Korea’s AI Basic Act explained: what the law requires and when it takes effect

This guide is for companies, startups, and professionals operating in South Korea who use or deploy artificial intelligence systems. The short answer: Korea’s AI Basic Act (Ingeong Jineung Beopnyul, or the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trustworthiness) has been in force since January 22, 2026, but full enforcement is being phased in gradually, with administrative fines largely deferred through at least the end of 2026 except in cases of serious harm.

How it works

The National Assembly passed the act on December 26, 2024. It was promulgated (officially published into law) on January 21, 2025, and entered force exactly one year later, on January 22, 2026. A supplementary Enforcement Decree (subordinate regulations that fill in the technical details) took effect on July 21, 2026.

The law creates two main categories of obligation.

High-impact AI

High-impact AI (고영향 AI, go-yeongyang AI) refers to AI systems used in sectors where errors can cause serious harm to people’s lives, safety, or fundamental rights. The act lists ten such sectors:

• Healthcare and medical devices
• Nuclear energy
• Energy supply
• Water production and supply
• Transport safety
• Biometric identification and analysis
• Hiring and employment decisions
• Credit and loan screening
• Public administration
• Education

Operators of high-impact AI must do four things before deployment. First, assess whether their system qualifies as high-impact AI. Second, provide users with a meaningful explanation of the AI’s outcomes, the key criteria it uses, and a summary of the training data behind it. Third, prepare and publish a user-protection plan. Fourth, build in a mechanism for human review and override of AI decisions.

Generative AI

Generative AI (생성형 AI) means systems that produce text, images, audio, or video from prompts. Operators must notify users in advance that AI is being used and label AI-generated content clearly. In-product uses such as chatbots or virtual assistants may satisfy this with a visible UI notice, logo, or pop-up. Exported synthetic content — for example, a video or article distributed outside the platform — requires clearer labeling.

Who is covered

The act covers AI developers and AI business operators (companies or individuals that deploy AI to end users). It has extraterritorial reach: foreign companies that provide AI services to users in Korea fall under its scope. Foreign operators with no Korean address or registered office must appoint a domestic representative in Korea.

Enforcement and grace period

The Ministry of Science and ICT (MSIT, 과학기술정보통신부) is the primary enforcement agency. MSIT can investigate operators, issue corrective orders, and impose administrative fines. However, MSIT announced a grace period covering at least all of 2026. During this period, routine fact-finding investigations and fines are generally deferred. Enforcement actions will proceed during the grace period only where there is serious social harm — such as loss of life or a human-rights violation. Repeated failure to comply with a corrective order can ultimately lead to a business suspension.

Why Korea does it this way

Korea has been a major semiconductor and electronics manufacturer for decades. Government policy has consistently treated technology leadership as a national priority. The AI Basic Act follows that tradition. Unlike the EU AI Act, which was designed primarily around risk containment, Korea’s law is explicitly framed as a dual-purpose instrument: promote AI development and establish minimum trust standards at the same time.

The one-year transition period before the act took force was intentional. Legislators wanted domestic companies — many of them small and medium-sized enterprises (SMEs) — to adapt without being immediately penalised. The continuing grace period on fines extends that logic into 2026.

The act also consciously sets a higher computational threshold for regulating general-purpose AI models (GPAI, large foundation models). The training-compute threshold above which a GPAI model triggers additional obligations is set roughly ten times higher than the EU’s equivalent threshold. This is widely understood as a deliberate regulatory gap designed to avoid burdening Korean companies building specialised vertical AI models while global foundation-model giants bear heavier compliance costs.

The numbers that matter

What it means for you

Companies deploying AI in Korea

Start by mapping your AI systems against the ten high-impact sectors. If any system falls into one of those categories, you need a user-protection plan and an explanation mechanism in place before you go live. Labeling requirements for generative AI are already active, so review your product UI to ensure AI disclosure is visible to users.

Foreign companies with no Korean entity should check whether they need to appoint a domestic representative. MSIT has not yet published a formal list of who must do this, so check the current guidance at the MSIT official website (msit.go.kr) or consult Korean legal counsel.

Investors and Korea-watchers

The low fine ceiling (KRW 30 million) makes the act relatively light on financial risk for most medium and large companies. The more meaningful pressure is reputational and operational: corrective orders, business suspension powers, and the requirement to explain AI decisions in regulated sectors all have real business consequences. Watch for future amendments that could raise fine levels or expand the list of high-impact sectors.

Workers and individuals

If an employer uses AI to make hiring decisions, Korean law now requires that employer to explain how the AI reached its conclusion and to have a human review mechanism in place. If you believe an AI decision affected your employment or a credit application, you have a right to request an explanation from the operator.

FAQ

Does the act apply to my company if we are headquartered outside Korea?

Yes. The act has extraterritorial reach. If your AI product or service is used by people in Korea, you are covered regardless of where your company is based. Foreign operators without a Korean office or address are expected to designate a domestic representative in Korea. The precise criteria for when a representative is required are set out in the Enforcement Decree that took effect in July 2026.

What is the difference between this law and the EU AI Act?

Both laws use a tiered, risk-based approach and require transparency for high-risk or high-impact AI. The key differences are in emphasis and penalties. Korea’s act prioritises industry development alongside safety and carries a maximum fine of roughly USD 21,000 — far below the EU’s maximum of approximately USD 41 million. Korea also does not include a list of prohibited AI practices, whereas the EU bans certain uses outright, such as real-time remote biometric surveillance in public spaces. Korea’s compute threshold for regulating large foundation models is also set much higher than the EU’s.

Are fines being enforced right now?

Generally no, not for routine violations. MSIT has announced a grace period covering at least all of 2026 during which administrative fines and most investigations are deferred. The exception is cases involving serious social harm such as loss of life or fundamental human-rights violations, which can trigger enforcement immediately. The grace period may be extended or ended by MSIT; check the current MSIT guidance at msit.go.kr for the latest status.

Browse all Le Won guides