In advance of South Korea’s first AI Act taking effect in January 2026, a recently published draft presidential decree has clarified the regulatory framework, resolving some initial uncertainties. The law seeks to balance innovation and safety, with the government explicitly stating its commitment to a “minimum regulation” approach.
South Korea
Technology
To print this article, all you need is to be registered or login on Mondaq.com.
Stance
The Korean government’s AI journey began in December 2019
with the announcement of the National AI Strategy, which formally
identified AI and semiconductors as Korea’s key future
industries. This commitment was reinforced at the AI Seoul Summit
in May 2024, where the nation positioned itself to become a global
AI leader. The National Assembly has also been active, with debates
and nearly 19 different legislative proposals culminating in the
enactment of the Basic AI Act in January 2025.
The law, officially titled the “Framework Act on the
Development of Artificial Intelligence and Establishment of Trust
Foundation,” serves a dual purpose: to build trust through
risk regulation and to foster AI development with government
support and industrial infrastructure. It is, in essence, a
foundational framework for all AI-related activities in Korea.
The government’s recent announcement of a draft presidential
decree explicitly signaled a shift toward a promotion-first,
“minimum regulation” approach, applying only the most
essential rules to the industry. This reflects the government’s
strong commitment to enhancing AI competitiveness by clarifying and
specifying legal provisions, and to operating a reasonable and
flexible regulatory system with the minimum necessary
regulations.
The Long-Awaited Decree and a Path to Clarity
As Korea’s first foundational AI law, the Act’s
enactment prompted many AI providers to seek clarity on new
obligations, particularly regarding transparency requirements. They
eagerly awaited subordinate regulations that would provide concrete
details, such as how high-impact AI would be determined and how
compliance would be achieved in practice.
However, the publication of subordinate regulations was
continuously delayed. The draft of the presidential decree was
finally announced in early September, just three and a half months
before the law’s effective date. While the decree resolves some
previous uncertainties by specifying certain details, a great deal
of practical guidance remains undefined and will need to be fleshed
out in future guidelines. It is expected that the draft decree will
be finalized this month and put up for public legislative notice in
October.
This legislative delay has created significant uncertainty for
regulated businesses. Fortunately, the government has adopted a
clear “minimum regulation” stance, deferring penalties
like administrative fines for a grace period whose length is still
under discussion. While this postpones active enforcement,
businesses are still obligated to comply with the law’s
transparency and safety requirements, with specific methods for
fulfilling these duties to be specified over time.
A positive sign is the formation of a subordinate regulations
task force, which aims to prepare guidelines and notices. This
initiative suggests that greater clarity on the Act’s
application is on the horizon. Furthermore, the government has
stated its intention to flexibly adapt its regulatory framework by
considering AI trends in the U.S., EU, and Japan. In short, while
Korea’s AI Act is a proactive legislative effort, its final
form remains a work in progress, and its evolution will need to be
closely monitored.
Specifics of the Regulations
The AI Act itself contains only a few provisions that directly
impose obligations on AI service providers. When including the
draft presidential decree, the regulatory content can be summarized
into four key points:
Transparency for High-Impact and Generative AI: This obligation
requires advance notice to users for both high-impact and
generative AI, as well as clear labeling of generative AI outputs.
The decree clarifies that advance notices can be provided through
terms of service or displayed on the user’s screen. Outputs can
be marked with either human- or machine-readable labels, including
invisible watermarks. A stricter rule applies to deepfake content,
which must be clearly recognizable to users, with consideration for
the primary users’ age and physical or social conditions. These
obligations are exempt for internal business use or when the
AI’s use is already apparent.
Risk Management for Large-Scale AI: Large-scale AI
providers—those trained with more than 1026 floating-point
operations—must evaluate and mitigate risks throughout the AI
lifecycle and establish a risk-management system to handle safety
incidents.
Specific Requirements for High-Impact AI: Once an AI system is
designated as “high-impact” by the Minister of Science
and ICT, providers must publish key information on their website.
This includes risk-management policies, organizational structures,
user protection measures, a summary of training data, and the
contact details of the person responsible for overseeing the
system.
AI Impact Assessment: While not a strict obligation, providers
of high-impact AI are encouraged to undergo an AI impact
assessment.
Finally, the Act includes clauses on extraterritorial
application, meaning it applies to activities carried out abroad if
they affect the Korean market or users. Providers without a Korean
office but who meet a certain user or revenue threshold will be
required to designate a domestic representative. This threshold is
defined by criteria similar to the Personal Information Protection
Act, including a total revenue of 1 trillion KRW (approximately 750
million USD) or an average daily domestic user base of 1 million
over a three-month period. The AI Act adds a new criterion: an
annual revenue from AI services of 10 billion KRW (approximately
7.5 million USD) or more.
Conclusion
Korea’s proactive enactment of the Basic AI Act in January
2025 marks a significant step towards becoming a global AI leader.
The subsequent draft presidential decree provides a crucial first
glimpse into the specifics of the regulatory framework, clarifying
key obligations and dispelling some initial uncertainties. While
this legislative and regulatory effort is an ongoing process, the
government’s clear stance on “minimum regulation,”
coupled with a flexible and pragmatic approach, aims to balance the
needs for both industrial growth and user protection. The upcoming
guidelines and notices, expected later this year, will be pivotal
in providing further clarity, and their content will serve as a key
reference point for other nations grappling with similar regulatory
challenges in the rapidly evolving AI landscape.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.