South Korea AI Regulation & Governance

South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act, Act No. 20676), together with its Enforcement Decree, came into force on 22 January 2026 following Cabinet approval on 20 January 2026 (CLM-KR-59564941, CLM-KR-baa18027; Confirmed, T1-sourced). The Act applies with direct effect within Korea and carries extraterritorial reach to foreign AI business operators meeting statutory thresholds. Under the in-force Act, Article 26 establishes the Korea AI Promotion Association (CLM-KR-139c412c, Probable), and the Act further establishes a National AI Strategy Committee chaired by the President together with statutory AI cluster and AI-safety-institute infrastructure (CLM-KR-54a15ac2, Probable). Foreign AI business operators without a Korean presence that meet revenue or user thresholds set by Presidential Decree must, under Article 36, designate a domestic representative and notify the Ministry of Science and ICT (MSIT) (CLM-KR-0dd1f129, CLM-KR-b4bb6c99, both Probable). Operators providing high-performance AI meeting compute, technology and risk thresholds must build a lifecycle risk-management system and report results to MSIT (CLM-KR-27647af0, Probable). Enacted but not yet fully in force: under the amending Act No. 21311's transitional clause, a defined subset of amended provisions — Article 3(5), Article 6(2)(7)-(8), Article 16(3)-(5) (limited to the part concerning the amended provision of paragraph 2 item 2-2), Article 17-2, Article 18, Article 22-3, and the latter part of Article 35(1) — is deferred to the day six months after promulgation, commencing 21 July 2026 rather than the Act's general 22 January 2026 start date (CLM-KR-adc07475, Confirmed, T1-sourced). Separately, a Personal Information Protection Act (PIPA) amendment passed 20 August 2026 will permit use of personal information for AI development beyond its original collection purpose, subject to deliberation by the Personal Information Protection Commission, commencing 9 March 2027 (CLM-KR-45f75252, Probable).

Korea's AI Basic Act does not contain a European Union-style enumerated list of prohibited or unacceptable-risk AI practices. Instead, the stored record indicates that prohibited-practice-type concerns are addressed through the Act's high-impact AI risk-management duties, which apply to sensitive use-cases rather than through a freestanding prohibition regime (CLM-KR-f6c26092, Probable).

Under the AI Basic Act, in force since 22 January 2026, Article 34(1) requires operators of high-impact AI to establish and operate a risk-management plan, maintain explainability, implement a user-protection plan, ensure human oversight, and document these measures (CLM-KR-f5e3c214, Probable). High-impact AI is defined as an AI system that materially affects or risks human life, bodily safety or fundamental rights, used within one of ten statutorily listed domains including energy, drinking water, healthcare, medical devices, nuclear materials, biometric criminal investigation and rights-affecting judicial or administrative decision-making, per the stored record (CLM-KR-258f69b5, Probable). The Enforcement Decree sets the related 'high-performance AI' threshold at cumulative training compute of at least 10^26 FLOPs, combined with use of state-of-the-art AI technology and material risk to life, safety or fundamental rights, with all three elements required cumulatively (CLM-KR-be5aaa02, Probable); operators meeting the compute, technology and risk thresholds must build a lifecycle risk-management system and report results to MSIT (CLM-KR-27647af0, Probable). A foreign AI business operator with no Korean address or place of business must appoint a domestic representative and notify MSIT if it meets any one of: prior-year total revenue of KRW 1 trillion or more; AI-service revenue of KRW 10 billion or more; or 1,000,000 or more average daily domestic users (CLM-KR-bf315629, Probable). As of mid-2026, only Anthropic had completed the Article 36 domestic-representative filing with MSIT; Google's filing was rejected for missing contact information; and OpenAI, Meta and Microsoft had not yet filed despite meeting the Article 36 thresholds (CLM-KR-86d0451a, Probable). A further description, resting on a single lower-tier secondary source, indicates that high-impact AI operators must implement six categories of safety and trustworthiness measures — a risk-management plan, an explanation plan, user-protection measures, human oversight, document retention, and any further matter resolved by the National AI Strategy Committee — and should be read as indicative rather than independently confirmed primary-text enumeration (CLM-KR-6836e584, Probable).

Under the AI Basic Act's Enforcement Decree, in force since 22 January 2026, the threshold for 'high-performance AI' — Korea's functional analogue to a general-purpose or foundation-model category — is set at cumulative training compute of at least 10^26 FLOPs, combined with use of state-of-the-art AI technology and material risk to life, safety or fundamental rights, with all three elements required cumulatively before the threshold is met (CLM-KR-be5aaa02, Probable).

Under the AI Basic Act, in force since 22 January 2026, Article 31(1) requires deployers offering high-impact or generative AI products or services to give advance notice to end users before they engage with the product or service, i.e. before it is put into service (CLM-KR-398775d3, Probable; CLM-KR-f7c948c8, Probable). Where an AI business operator provides deepfake-type output, it must notify or mark the output so users can clearly recognise it was AI-generated; visible or audible marking is required, with an invisible watermark alone being insufficient, though artistic or creative works may use marking that does not impair the work (CLM-KR-8c477dfb, Probable). An AI business operator providing generative AI, or a product or service using it, must mark output as generated by generative AI, with stricter marking — a visible logo or machine-readable watermark or metadata — required for exported or downloaded content than for content used only within the service environment (CLM-KR-c056f357, Probable).

A Personal Information Protection Act (PIPA) amendment, passed 20 August 2026, will permit use of personal information for AI development beyond its original collection purpose, subject to deliberation by the Personal Information Protection Commission (PIPC). The amendment is enacted but not yet in force, commencing 9 March 2027 (CLM-KR-45f75252, Probable).

An AI business operator providing high-impact AI, or a product or service using it, must implement six categories of safety and trustworthiness measures under the in-force AI Basic Act regime: a risk-management plan, an explanation plan, user-protection measures, human oversight, document retention, and any further matter resolved by the National AI Strategy Committee. This enumeration rests on a single lower-tier secondary source rather than a directly retrieved primary enactment text in the record and is reported here with that qualification (CLM-KR-6836e584, Probable).

Under the in-force AI Basic Act, Article 34(1) requires high-impact AI operators to implement six categories of safety and trustworthiness measures prescribed by Presidential Decree; this description rests on a single lower-tier secondary source (CLM-KR-037e90a3, Probable). Operators must retain documentary evidence of the Article 34(1) measures for five years and post specified content at their place of business and/or website, with trade secrets excludable (CLM-KR-f3bdca96, Probable). Where an operator has implemented measures equivalent to Article 34(1) under other laws, such as Chapters 4 and 5 of the Personal Information Protection Act, it is deemed to have fulfilled the Article 34(1) obligations as to personal-data handling and protection (CLM-KR-011e4d3e, Probable). Operators must endeavour to obtain prior verification or certification of safety and trustworthiness under Article 30, and state bodies or public institutions intending to use high-impact AI must give preferential consideration to products or services based on AI that has obtained such certification; this account again rests on a single lower-tier secondary source (CLM-KR-a2deaa53, Probable). Unlike the EU AI Act, Korea's regime does not mandate third-party conformity assessment for high-impact AI: verification or certification under Article 30 is voluntary and state-supported, backed only by a fixed, comparatively modest administrative fine rather than turnover-based penalties (CLM-KR-dc13c1a4, Probable).

The in-force AI Basic Act establishes a National AI Strategy Committee chaired by the President, statutory AI cluster and AI-safety-institute infrastructure, and the Korea AI Promotion Association under Article 26 (CLM-KR-54a15ac2, Probable). Article 43(1) fixes a maximum administrative fine of KRW 30 million for three listed breaches: failure to give the Article 31(1) advance notice, failure to appoint a domestic representative, and non-compliance with a suspension or corrective order; this is reported from a single lower-tier secondary source (CLM-KR-68ef5357, Probable), and is corroborated by a further source confirming that the Act caps administrative fines at KRW 30 million per breach (CLM-KR-f1987ba0, Probable). MSIT has announced an enforcement grace period of at least one year from the Act's 22 January 2026 commencement, consistent with the stored milestone marking the grace period's scheduled end on 22 January 2027, during which fact-finding and administrative fines will generally not be pursued except in cases involving risk to life, serious human-rights infringement, or national-level harm (CLM-KR-6d2897a1, Probable; CLM-KR-4a49c35d, Probable; CLM-KR-f1987ba0, Probable). In an adjacent sectoral enforcement development, enacted but not yet in force, Korea's National Assembly passed an amendment to the Game Industry Promotion Act on 1 October 2026, strengthening local-representative obligations on overseas game operators; it takes effect in April 2027, with non-compliance with a corrective order potentially restricting game availability in Korea (CLM-KR-d5cf63af, Probable). As background enforcement precedent predating the AI Basic Act's commencement, DeepSeek temporarily suspended its application service in Korea on 15 February 2025, following a recommendation from the Personal Information Protection Commission to enhance compliance with the Personal Information Protection Act (CLM-KR-da11075d, Probable).

The AI Basic Act, in force since 22 January 2026, directs the government to actively support use of the existing ICT regulatory sandbox — temporary permits under Article 37 and demonstration special cases under Article 38-2 of the ICT Convergence Act — for AI-converged products and services developed with government R&D support. The stored record indicates no AI-specific sandbox regime has separately been established (CLM-KR-54fd1b1b, Probable).

Under the AI Basic Act's Article 36 domestic-representative requirement, the stored record shows a mixed compliance picture as of mid-2026: only Anthropic had completed the filing with MSIT; Google's filing was rejected for missing contact information; and OpenAI, Meta and Microsoft had not yet filed despite meeting the Article 36 thresholds (CLM-KR-86d0451a, Probable). Separately, on 29 June 2026 the South Korean government and major domestic firms announced a combined AI and semiconductor investment package of at least KRW 1,350 trillion (approximately USD 880 billion), comprising an 800 trillion won Samsung/SK Hynix fabrication project and a 550 trillion won AI data-centre investment (CLM-KR-069985fa, Probable). On 31 October 2025, Nvidia expanded its AI ties with Samsung, SK, Hyundai Motor Group and Naver, with over 200,000 GPUs allocated to drive AI-based manufacturing and industry-specific model development (CLM-KR-e1dfa006, Probable).