Korea AI Basic Act

• Korea's first comprehensive AI law. Promulgated 21 Jan 2025 and in force since 22 Jan 2026, together with its Enforcement Decree.
• Most of its 43-plus articles set up national strategy, funding, data, clusters, talent and an AI Safety Institute. The business duties sit in Chapter IV (Arts. 31 to 36).
• Transparency (Art. 31): tell users in advance when a product uses generative or high-impact AI, label generative outputs, and make realistic synthetic media clearly recognisable.
• High-impact AI (Arts. 33 to 35): AI used in listed sensitive areas (energy, water, health, medical devices, nuclear, biometric policing, hiring and loan screening, transport, public decisions, student evaluation) needs risk management, explanation, user protection, human oversight and records.
• Very large models (Art. 32): systems trained with at least 10^26 FLOPs that are also state of the art and broadly risky must run lifecycle risk management and report results to MSIT.
• Foreign companies (Art. 36): above revenue or user thresholds, a foreign AI business with no Korean office must appoint a Korean domestic representative.
• Fines are modest (max KRW 30 million) and MSIT announced at least a one-year guidance period before fining.

• AI business operators: companies, organisations, individuals and public bodies that develop and supply AI, or that provide AI products or services using it (Art. 2(7)).
• Extraterritorial: the Act applies to conduct outside Korea that affects the Korean market or Korean users (Art. 4(1)).
• Excluded: AI developed and used only for national defence or national security, as set by Presidential Decree (Art. 4(2)).
• Domestic representative trigger (Art. 36; Decree Art. 29): a foreign AI business with no address or place of business in Korea that meets any one of:
  1. total revenue in the previous year of KRW 1 trillion or more;
  2. AI-service revenue in the previous year of KRW 10 billion or more;
  3. an average of 1 million or more daily Korean users over the last three months of the previous year;
  4. a previous fine for ignoring a correction order under Art. 43(1)3. Revenue is converted to won at the previous year's average exchange rate (Decree Art. 29(2)).

• Art. 43(1): administrative fine up to KRW 30 million for:
  1. not giving prior notice that a product or service uses generative or high-impact AI (Art. 31(1));
  2. not designating a domestic representative (Art. 36(1));
  3. not complying with a cease or correction order (Art. 40(3)).
• Labelling of outputs (Art. 31(2), (3)), the large-model safety duty (Art. 32) and high-impact measures (Art. 34(1)) are not fined directly. MSIT can investigate (data requests, on-site inspection) and issue correction orders (Art. 40); ignoring the order is then fineable.
• Fine amounts by violation are in Decree Annex 2 (Decree Art. 32); the Annex is published as an attachment and its figures were not reviewed for this note.
• A foreign company is treated as having committed any violation its domestic representative commits on its behalf (Art. 36(3)).
• Grace period: MSIT announced a guidance period of at least one year during which fines (and, per some reports, fact-finding investigations) are deferred. This comes from MSIT announcements reported in Korean media and law-firm notes; it is an enforcement policy, not text in the Act or Decree.
• Art. 42 (criminal) only covers Council members who leak secrets.

• Selling an AI product or SaaS to Korean users: you are in scope from day one through Art. 4(1), even without a Korean entity. The duties are lighter than the EU's, but they are binding.
• Generative AI features (chatbots, writing, image tools): add a prior notice in the UI, terms or contract (Decree Art. 23(1)), and label outputs. A machine-readable watermark is allowed, but then you must tell the user at least once, in text or voice, that outputs are AI-generated (Decree Art. 23(2)).
• Realistic synthetic voice, image or video: label so an ordinary user can easily tell, taking account of age and abilities of the main users (Art. 31(3); Decree Art. 23(3)).
• HR tech, lending, health or edtech products used in Korea: likely high-impact. Do an internal classification first, and consider asking MSIT for a confirmation (30-day reply, extendable once). Build the Art. 34 measures and publish their summary on your website.
• Domestic representative: most Indian SMEs will fall below the KRW 1 trillion / KRW 10 billion AI revenue / 1 million daily users thresholds. Large IT services firms with big consolidated revenue should check the KRW 1 trillion total revenue test carefully; it is not limited to AI revenue.
• Building on a third-party model (for example a US LLM): you are an AI use business operator. Ask the model developer for documentation; the Decree says developers should try to cooperate (Decree Art. 27(4)).
• Controls you already run for the EU AI Act Art. 50 and an ISO/IEC 42001 AIMS cover most of this.

Article references are to the Act (KLRI English text, as amended by Act No. 21311) unless marked "Decree" (Enforcement Decree, Presidential Decree No. 36053 as amended).

• AI inventory flagging which products use generative AI, which are high-impact (with the Art. 2(4) area cited) and which models exceed 10^26 training FLOPs.
• Screenshots or contract clauses showing prior AI notice to Korean users.
• Output labelling design: visible labels, watermark or metadata method, and the one-time user notice where labels are machine-readable.
• High-impact classification memos and any MSIT confirmation requests and replies.
• Risk management procedure, explanation method, user protection process and human oversight assignment for each high-impact system.
• Website or office notice with the published summary and the overseer's name and contact.
• Five-year document retention schedule and storage evidence.
• Fundamental rights impact assessments (even though the duty is "endeavour").
• Domestic representative written designation and the MSIT filing, or a threshold analysis showing why none is needed.
• Records of any MSIT data requests, inspections and corrective orders.

• Assuming the law only binds Korean companies. Art. 4(1) reaches foreign conduct that affects Korean users.
• Reading "grace period" as "no obligations". The duties applied from 22 Jan 2026; only fines are deferred, and only by MSIT policy.
• Testing the KRW 1 trillion threshold against AI revenue only. Threshold 1 is total revenue; threshold 2 is AI-service revenue.
• Using an invisible watermark with no user-facing notice at all.
• Treating "endeavour" duties (impact assessment, certification) as optional for public-sector buyers, who must prefer assessed and certified products (Arts. 30(4), 35(2)).
• Forgetting that a domestic representative's breach is treated as your own breach.
• Mixing this up with the EU's tiering: Korea has no prohibited-practice list and no conformity assessment requirement.

• AI business operator: any company, body or individual doing AI-related business; split into development and use business operators.
• AI development business operator: builds and supplies AI.
• AI use business operator: offers products or services using AI supplied by a developer.
• High-impact AI: AI that may significantly affect life, safety or fundamental rights and is used in one of the areas listed in Art. 2(4).
• Generative AI: AI that produces text, sound, images, video and similar outputs by imitating the structure of its input data.
• Impacted person: someone whose life, safety or fundamental rights are significantly affected by an AI product or service.
• AI-vulnerable groups: people such as persons with disabilities and older people who find AI harder to use; added by the January 2026 amendment.
• Domestic representative: a person with a Korean address who acts for a foreign AI business in dealings with MSIT.
• Enforcement Decree: the Presidential Decree that fills in details the Act leaves to regulation.
• FLOPs: floating-point operations, a measure of total computing used to train a model.
• MSIT: Ministry of Science and ICT, the lead regulator.

• Binding and extraterritorial since 22 Jan 2026; Indian AI products used by Korean users are in scope.
• Core duties: prior AI notice, output labelling, high-impact risk management with published summaries and five-year records, large-model safety reporting, and a domestic representative for big foreign players.
• Domestic representative thresholds (Decree Art. 29): KRW 1 trillion total revenue, KRW 10 billion AI revenue, or 1 million daily Korean users.
• Maximum fine KRW 30 million; MSIT promised at least a year without fines, so expect enforcement from 2027 at the earliest.
• 19 obligations mapped here.

• KLRI English translation of the Act, amended by Act No. 21311 (20 Jan 2026), accessed 2026-10-19
• KLRI English translation of the original Act No. 20676 (21 Jan 2025), accessed 2026-10-19
• Korean Enforcement Decree, Art. 29 and full text, National Law Information Center (law.go.kr), accessed 2026-10-19
• Secondary, for the fine guidance period only: Money Today report on MSIT's minimum one-year fine guidance period (Korean), accessed 2026-10-19
• Secondary, for context: US Commerce Department trade.gov market note on the AI Basic Act, accessed 2026-10-19