Korea AI Framework Act

Article 31 imposes three duties: (1) where a product or service uses high-impact AI or generative AI, users must be informed in advance that it operates on that AI; (2) where generative AI, or a product or service using it, is provided, the output must be marked as generated by generative AI; and (3) where an AI system produces virtual audio, images or video hard to distinguish from reality, the fact that it was generated by an AI system must be notified or marked in a way the user can clearly recognise, with the option, for outputs that are or form part of artistic or creative works, of a method that does not impair their display or enjoyment. Article 23 of the Enforcement Decree adds detail: the prior notice may be given by stating it on the product itself or in the contract, user manual or terms of use; by display on the user’s screen or device; by conspicuous posting at the place where the product or service is supplied; or by another method recognised by the Minister. The Art. 31(2) marking may be human-readable or machine-readable, and where machine-readable it must be accompanied at least once by a textual or audio notice that the output was generated by generative AI. The Art. 31(3) notice or marking must let the user clearly recognise the fact, taking account of whether it can be readily checked visually, aurally or by software, and of the age and physical and social circumstances of the main users. Three exceptions apply: where the use of high-impact or generative AI is already obvious from the product or service name, user screen, product exterior or the wording shown on the output; where the system is used solely for the AI business’s internal operations; and where the Minister notifies, by public notice, other cases warranting full or partial exemption.

Applies when

Chinese companies offering generative AI applications, AI assistants, digital humans, voice cloning or image and video generation to users in Korea.

Applies from: 2026-01-22

Evidence to retain

• · Screenshots and Korean-language copy of the prior-notice surface
• · Implementation design for output marking, covering visible indicators and metadata or watermarks
• · Detection and marking rules for realistic synthetic content
• · Assessment records where the artistic or creative exception is relied on
• · Robustness testing of the markings and version-change records

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Article 32 requires that, for AI systems whose cumulative compute used in training is at or above the threshold set by Presidential Decree, the AI business must implement two things to ensure safety: identification, assessment and mitigation of risk throughout the AI lifecycle; and establishment of a risk-management system that monitors and responds to AI-related safety incidents. The results of that implementation must be submitted to the Minister of Science and ICT. Article 24(1) of the Enforcement Decree defines the threshold as a system meeting all three of the following: cumulative compute used in training of 10^26 floating-point operations or more; being constituted and operated using the most advanced AI technology among those currently applied to AI systems, having regard to the state of the art; and a risk level liable to have a broad and serious effect on human life, bodily safety and fundamental rights. All three are cumulative, so crossing the compute figure alone does not bring a system within the article. The method of calculating cumulative training compute is to be fixed separately by ministerial notice (Decree Art. 24(2)), which was not verified in this pass.

Applies when

Chinese AI companies placing self-developed foundation models or large-scale trained models on the Korean market; whether the threshold is met must be assessed and documented per model against all three conditions in Decree Art. 24, with the compute-counting methodology awaiting the ministerial notice.

Applies from: 2026-01-22

Evidence to retain

• · Methodology and working papers for cumulative training compute, measured against the 10^26 FLOPs threshold
• · Item-by-item applicability assessment against all three conditions in Decree Art. 24(1)
• · Lifecycle risk identification, assessment and mitigation records
• · Documentation of the safety-incident monitoring and response system, including on-call and escalation
• · Implementation results submitted to MSIT and the acknowledgement
• · Re-assessment records on each model version iteration

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

Article 33 requires an AI business, before providing AI or a product or service using it, to examine in advance whether that AI constitutes high-impact AI, and permits it to ask the Minister of Science and ICT to confirm that question. The Minister must respond and may establish an expert committee for advice. The Minister may develop and disseminate guidelines on the criteria for, and examples of, high-impact AI. The confirmation procedure is prescribed by Presidential Decree.

Applies when

Chinese companies supplying AI into Korean hiring, credit, healthcare, education assessment, energy or public-service contexts. Even where the self-assessment concludes the AI is not high-impact, the reasoning must be retained for a possible Art. 40 investigation.

Applies from: 2026-01-22

Evidence to retain

• · Prior high-impact examination record for each use case
• · Basis for the determination and the version of ministerial guidance relied on
• · Any confirmation request submitted to the Minister and the response
• · Re-examination records when the use case changes

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Article 34(1) requires an AI business providing high-impact AI, or a product or service using it, to implement measures as prescribed by Presidential Decree, comprising six items: establishing and operating a risk-management plan; establishing and implementing, so far as technically feasible, an explanation plan covering the AI’s final output, the main criteria used to reach it and an overview of the training data used in developing and using the AI; establishing and operating a user-protection plan; human management and oversight of the high-impact AI; creating and retaining documentation evidencing the safety and reliability measures; and any other matter deliberated and resolved by the Committee for securing the safety and reliability of high-impact AI. That sixth item is open-ended, so the operative checklist is not limited to the first five and the National AI Strategy Committee’s resolutions must be tracked. The Minister may issue a notice specifying details and recommend compliance. Implementing equivalent measures under other legislation, as prescribed by Presidential Decree, counts as compliance, with the recognition criteria and procedure set out in Annex 1 to the Decree. Article 27 of the Decree adds three directly operational requirements: the key contents of the risk-management plan, the key contents of the explanation plan, the user-protection plan and the name and contact details of the person managing and overseeing the high-impact AI must be posted at the business’s office or premises or on its website (matters that are trade secrets under Art. 2(2) of the Unfair Competition Prevention and Trade Secret Protection Act may be withheld); the evidence of implementing the Art. 34(1) measures must be retained in documentary form, including electronically, for five years; and an AI-using business that receives a system from a business which has implemented all or some of items 1 to 3 is treated as having implemented them itself, provided it has not materially changed the system’s function, such as by significantly altering its original purpose or use. An AI-using business may request from the AI developer the materials needed to discharge these duties, and the developer must endeavour to cooperate.

Applies when

Chinese providers and deployers whose products fall within high-impact AI on self-assessment.

Applies from: 2026-01-22

Evidence to retain

• · Risk-management plan and operating records
• · Explanation plan covering final outputs, main criteria and a training-data overview, with the user-facing explanation materials
• · User-protection plan and complaint-handling records
• · Human oversight procedure, staffing and intervention logs, plus the published name and contact details of the responsible person
• · Archived copies of the page published under Decree Art. 27, with the assessment of anything withheld as a trade secret
• · Documented file of safety and reliability measures with evidence of five-year retention

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

Article 35(1) provides that an AI business providing a product or service using high-impact AI shall endeavour to assess in advance its impact on people’s fundamental rights, and in doing so must have regard to the nature of the product or service so that the assessment reflects the characteristics of AI-vulnerable groups (the second sentence was added by the 20 January 2026 amendment and commences 21 July 2026). Article 35(2) requires state agencies and equivalent bodies intending to use high-impact AI products or services to give priority to those for which an impact assessment has been conducted. The assessment is therefore an endeavour obligation with real competitive weight in Korean public procurement. Article 28(1) of the Enforcement Decree requires the assessment to cover seven items: identification of the individuals or groups whose life, bodily safety or fundamental rights may be affected by the high-impact AI product or service, reflecting the characteristics of the AI-vulnerable groups defined under Art. 3(5); identification of the types of fundamental rights that may be affected; the nature and extent of the social and economic effects on those rights; the patterns of use of the high-impact AI; the quantitative or qualitative indicators used and how results are produced; prevention, mitigation and loss-recovery measures for the risks identified; and, where the results call for improvement, the implementation plan. The assessment may be carried out by the business itself or commissioned to a third party (Decree Art. 28(2)); remaining requirements are to be set by ministerial notice.

Applies when

Providers of high-impact AI products bidding for Korean government or public-body procurement; products serving older people or people with disabilities must specifically reflect those characteristics.

Applies from: 2026-01-22

Evidence to retain

• · Fundamental-rights impact assessment report
• · Methodology and test results showing how vulnerable-group characteristics were reflected
• · Record of how assessment findings changed the product design
• · Assessment materials submitted in public procurement bids

Estimated first-time effort: 12–30 person-days (estimate, not a commitment)

Article 36: an AI business with no address or place of business in Korea that meets the user-count, revenue or other thresholds set by Presidential Decree must designate in writing a person to act for it (the domestic representative) and notify the Minister of Science and ICT. Article 29(1) of the Enforcement Decree sets those thresholds as any one of: prior-year revenue (prior business year for a corporation) of KRW 1 trillion or more; prior-year revenue in the AI services segment of KRW 10 billion or more; a daily average of 1 million or more domestic users of the business’s AI products and services over the three months preceding the end of the prior year; or having previously been fined under Art. 43(1)3. Revenue under the first two limbs is converted into won at the prior year’s average exchange rate (Decree Art. 29(2)). The representative handles: submission of implementation results under Art. 32(2); requests under Art. 33(1) for confirmation of high-impact status; and the support needed to implement the Art. 34(1) safety and reliability measures, including checking that the Art. 34(1)5 documentation is current and accurate. The representative must have an address or place of business in Korea. A violation of the Act by the representative in respect of those matters is deemed committed by the AI business that designated it. Failure to designate is expressly an administrative-fine offence under Art. 43.

Applies when

Chinese AI companies with no Korean entity that meet any one of the Decree Art. 29 thresholds. The tests run on prior-year figures and must be re-checked annually; the 1-million daily-average domestic user limb is the one most easily tripped by consumer apps and chatbots.

Applies from: 2026-01-22

Evidence to retain

• · Written designation of the domestic representative
• · Record of the notification to MSIT and its acknowledgement
• · Working papers testing each of the four Decree Art. 29 thresholds, including the exchange-rate basis and the daily-active-user counting methodology
• · Representative’s checks on the currency and accuracy of the Art. 34(1)5 documentation

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Article 40: where the Minister of Science and ICT discovers or learns of a violation or suspected violation of Art. 31(2)–(3), Art. 32(1)–(2) or Art. 34(1), or receives a report or complaint about one, the Minister may require the AI business to submit relevant materials or have officials conduct the necessary investigation, and where necessary enter the business’s offices or premises to inspect books, documents and other materials or objects (with the Administrative Investigation Basic Act applying to the procedure). Where the investigation establishes a violation, the Minister may order the measures necessary to stop or correct it. Failure to comply attracts an administrative fine of up to KRW 30 million under Art. 43.

Applies when

All AI businesses providing generative or high-impact AI in Korea, including foreign companies responding through a domestic representative.

Applies from: 2026-01-22

Evidence to retain

• · Regulator-enquiry response plan with designated authorised contacts
• · Index of readily retrievable compliance documentation for Arts. 31, 32 and 34
• · Correspondence records and list of materials submitted
• · Evidence of execution and closure of any suspension or corrective order

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)