Skip to content
Back to Scenario Playbooks
JapanSouth KoreaEnterprise SaaSGenAI & foundation modelsAI agentsComputer vision

Entering Japan and Korea: APPI, PIPA and Korea’s AI Framework Act

A China-based AI company serves Japanese and Korean business or consumer customers through an offshore entity or a local subsidiary, processes local residents’ personal information, and may be treated as an AI business operator supplying services in those markets.

Verified against official sources · 2026-09-12Verified against official text

Prerequisites

  • Extraterritorial application is confirmed: Japan’s APPI applies extraterritorially to operators handling the personal information of individuals in Japan; Korea requires offshore handlers to appoint a domestic representative.
  • You have mapped whether the product is used for “significant decisions” or high-impact scenarios (employment, credit, healthcare, public services), which drives the high-impact AI determination under Korea’s AI Framework Act.
  • You have estimated the order of magnitude of training compute, to judge whether the compute-threshold duties under Korea’s AI Framework Act are triggered.
  • Japan’s 2026 amendment act was promulgated on 17 July 2026 but is **not yet in force**: commencement is in principle within two years of promulgation on a date to be fixed by Cabinet Order, and as at this review (12 Sep 2026) no such date has been fixed; concrete thresholds and publication items still await the forthcoming cabinet orders and PPC rules. The new duties (facial feature data, individuals under 16, limits on the scope of contractor processing, and the surcharge regime) are therefore **transition-period preparation items, not current obligations**, and this playbook schedules on a dual track: comply with the law as it stands, prepare for the amendment.

Stages (20–33 weeks, estimate)

  1. 1. Stage 1 — Extraterritorial application and appointing local representatives

    3–5 weeks

    Complete the three items without which you are simply not in the market: confirm the APPI’s extraterritorial application and build Japan-side contact and response capability; appoint a domestic representative under Korea’s PIPA and publish it in the privacy policy; and, if treated as an AI business operator, appoint a domestic representative under the AI Framework Act and file with MSIT. The three rest on different legal bases and may be held by the same service provider, but the mandates and published particulars must be prepared separately.

    Obligations in this stage

    Evidence to retain

    • · Extraterritorial application memorandum, with the basis set out separately for Japan and Korea
    • · Japan-side contact and response arrangement (named contact, response language, time-zone coverage)
    • · Korean domestic representative mandate and the particulars published in the privacy policy
    • · AI Framework Act domestic representative filing materials and the acknowledgement of receipt

    Common blockers

    • · Treating the PIPA domestic representative and the AI Framework Act domestic representative as one item: each statute has its own filing and publication requirements.
    • · A representative in name only with no response capability: regulator enquiries and individual requests go straight to the representative, and an unanswerable representative is effectively none.
    • · Missing Japanese/Korean external texts: local notices and request intake need the local language, and English-only is treated as a failure to notify.

  2. 2. Stage 2 — Japan APPI baseline and adaptation to the 2026 amendment

    5–8 weeks

    Get the baseline right first: specify and publish the purpose of use and do not exceed it; obtain prior consent for special care-required personal information; implement security control measures; supervise contractors; report data breaches to the Commission and notify individuals; and use one of the three routes for providing personal data to third parties in foreign countries. Then recalibrate against the 2026 amendment: the publicity duty and the ban on opt-out provision for facial feature data (the change with the largest impact on computer-vision products); the intervention of legal representatives for individuals under 16; the bar on contractors processing beyond what the entrusted business requires; and the evidentiary and internal-control demands created by the surcharge regime.

    Obligations in this stage

    Deliverables

    Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

    Evidence to retain

    • · Japanese-language text specifying and publishing the purpose of use, with version history
    • · Inventory of special care-required personal information processing and consent records
    • · Security control measures documentation across the organisational, personnel, physical and technical categories
    • · Contractor supervision programme and scope-of-entrustment definitions matching the amended scope limit
    • · Publicity content for facial feature data processing and evidence that opt-out provision is blocked
    • · Record of the route chosen for provision to foreign third parties and the accompanying notification materials

    Common blockers

    • · Drafting the purpose of use broadly so “anything is covered later”: Japanese practice expects genuine specificity, and an over-broad purpose invites challenge on individual requests and inspections.
    • · Carrying over the old opt-out approach in facial-recognition products: the amendment does expressly ban opt-out provision for facial feature data, but that ban bites only from the commencement date fixed by Cabinet Order (not fixed as at 12 Sep 2026). The present risk is therefore not that you are already in breach, but that redesigning the product and rebuilding the consent path may take longer than the transition window — schedule backwards from the commencement date and keep dated evidence of when the rework completed.
    • · Contractor agreements that do not bound the processing scope: the amended scope limit requires contract and practice to match, and blanket authorisations are no longer safe.

  3. 3. Stage 3 — Korea PIPA baseline

    5–8 weeks

    Korea’s compliance density exceeds Japan’s and enforcement is active. Six items to close: determine a statutory basis for each processing activity and obtain compliant consent; place every overseas transfer on one of the five statutory routes in Article 28-8; implement the right to refuse an automated decision, the right to request an explanation, and publication of the decision criteria; notify individuals and file with the PIPC on breach events; assign ultimate responsibility to the business owner/representative and appoint a chief privacy officer; and implement safety-assurance measures and prevent contractor violations. Handlers meeting the scale thresholds must additionally obtain personal information protection certification.

    Obligations in this stage

    Deliverables

    Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)

    Evidence to retain

    • · Processing-activity to statutory-basis mapping table, in a Korean-language external version
    • · Overseas transfer route determinations and supporting documents, mapped against each limb of Article 28-8
    • · Published criteria for automated decisions plus the intake process for refusal and explanation requests
    • · Chief privacy officer appointment and the note on safeguarding their independence
    • · Evidence of safety-assurance measure implementation and contractor management records
    • · Certification applicability determination and, where applicable, the plan to obtain it

    Common blockers

    • · Treating consent as a universal basis: Korea is strict on the form and itemisation of consent, and bundled consent is readily rejected on inspection.
    • · Overseas transfers not resting on a statutory route: a Chinese recipient requires limb-by-limb reasoning, and a general “we have consent” is usually insufficient.
    • · Not publishing the criteria for automated decisions: this is a right individuals can assert directly, and its absence generates complaints immediately.

  4. 4. Stage 4 — Adapting to Korea’s AI Framework Act

    4–7 weeks

    Land four workstreams: transparency (prior notice that AI is in use, labelling of generated content, and additional notice for realistic synthetic content); the safety-assurance duty and result submission for models above the compute threshold; the prior self-check and application for ministerial confirmation for high-impact AI, together with the six statutory measures under Article 34(1); and the fundamental-rights impact assessment (a best-efforts duty, but one asked about in procurement and regulator dialogue). Also build the internal process for cooperating with fact-finding and executing suspension or remediation orders.

    Obligations in this stage

    Deliverables

    Model CardEU AI Act Article 27 Fundamental Rights Impact Assessment (FRIA)

    Evidence to retain

    • · Interface evidence (in Korean) for prior AI-use notice and labelling of generated content
    • · Compute-threshold determination record and the safety-assurance implementation report
    • · High-impact AI self-check record and the application for ministerial confirmation
    • · Register tracking implementation of each of the Article 34 statutory measures
    • · Fundamental-rights impact assessment report, where conducted
    • · Internal process documentation for cooperating with fact-finding and executing orders

    Common blockers

    • · Letting sales fill in the “high-impact” determination from what the customer says: the determination rests on the statutory criteria for the use case, not the customer’s characterisation.
    • · Labelling only inside your own interface: content must remain identifiable after it leaves the product, or the transparency duty is hollow.
    • · A compute-threshold determination with no measurement basis: as with the equivalent EU duty, it needs a reviewable estimation method and raw records.

  5. 5. Stage 5 — Commercial landing and ongoing upkeep

    3–5 weeks

    Turn compliance output into procurement material that Japanese and Korean enterprise buyers accept, and move into an upkeep cadence. On the Japan side, align with the national guidelines and basic plan issued under the AI Promotion Act while being clear that the Act does not displace compliance judgements under existing law. On the Korea side, maintain certification, representative filings and fact-finding response capability. Japanese and Korean corporates typically re-review vendors annually and require local-language materials, so putting the refresh cadence on the calendar costs less than improvising.

    Obligations in this stage

    Deliverables

    Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)AI incident and serious incident reporting record (register plus report drafts)

    Evidence to retain

    • · Customer compliance packs in Japanese and Korean
    • · Alignment note against the national guidelines and basic plan (Japan side)
    • · Annual upkeep calendar (certification renewal, representative particulars updates, material refresh)
    • · Incident register and a cross-jurisdiction notification-deadline comparison table

    Common blockers

    • · Reading Japan’s AI Promotion Act as a safe harbour: it does not change compliance judgements under existing law, and misreading it leaves the personal-information side exposed.
    • · English-only materials: Japanese and Korean procurement generally expects local-language documents, and English alone triggers requests for supplementary filings during review.

Common failure modes

  • · Using one pan-APAC pack for both Japan and Korea: statutory bases, representative regimes, notification deadlines and language requirements all differ.
  • · Preparing materials against Japan’s pre-2026 text: facial feature data, individuals under 16 and the contractor scope limit are substantive changes, not drafting tweaks.
  • · Reading Korea’s AI Framework Act as aspirational legislation: it carries operative provisions on high-impact determination, compute-threshold duties, domestic representatives and cooperation with investigations.
  • · Ignoring the “business owner responsibility” character of both regimes: Korea expressly places ultimate responsibility on the owner/representative, and pushing all compliance down to the engineering team does not hold up in governance review.
  • · Implementing generated-content labelling as a visual watermark only: the additional notice requirement for realistic synthetic content is a different obligation from a visible watermark.
  • · Underestimating local-language cost: notices, consent interfaces, complaint intake and representative communications all require local language and local time-zone coverage.

Sources (12)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

Request accessContact an advisor
GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
Entering Japan and Korea: APPI, PIPA and Korea’s AI Framework Act · Scenario playbook | HaiWen HQ