How to use this book
Caution
This is not legal advice. This book is study material for the AIDAN Specialty course. It summarizes and explains laws and vendor terms to help you understand them; it is not a legal opinion on any specific service or case. Whether a service is subject to an obligation, or which legal basis for processing is available, depends on the facts. Before making an actual decision, check the original text of the law in force on that day and have a lawyer or other qualified professional review it.
Checked on: 20 October 2026 (review changes rechecked on 21 October). The legal content in this book was compiled by reading the original texts at Korea's National Law Information Center.
- Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (AI Basic Act) [in force 21 July 2026] [Act No. 21311, 20 January 2026, partial amendment]
- Enforcement Decree of the same Act [in force 20 August 2026] [Presidential Decree No. 36580, 18 August 2026, amended by another statute]
- Personal Information Protection Act (PIPA) [in force 11 September 2026] [Act No. 21445, 10 March 2026, partial amendment]
- Enforcement Decree of the Personal Information Protection Act [in force 11 September 2026] [Presidential Decree No. 36671, 10 September 2026, partial amendment]
Vendor terms and policies, and NIST and ISO materials, were also checked on each organization's official pages on the same day. As of the check date, some matters remain unsettled or are due to change. No linked ministerial notice specifying the details delegated by the AI Basic Act (such as how to calculate cumulative training compute) was available on the National Law Information Center website, and the government has announced only that the grace period will last "at least one year", without setting an end date. Anthropic has already posted a revised usage policy taking effect on 12 November 2026, and NIST has stated that it is revising AI RMF 1.0. The text identifies the status of each such item.
Who this book is for
This book is written for two groups of readers. One is legal, compliance and information security staff who set their company's AI adoption policy; the other is planning and operations leads for AI services. The first group asks, "May we use this tool?" The second asks, "What must our service comply with?" Both questions lead to the same three tasks: reading vendor terms and laws accurately, translating them into organizational rules and settings, and recording decisions so that they can be explained later.
A White Belt (AI Literacy) level of understanding and even a little experience in privacy or compliance work are enough. Terms are explained when they first appear so that readers new to legal provisions can follow along.
By the end of this book, you should be able to create a plan-by-plan data terms comparison table, a function-by-function AI Basic Act obligations assessment, a memo reviewing the legal basis for processing personal information, a one-page AI use policy and a risk register. Each chapter's hands-on tasks guide you through one of these outputs.
This course does not replace legal advice on individual cases. Foreign laws are outside the exam scope and are not covered.
How this book is organized
The main text has five chapters in the same order as the exam domains. Chapter 1 covers vendor terms; Chapters 2 and 3 cover rules set by the state; Chapters 4 and 5 cover systems that organizations build for themselves. The terms identified in earlier chapters become the basis for the policies and controls in later chapters.
Each chapter has ten sections: learning objectives, introduction, key concepts, going deeper (trade-offs and boundary cases), at work (fictional cases showing rejected options as well), common mistakes, summary at a glance, check the official docs, self-check (with explanations in Appendix B), and hands-on tasks.
The appendices contain a glossary (A), self-check explanations (B), an exam day guide (C) and a list of the official documents cited in this book (D). Read the chapters in order the first time; for review, start with each chapter's "Summary at a glance" and "Common mistakes".
The exam at a glance
AI Governance & AI Basic Act (AGV) is a Specialty course. The Specialty exam has 35 questions in 60 minutes, and you pass with a raw score of 75 or more. The free practice set has 10 questions in 25 minutes.
| Chapter | Domain | Weight |
|---|---|---|
| Chapter 1 | Vendor policies and data terms | 20% |
| Chapter 2 | Korea's AI Basic Act | 25% |
| Chapter 3 | Personal information and AI | 20% |
| Chapter 4 | Organizational policy and controls | 20% |
| Chapter 5 | Risk assessment and accountability | 15% |
Questions on law are based on the laws in force at the time of the exam. When a reference date changes the conclusion, the question states that date. Vendor questions are based on the current content of official documents.
What the questions look like
Questions come in five formats. Most first describe a fictional organization and then ask for the most appropriate judgment or action in that situation.
| Format | What it looks like | Scoring | How to approach it |
|---|---|---|---|
| Single choice | One correct answer out of 4–5 options | Exact match | First underline the conditions in the scenario (who, which plan, what data, when), then read the options |
| Multiple choice | 2–3 correct answers out of 5–6 options | Correct only if you pick every right answer and no wrong one | Judge each option independently as true or false. Do not force a selection just to reach a number |
| Statement evaluation | Yes/No for each statement | Yes only if both the judgment and the reason are right | Even if the conclusion is correct, answer No if the reason has an incorrect article number or requirement |
| Ordering | Put 4–5 steps in order | The whole order must match | Order them by asking whether the output of one step becomes the input to the next |
| Matching | Link items on the left to choices on the right | Every pair must match | Eliminate the most certain pairs first, and remember that some choices may be unused |
Incorrect options in this exam are usually constructed in three ways. First, they combine separate commitments into one ("It is not used for training, so it is not stored"). Second, they grant exemptions or impose duties on grounds not found in the law ("Small businesses are not covered"). Third, they change the verb in a provision ("shall endeavor to" becomes "shall"). Each chapter's "Common mistakes" organizes these three types by topic.
Six-week study plan
This plan assumes 40–60 minutes a day, five days a week. If you have extensive practical experience, you can combine Weeks 1 and 2. You should have a tangible output at the end of each week.
| Week | Scope | Tasks | Output |
|---|---|---|---|
| Week 1 | Chapter 1 | Find and read the official documents for two AI tools you use | Data terms comparison table |
| Week 2 | First part of Chapter 2 (definitions to high-impact AI) | Read the original text of Articles 2 and 31–36 of the Act once | Draft function-by-function obligations assessment |
| Week 3 | Rest of Chapter 2, first part of Chapter 3 | Read Articles 23–29 and Schedules 1 and 2 of the Enforcement Decree, then revise your assessment | Notice and labeling design, processing basis memo |
| Week 4 | Rest of Chapter 3, Chapter 4 | Read the provisions on cross-border transfers and automated decisions | Data flow diagram, one-page AI use policy |
| Week 5 | Chapter 4 tasks, Chapter 5 | Review the NIST AI RMF Core and Generative AI Profile | Five-row risk register, agent permissions table |
| Week 6 | Full review | Repeat the self-checks and take the practice set | Review notes, Appendix C checklist |
Key point
Read each article in its original wording at least once. If you only read summaries, it is easy to miss the difference between "shall", "shall endeavor to" and "may". The exam often asks about exactly that difference.
Notation and sources
Article references. References use forms such as "Article 31(2)" for the Act and "Article 23(2) of the Enforcement Decree" for the Decree. An article without a law name refers to the law covered in that chapter: the AI Basic Act in Chapter 2 and the Personal Information Protection Act in Chapter 3. When a chapter cites another law, its name is given.
Strength of verbs. The verb in a legal sentence indicates the strength of the obligation. This book consistently uses the distinctions below.
| Wording | Meaning | Example |
|---|---|---|
| Shall / shall not | Obligation or prohibition | Prior notice under Article 31(1) |
| Shall endeavor to | Duty to endeavor. Failure to act is not immediately a violation, but may be disadvantageous in public procurement, for example | Impact assessment under Article 35(1) |
| May | Discretion or authority | Request for confirmation under Article 33(1) |
| May be exempted | An exception is possible | Article 23(4) of the Enforcement Decree |
| Shall be deemed | A legal deeming provision | Recognition of fulfillment under Article 27(3) of the Enforcement Decree |
Vendor and feature names. Product, feature and setting names retain their original spelling in official documents (for example, Zero Data Retention). Model versions and prices are not covered.
Fictional organizations. All companies and institutions in the text have invented names.
Status labels. Unsettled matters and government policies that are not statutory provisions are identified as such. Information that could not be confirmed in official documents has not been included.
Alert boxes. NOTE provides additional context; TIP highlights what you must remember; WARNING marks frequent sources of mistakes; EXAMPLE gives tasks to try yourself.