South Korea · Law
Framework Act on the Development of Artificial Intelligence and Establishment of Trust (South Korea)
South Korea's AI Basic Act, in force 22 January 2026. High-impact AI duties, generative AI notices and labels, domestic representatives and the grace period.
South Korea's AI Basic Act is the country's comprehensive AI law, in force since 22 January 2026. It requires businesses to check whether their AI is high-impact AI, take safety and reliability measures for high-impact systems, notify users before they interact with high-impact or generative AI, and label generative output. Fines of up to KRW 30 million apply, but MSIT has deferred fines and fact-finding for at least a year except in highly exceptional cases.
What it is
The Framework Act on the Development of Artificial Intelligence and Establishment of Trust (인공지능 발전과 신뢰 기반 조성 등에 관한 기본법), usually called the AI Basic Act, is South Korea’s comprehensive AI law. It was promulgated as Act No. 20676 on 21 January 2025 and came into force on 22 January 2026, together with its Enforcement Decree.
The Act does two things. Most of it sets up national machinery to promote the AI industry, including a basic plan every three years and the National AI Strategy Committee chaired by the President. Chapter 4 sets binding obligations on AI businesses to build trust, centred on high-impact AI and generative AI.
It was amended by Act No. 21311, promulgated on 20 January 2026 and in force from 21 July 2026.
Who it applies to
The obligations fall on AI business operators, which the Act defines in two groups.
- AI developer businesses develop and provide AI.
- AI utilisation businesses provide AI products or services using AI supplied by a developer.
Both can be companies, organisations, individuals or public bodies. The Act applies to acts outside Korea that affect the Korean market or users. AI developed and used only for national defence or security, as specified by decree, is excluded.
What it requires
Check whether your AI is high-impact
Article 33 requires a business to review in advance whether the AI it provides is high-impact AI. It may ask MSIT to confirm. High-impact AI means an AI system that may significantly affect or endanger people’s life, physical safety or fundamental rights and is used in one of the listed domains. They are energy supply, drinking water production, healthcare provision, medical devices and digital medical devices, nuclear materials and facilities, biometric analysis for criminal investigation or arrest, judgements or evaluations that significantly affect rights and obligations such as hiring and loan screening, the operation of transport, government decisions affecting citizens such as eligibility for public services, and student assessment in early childhood, primary and secondary education. Further domains can be added by decree.
Measures for high-impact AI
Under Article 34, a business providing high-impact AI must implement measures to ensure its safety and reliability.
- Establish and operate a risk management plan.
- Establish and implement a plan to explain, as far as technically possible, the AI’s final results, the main criteria used to reach them and an overview of the training data.
- Establish and operate a user protection plan.
- Provide human management and supervision of the high-impact AI.
- Prepare and keep documents that show the safety and reliability measures taken.
- Any other measures the National AI Strategy Committee decides.
Measures already taken under other laws that correspond to these are treated as compliance.
Impact assessment
Article 35 asks businesses providing high-impact AI to endeavour to assess its impact on people’s fundamental rights in advance. Public bodies must give priority to products and services that have been assessed.
Transparency
Article 31 sets three duties.
- Notify users in advance that a product or service using high-impact or generative AI runs on that AI.
- Indicate that output from generative AI was generated by generative AI.
- Where an AI system produces sounds, images or video that are hard to distinguish from reality, notify or label it so users can clearly recognise it. Artistic and creative work can be labelled in a way that does not spoil it.
MSIT has said that non-deepfake output such as animation and webtoons may carry invisible digital watermarks.
Safety for the largest models
Article 32 applies to AI systems that meet all three criteria in the Enforcement Decree. They are trained with cumulative compute of 10^26 floating-point operations or more, built on state-of-the-art AI technology, and pose a risk of broad and serious effects on life, safety or fundamental rights. Their providers must identify, assess and mitigate risks across the AI lifecycle, build a risk management system that monitors and responds to safety incidents, and submit the results to MSIT.
Domestic representative
Article 36 requires foreign AI businesses without a Korean address or office to appoint a domestic representative if they meet decree thresholds. They are total revenue of KRW 1 trillion or more, AI service revenue of KRW 10 billion or more, an average of 1 million or more daily users in Korea, or a previous fine for failing to follow a corrective order.
Enforcement
MSIT can require materials and investigate where it suspects a breach of the labelling, safety or high-impact duties, and can order a business to stop or correct a violation (Article 40). Fines of up to KRW 30 million apply for failing to give the advance notice, failing to appoint a domestic representative, or failing to follow a stop or corrective order (Article 43).
Key dates
- 21 January 2025. Act promulgated.
- 20 January 2026. Amending Act No. 21311 promulgated.
- 22 January 2026. Act and Enforcement Decree in force. MSIT’s grace period of at least one year on fact-finding and penalties begins.
- 21 July 2026. Amending Act No. 21311 in force.
MSIT has also opened an AI Basic Act support desk for confidential, including anonymous, consultations.
How it relates to other frameworks
The Act’s structure is close to the EU AI Act’s. High-impact AI plays the role of high-risk AI, and both regimes require risk management, explanation, human oversight, documentation and labelling of generative output. The Korean duties are lighter, the impact assessment is best-efforts, and fines are much smaller. An organisation that already runs an ISO/IEC 42001 management system or works to the NIST AI RMF will find most of the Article 34 measures are already part of that work.
The Act sits alongside Korea’s Personal Information Protection Act, which separately gives individuals rights over fully automated decisions.
A note on this page
This is Aicura’s reading of the Act, written to help you find your way around it. It is not legal advice and it is not the Act itself. Read the primary text on the Korean National Law Information Center and MSIT’s guidance, and take advice on how they apply to your organisation.
Last reviewed 17 October 2026. This page explains the framework to support your governance work. It is not legal advice; read the official source for the authoritative text.
Questions
When does the Korean AI Basic Act take effect?
It came into force on 22 January 2026, together with its Enforcement Decree. The January 2026 amendment came into force on 21 July 2026.
Are fines being enforced?
MSIT announced a grace period of at least one year from 22 January 2026, during which fact-finding investigations and penalties are deferred. It said investigations would happen only in highly exceptional cases, such as incidents involving loss of life or human rights violations. The obligations themselves are in force.
What is high-impact AI?
An AI system that may have a significant effect on, or pose a risk to, people's life, physical safety or fundamental rights, used in a listed domain. The domains include energy supply, drinking water, healthcare and medical devices, nuclear facilities, biometric analysis for criminal investigation, judgements such as hiring and loan screening, transport, government decisions affecting citizens and student assessment, plus any domain added by decree.
Does the Act apply to foreign companies?
Yes. It applies to acts outside Korea that affect the Korean market or Korean users. Foreign AI businesses without a Korean address or office must appoint a domestic representative if they meet thresholds in the Enforcement Decree, such as total revenue of KRW 1 trillion or more, AI service revenue of KRW 10 billion or more, or an average of 1 million or more daily users in Korea.
Is the impact assessment mandatory?
The Act asks businesses providing high-impact AI to endeavour to assess its impact on fundamental rights in advance. It is a best-efforts duty rather than a fined one, but public bodies must give priority to products and services that have been assessed.
Start with the AI you run
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.