AI Governance & AI Basic Act Course

Contents

1. How to use this book
2. Chapter 1. Vendor policies and data terms

   A map of contractual documents · Same company, different terms · Specify the access route first · From three axes to five questions · Training defaults and exceptions · Retention: defaults, admin settings and zero retention · Human review and abuse monitoring · Storage location and processing location · DPA and processing status · Reading usage policies · Output rights and indemnity conditions · Building a plan-by-plan data terms comparison table · More features mean more data routes · The cost of zero retention

3. Chapter 2. Korea's AI Basic Act

   The hierarchy of legal documents and how to read them · History and effective dates · Definitions: AI systems and generative AI · Who is a business operator? · Scope and relationship with other laws · The two requirements for high-impact AI · Prior review and requests for confirmation of high-impact status · Responsibilities of high-impact business operators · Impact assessment, verification and certification · Ensuring transparency: notice and labeling · Safety obligations · Domestic representatives · Enforcement: investigations, corrective orders, fines and the grace period · Assessing whether a service is subject to obligations · Function-level analysis and change management · When other laws overlap

4. Chapter 3. Personal information and AI

   "Processing" through the AI life cycle · Processing principles · Choosing a processing basis · Additional use and use beyond the original purpose · Public personal information and legitimate interests · Sensitive information, unique identifying information and resident registration numbers · Special provisions for pseudonymized information · Anonymous information and re-identification risk · Entrustment, third-party provision and independent vendor use · Cross-border transfers · Automated decisions · Data subject rights, breach notification and impact assessment · Assessing lawful processing of AI training and inference data · Internal search and RAG: permissions and deletion must propagate · Personal information inside models · What the 2026 amendment means for AI operations

5. Chapter 4. Organizational policy and controls

   The first step in governance: an AI use inventory · Policy, standards, procedures and guidance · The structure of an AI use policy · Designing allowed, conditional and prohibited categories · Risk-proportionate approval procedures · Exception management · Accountability: who decides and who reviews? · Admin controls · Permission cleanup and oversharing · Controls for agents and connected features · Training and shadow AI · Supply chain and third-party management · Formal approval and automation bias · Changing and retiring AI systems

6. Chapter 5. Risk assessment and accountability

   Writing risks as harm scenarios · NIST AI RMF structure and starting flow · Seven characteristics of trustworthy AI · The Generative AI Profile's twelve risks · Four risk response options and residual risk · Mapping controls to risk levels · Distinguishing legal requirements from discretionary controls · Records and audits · Operational monitoring and incident response · ISO/IEC 42001: management system certification · Frontier safety frameworks · The traps of scoring · Nondeterministic outputs and reproducibility

7. Appendix A. Glossary
8. Appendix B. Self-check answers and explanations
9. Appendix C. Exam day guide
10. Appendix D. Reference documents