures in loan screening, and responsibilities under the Financial Consumer Protection Act can count as fulfillment of the corresponding subparagraphs. PIPA safeguards, privacy policies, impact assessments and automated decision responses count as corresponding measures for personal information processing and protection.

Article 34(2) permits the minister to issue notices detailing the measures and recommend compliance.

Impact assessment, verification and certification

Impact assessment (Article 35): Providers of products or services using high-impact AI shall endeavor to assess impacts on fundamental rights in advance. The 2026 amendment added that assessments should reflect the characteristics of AI-vulnerable groups. State agencies and similar bodies planning to use high-impact AI products or services shall give priority consideration to those that have undergone impact assessment. Thus, although it is a duty to endeavor, it may effectively become a competitive condition in public procurement.

If you decide not to undertake the assessment this time, record why and what would trigger reconsideration, rather than simply saying "not conducted". Article 28(1) of the Enforcement Decree lists seven assessment items: identifying potentially affected individuals or groups (reflecting vulnerable groups' characteristics); types of fundamental rights affected; nature and scope of social and economic impacts; patterns of use; quantitative and qualitative indicators and calculation methods; risk prevention, mitigation and loss recovery; and implementation plans where improvements are needed. Operators can assess directly or commission a third party.

AI-vulnerable groups are prescribed by Enforcement Decree Article 1-2. There are ten categories, including people aged 65 or older, persons with disabilities, recipients and near-poor groups under the National Basic Living Security Act, multicultural family members and North Korean defectors.

Verification and certification (Article 30): Providers of high-impact AI must endeavor to obtain verification and certification in advance, and state agencies and similar bodies must give priority consideration to verified or certified products and services. These are voluntary verification and certification activities by private organizations and similar bodies.

Ensuring transparency: notice and labeling

Article 31 has three obligations, each covering different subjects.

There are three exceptions (Enforcement Decree Article 23(4)) under which exemptions from all or part of the obligations may be granted: where the service name or screen wording makes high-impact or generative AI use obvious; use solely for the operator's internal work; and cases specified by ministerial notice. No notice under the third exception was confirmed at the National Law Information Center as of the check date.

Government transparency guidelines distinguish outputs provided only within the service environment from those exported outside through downloading or sharing. Within the service, flexible labeling such as on-screen notices or logos is allowed; conversational services can give notice before use or display a logo on screen. Exported outputs should have a human-perceptible watermark or similar label, or a machine-readable label such as metadata after a text or audio notice. Outputs difficult to distinguish from reality (such as deepfakes) require clearly human-perceptible labeling. Artistic or creative works may, however, use methods that do not hinder exhibition or enjoyment under the latter part of Article 31(3).

Safety obligations

Article 32 applies to AI systems whose cumulative training compute meets or exceeds the threshold set by the Enforcement Decree. Article 24(1) requires systems to meet all three criteria.

1. Cumulative training compute of at least 10^26 floating-point operations
2. Construction and operation using the most advanced AI technology currently in use
3. A potential broad and significant risk to human life, physical safety and fundamental rights

Covered operators must identify, assess and mitigate risks throughout the life cycle, maintain a risk management system monitoring and responding to safety incidents, and submit implementation results to the minister. Detailed compute calculation and implementation methods are delegated to ministerial notice, but no linked notice was confirmed at the National Law Information Center as of the check date. Enforcement Decree Article 33 requires review of the applicability criteria every three years from 1 January 2026.

This obligation is unrelated to most companies. Exceeding the compute threshold alone is insufficient, and this is a separate regime from high-impact AI.

Domestic representatives

An AI business operator with no Korean address or place of business that meets any one criterion in Enforcement Decree Article 29 must designate a domestic representative in writing and notify the minister (Article 36).

Revenue is converted to KRW at the average exchange rate for the previous year (previous fiscal year). The domestic representative acts on implementation result submissions, high-impact confirmation requests and support for fulfilling responsibilities (including checking that documents are current and accurate). The representative must have a Korean address or place of business. A violation by the representative in these duties is deemed an act of the appointing business operator.

Enforcement: investigations, corrective orders, fines and the grace period

Fact-finding investigations (Article 40): If the minister discovers or learns of suspected violations of Article 31(2) or (3) (labeling), Article 32(1) or (2) (safety), or Article 34(1) (high-impact responsibilities), or receives a report or complaint, the minister may demand materials or investigate, including entry into offices. If a violation is established, necessary suspension or corrective measures may be ordered.

Administrative fines (Article 43) are capped at KRW 30 million and have only three grounds. Schedule 2 of the Enforcement Decree gives the following amounts (amounts in units of KRW 10,000).

Repeat violations are counted where a fine was imposed for the same violation within the last two years. Fines may be reduced by up to half for small and medium-sized enterprises, venture firms, small businesses, minor negligence or errors, recognized corrective efforts and similar grounds (excluding those in arrears). Serious violations or violations lasting at least six months may lead to the fine being increased by up to half, without exceeding the statutory ceiling.

Output labeling violations (Article 31(2) and (3)) are not themselves grounds for a fine. They become grounds when the operator fails to comply with a corrective order issued after a fact-finding investigation.

Assessing whether a service is subject to obligations

This chapter's practical skill is determining which obligations apply to a service. Repeat the following procedure for each function.

1. Break down functions: Separate the service into user-visible functions. An app with a support chatbot, recommendations and image generation gets three rows.
2. AI applicability: Assess whether each function is an AI system and whether it is generative.
3. Status: Determine whether the company is a development business operator, utilization business operator or user employing a tool without providing it.
4. Scope: Check impact on the Korean market or users, and the national defense and security exclusion.
5. Transparency: Apply prior notice under Article 31(1) for generative or high-impact AI, labeling under paragraph (2) for generative AI, and paragraph (3) for outputs difficult to distinguish from reality. Review exceptions under Enforcement Decree Article 23(4).
6. High-impact status: Record prior review of the statutory area and potential significant impact. Consider a confirmation request if uncertain. If applicable, document Article 34 responsibilities, Article 35 assessment efforts and Schedule 1 recognition.
7. Safety: Check all three criteria in Enforcement Decree Article 24.
8. Domestic representative: For overseas operators, check Enforcement Decree Article 29.
9. Separate uncertainties: List unresolved items under "Legal review", "Consider ministerial confirmation request" or "Await final ministerial notice".

Going deeper

Function-level analysis and change management

Obligations assessment is not completed once at launch. A different use of the same model can change the conclusion. Moving from internal document summarization to customer loan advice removes the internal-work exception and may enter a statutory area. A utilization business operator receiving a high-impact system whose developer fulfilled the responsibilities loses recognition under Enforcement Decree Article 27(3) if it substantially changes the original use.

Record changes that could alter the conclusion in advance. Typical triggers include changes in users (adults to children), output format (text to realistic video), decision method (reference material to automated decisions) and distribution route (within the service to external export). Reopen the assessment when such changes appear in a proposal.

When other laws overlap

Multiple laws often apply to one AI service. Loan screening AI can simultaneously involve high-impact responsibilities under the AI Basic Act, explanation duties under the Credit Information Act and automated decision responses under PIPA. Schedule 1 of the Enforcement Decree reduces duplication by recognizing some measures under other laws as fulfillment of AI Basic Act measures.

Recognition is, however, subparagraph-specific. Complying with the Credit Information Act Article 35-2 explanation duty and maintaining procedures under Article 36-2(1) counts toward subparagraph 2 (explanation plan) for loan screening; fulfilling Financial Consumer Protection Act responsibilities counts toward subparagraph 3 (user protection plan). Subparagraphs 1 and 4 are not automatically resolved. Record a recognition basis or separate implementation plan for every subparagraph to expose gaps.

At work

Badaro Mobility: shuttle dispatch AI and a support chatbot

Badaro Mobility, a metropolitan commuter shuttle operator, is preparing two AI functions. One automatically adjusts dispatch intervals and routes using real-time traffic and booking demand; the other answers booking and refund questions. The dispatch system is developed in-house, while the chatbot uses an overseas developer's model through an API.

The compliance officer split the functions into two rows. For dispatch, the company is a development business operator and provider. Because it can affect passenger and road-user safety, Article 2, subparagraph 4(h) (major functioning and operation of transport) could apply. The issue was whether dispatch and route decisions count as "major functioning" when a human drives.

The argument "It is not autonomous driving, so it is not high-impact" was insufficient, since item (h) broadly includes major functioning and operation of transport vehicles and systems. "All transport is high-impact" was also rejected for omitting the significant-impact requirement. The officer recorded prior review, prepared a ministerial confirmation request, and drafted a risk management plan and supervisor designation in case high-impact status applied. Schedule 1 recognition of autonomous vehicle certification did not cover the company's vehicles, so separate fulfillment was recorded as necessary.

For the chatbot, the company is a utilization business operator. The entry screen discloses AI support (prior notice), the conversation window shows an AI label (in-service output labeling), and a human agent finalizes refund decisions. The assessment ends with "Dispatch system: prepare as high-impact pending reply" and "Obligations remain in force during the grace period".

Haram Commerce: one company, three conclusions

Fashion retailer Haram Commerce has three AI functions. Generative AI creates and posts product descriptions from sellers' photos; virtual try-on produces realistic images of customers wearing clothes from their own uploaded photos (customers can attach these to reviews); and HR subscribes to an external solution's application assessment tool for the company's recruitment.

The legal officer assessed each separately. Product descriptions are a generative AI service provided to sellers, requiring prior notice on the seller screen and review of labeling for published text. In response to the argument that sellers often revise the text, the company decided to use guidelines and legal review rather than arbitrarily assuming that editing removes the labeling obligation.

Virtual try-on could create images difficult to distinguish from reality, potentially invoking Article 31(3). Clearly human-perceivable labels were added to outputs and preserved when other users viewed images in reviews. Processing facial photos also triggered Chapter 3's personal information review.

The recruitment tool prompted the longest discussion. The HR solution company develops and provides it; Haram Commerce uses it for its own recruitment. The officer confirmed that Article 34 responsibilities apply to business operators providing high-impact AI, and requested the solution company's prior review results and implementation evidence before contracting. Haram Commerce's direct duties to applicants were recorded separately. Rejection without meaningful human involvement is an automated decision under PIPA Article 37-2, so the process was changed: HR must review AI scores together with other assessment factors and have authority to change outcomes, rather than merely rubber-stamping scores. The value-chain table puts Haram Commerce closer to a user employing a tool for its own work. Whether the same conclusion holds for high-impact responsibilities lacked an official interpretation, however, and remained subject to legal review.

Common mistakes

1. "If it is not high-impact, the Act imposes no duties." Article 31 prior notice and labeling also apply to generative AI.
2. "Only the model developer has obligations." Utilization business operators providing services with another party's model are AI business operators too.
3. "Use in a statutory area automatically makes it high-impact." Both the area requirement and potential significant impact or risk are necessary.
4. "High-impact AI must undergo impact assessment." The wording is "shall endeavor to". State agencies and similar bodies must, however, give priority consideration to assessed products.
5. "Labeling violations immediately mean a fine." There are three grounds: failure to give prior notice, designate a domestic representative or comply with a suspension or corrective order.
6. "Trade secrets excuse publishing responsibility details." Only information qualifying as trade secrets may be excluded.
7. "Exceeding 10^26 operations alone triggers safety obligations." All three criteria are required: compute, the most advanced technology and potential broad and significant risk.
8. "There are no obligations during the grace period." The grace period is government policy on investigations and fines; the obligation provisions are in force.

Summary at a glance

Check the official docs

• National Law Information Center — AI Basic Act: Current text, addenda and history. Read Articles 2, 4, 31–36, 40 and 43 in the original.
• National Law Information Center — AI Basic Act Enforcement Decree: Articles 1-2, 2 and 23–29, Schedules 1 and 2, and prescribed forms.
• Korea Policy Briefing — AI Basic Act takes effect on the 22nd: Commencement, grace period policy and support desk.
• Korea Policy Briefing — Guidelines for Ensuring AI Transparency released: Obligated parties and labeling standards for in-service provision and external export.
• Ministry of Science and ICT: Latest guidelines, ministerial notices and announcements.

Self-check

2-1. State the AI Basic Act's effective date and enacting Act number, and explain which provisions in the January 2026 amendment had different effective dates.

2-2. Distinguish Acts, Enforcement Decrees, ministerial notices and guidelines by binding force, and identify which layer's status was uncertain as of the check date.

2-3. A company sells document-drafting features to consumers using an external model through an API. List its Article 31 duties by paragraph, explaining why any paragraph does not apply.

2-4. State the two requirements for high-impact AI, and explain in one sentence when use in a statutory area might not be high-impact.

2-5. List the steps and deadlines for an operator disagreeing with the reply to a high-impact confirmation request.

2-6. State the four publication items under Enforcement Decree Article 27 and the document retention period. Distinguish what trade secrets do and do not permit.

2-7. State the enforcement steps, with article references, leading from a failure to label outputs to an administrative fine.

2-8. (Design) Invent a service with two generative AI functions and one potentially in a statutory area. Apply all nine assessment steps in a table, separating uncertainties.

Hands-on tasks