Describe your business, leave with a checklist you can assign

Article 31 imposes three duties: (1) where a product or service uses high-impact AI or generative AI, users must be informed in advance that it operates on that AI; (2) where generative AI, or a product or service using it, is provided, the output must be marked as generated by generative AI; and (3) where an AI system produces virtual audio, images or video hard to distinguish from reality, the fact that it was generated by an AI system must be notified or marked in a way the user can clearly recognise, with the option, for outputs that are or form part of artistic or creative works, of a method that does not impair their display or enjoyment. Article 23 of the Enforcement Decree adds detail: the prior notice may be given by stating it on the product itself or in the contract, user manual or terms of use; by display on the user’s screen or device; by conspicuous posting at the place where the product or service is supplied; or by another method recognised by the Minister. The Art. 31(2) marking may be human-readable or machine-readable, and where machine-readable it must be accompanied at least once by a textual or audio notice that the output was generated by generative AI. The Art. 31(3) notice or marking must let the user clearly recognise the fact, taking account of whether it can be readily checked visually, aurally or by software, and of the age and physical and social circumstances of the main users. Three exceptions apply: where the use of high-impact or generative AI is already obvious from the product or service name, user screen, product exterior or the wording shown on the output; where the system is used solely for the AI business’s internal operations; and where the Minister notifies, by public notice, other cases warranting full or partial exemption.

Evidence: Screenshots and Korean-language copy of the prior-notice surface; Implementation design for output marking, covering visible indicators and metadata or watermarks; Detection and marking rules for realistic synthetic content; Assessment records where the artistic or creative exception is relied on; Robustness testing of the markings and version-change records

Model Card

Article 32 requires that, for AI systems whose cumulative compute used in training is at or above the threshold set by Presidential Decree, the AI business must implement two things to ensure safety: identification, assessment and mitigation of risk throughout the AI lifecycle; and establishment of a risk-management system that monitors and responds to AI-related safety incidents. The results of that implementation must be submitted to the Minister of Science and ICT. Article 24(1) of the Enforcement Decree defines the threshold as a system meeting all three of the following: cumulative compute used in training of 10^26 floating-point operations or more; being constituted and operated using the most advanced AI technology among those currently applied to AI systems, having regard to the state of the art; and a risk level liable to have a broad and serious effect on human life, bodily safety and fundamental rights. All three are cumulative, so crossing the compute figure alone does not bring a system within the article. The method of calculating cumulative training compute is to be fixed separately by ministerial notice (Decree Art. 24(2)), which was not verified in this pass.

Evidence: Methodology and working papers for cumulative training compute, measured against the 10^26 FLOPs threshold; Item-by-item applicability assessment against all three conditions in Decree Art. 24(1); Lifecycle risk identification, assessment and mitigation records; Documentation of the safety-incident monitoring and response system, including on-call and escalation; Implementation results submitted to MSIT and the acknowledgement; Re-assessment records on each model version iteration

Model CardISO/IEC 42001 AI management system implementation and certification readiness checklist

Article 34(1) requires an AI business providing high-impact AI, or a product or service using it, to implement measures as prescribed by Presidential Decree, comprising six items: establishing and operating a risk-management plan; establishing and implementing, so far as technically feasible, an explanation plan covering the AI’s final output, the main criteria used to reach it and an overview of the training data used in developing and using the AI; establishing and operating a user-protection plan; human management and oversight of the high-impact AI; creating and retaining documentation evidencing the safety and reliability measures; and any other matter deliberated and resolved by the Committee for securing the safety and reliability of high-impact AI. That sixth item is open-ended, so the operative checklist is not limited to the first five and the National AI Strategy Committee’s resolutions must be tracked. The Minister may issue a notice specifying details and recommend compliance. Implementing equivalent measures under other legislation, as prescribed by Presidential Decree, counts as compliance, with the recognition criteria and procedure set out in Annex 1 to the Decree. Article 27 of the Decree adds three directly operational requirements: the key contents of the risk-management plan, the key contents of the explanation plan, the user-protection plan and the name and contact details of the person managing and overseeing the high-impact AI must be posted at the business’s office or premises or on its website (matters that are trade secrets under Art. 2(2) of the Unfair Competition Prevention and Trade Secret Protection Act may be withheld); the evidence of implementing the Art. 34(1) measures must be retained in documentary form, including electronically, for five years; and an AI-using business that receives a system from a business which has implemented all or some of items 1 to 3 is treated as having implemented them itself, provided it has not materially changed the system’s function, such as by significantly altering its original purpose or use. An AI-using business may request from the AI developer the materials needed to discharge these duties, and the developer must endeavour to cooperate.

Evidence: Risk-management plan and operating records; Explanation plan covering final outputs, main criteria and a training-data overview, with the user-facing explanation materials; User-protection plan and complaint-handling records; Human oversight procedure, staffing and intervention logs, plus the published name and contact details of the responsible person; Archived copies of the page published under Decree Art. 27, with the assessment of anything withheld as a trade secret; Documented file of safety and reliability measures with evidence of five-year retention

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Article 36: an AI business with no address or place of business in Korea that meets the user-count, revenue or other thresholds set by Presidential Decree must designate in writing a person to act for it (the domestic representative) and notify the Minister of Science and ICT. Article 29(1) of the Enforcement Decree sets those thresholds as any one of: prior-year revenue (prior business year for a corporation) of KRW 1 trillion or more; prior-year revenue in the AI services segment of KRW 10 billion or more; a daily average of 1 million or more domestic users of the business’s AI products and services over the three months preceding the end of the prior year; or having previously been fined under Art. 43(1)3. Revenue under the first two limbs is converted into won at the prior year’s average exchange rate (Decree Art. 29(2)). The representative handles: submission of implementation results under Art. 32(2); requests under Art. 33(1) for confirmation of high-impact status; and the support needed to implement the Art. 34(1) safety and reliability measures, including checking that the Art. 34(1)5 documentation is current and accurate. The representative must have an address or place of business in Korea. A violation of the Act by the representative in respect of those matters is deemed committed by the AI business that designated it. Failure to designate is expressly an administrative-fine offence under Art. 43.

Evidence: Written designation of the domestic representative; Record of the notification to MSIT and its acknowledgement; Working papers testing each of the four Decree Art. 29 thresholds, including the exchange-rate basis and the daily-active-user counting methodology; Representative’s checks on the currency and accuracy of the Art. 34(1)5 documentation

Article 33 requires an AI business, before providing AI or a product or service using it, to examine in advance whether that AI constitutes high-impact AI, and permits it to ask the Minister of Science and ICT to confirm that question. The Minister must respond and may establish an expert committee for advice. The Minister may develop and disseminate guidelines on the criteria for, and examples of, high-impact AI. The confirmation procedure is prescribed by Presidential Decree.

Evidence: Prior high-impact examination record for each use case; Basis for the determination and the version of ministerial guidance relied on; Any confirmation request submitted to the Minister and the response; Re-examination records when the use case changes

Article 35(1) provides that an AI business providing a product or service using high-impact AI shall endeavour to assess in advance its impact on people’s fundamental rights, and in doing so must have regard to the nature of the product or service so that the assessment reflects the characteristics of AI-vulnerable groups (the second sentence was added by the 20 January 2026 amendment and commences 21 July 2026). Article 35(2) requires state agencies and equivalent bodies intending to use high-impact AI products or services to give priority to those for which an impact assessment has been conducted. The assessment is therefore an endeavour obligation with real competitive weight in Korean public procurement. Article 28(1) of the Enforcement Decree requires the assessment to cover seven items: identification of the individuals or groups whose life, bodily safety or fundamental rights may be affected by the high-impact AI product or service, reflecting the characteristics of the AI-vulnerable groups defined under Art. 3(5); identification of the types of fundamental rights that may be affected; the nature and extent of the social and economic effects on those rights; the patterns of use of the high-impact AI; the quantitative or qualitative indicators used and how results are produced; prevention, mitigation and loss-recovery measures for the risks identified; and, where the results call for improvement, the implementation plan. The assessment may be carried out by the business itself or commissioned to a third party (Decree Art. 28(2)); remaining requirements are to be set by ministerial notice.

Evidence: Fundamental-rights impact assessment report; Methodology and test results showing how vulnerable-group characteristics were reflected; Record of how assessment findings changed the product design; Assessment materials submitted in public procurement bids

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Article 40: where the Minister of Science and ICT discovers or learns of a violation or suspected violation of Art. 31(2)–(3), Art. 32(1)–(2) or Art. 34(1), or receives a report or complaint about one, the Minister may require the AI business to submit relevant materials or have officials conduct the necessary investigation, and where necessary enter the business’s offices or premises to inspect books, documents and other materials or objects (with the Administrative Investigation Basic Act applying to the procedure). Where the investigation establishes a violation, the Minister may order the measures necessary to stop or correct it. Failure to comply attracts an administrative fine of up to KRW 30 million under Art. 43.

Evidence: Regulator-enquiry response plan with designated authorised contacts; Index of readily retrievable compliance documentation for Arts. 31, 32 and 34; Correspondence records and list of materials submitted; Evidence of execution and closure of any suspension or corrective order

Collection, use and provision of personal information must rest on one of the grounds in Arts. 15, 17 and 18; where consent is relied on, it must be obtained separately and distinguishably under Art. 22, and service must not be refused because consent beyond what is necessary was declined. Processing the data of a child under 14 requires the legal representative’s consent.

Evidence: Processing inventory mapped to lawful bases; Korean-language consent UI screenshots and itemised consent records; Age-determination records for under-14s and legal-representative consent records; Documentation distinguishing mandatory from optional consent items

Transfers abroad — defined to include provision (including where the data can be queried), entrusted processing and storage — are prohibited unless one of five routes applies: (1) the data subject’s separate consent to the cross-border transfer; (2) a special provision in law, a treaty to which Korea is a party, or another international agreement; (3) entrusted processing or storage necessary to conclude and perform a contract with the data subject, where the Art. 28-8(2) items are disclosed in the privacy policy or notified to the data subject by email or another method prescribed by Presidential Decree; (4) the recipient holds a certification under Art. 32-2 or one recognised by PIPC notice and has taken the safety and rights-protection measures required, plus the measures needed to implement the certified matters in the destination country; or (5) PIPC recognises that the destination country or international organisation has a protection system, scope of rights guarantees and remedial procedures substantially equivalent to this Act. Before consent under route (1), the data subject must be informed of the items transferred, the destination country, timing and method, the recipient’s name and contact details, the recipient’s purpose and retention period, and the method, procedure and effect of refusing; any change requires fresh notice and consent. Contracts for cross-border transfer whose content breaches this Act are prohibited.

Evidence: Cross-border transfer register: recipient, country, data items, purpose, retention period; Separate consent UI and consent records, or archived privacy-policy disclosure page; Certification documents and description of measures implementing the certified matters in the destination country (route 4); The cross-border transfer contract with legal review confirming it does not breach PIPA; Records of fresh notice and consent where transfer particulars changed

Open tool: Transfer Matrix

A controller with no address or place of business in Korea that meets the revenue and data-holding thresholds set by Presidential Decree must designate a domestic representative in writing to handle: complaint handling and damage relief under Art. 31(4)5; the notifications under Art. 34(1)–(2) and the breach report under Art. 34(4); and the submission of materials under Art. 63(1). The representative must have an address or place of business in Korea; where the controller has established a Korean corporation, or a Korean corporation over which it exercises dominant influence on officer appointments or business operations, the representative must be designated from among those entities. The controller must educate, inspect and supervise the representative as prescribed by Presidential Decree. The representative’s name, address, telephone number and email must appear in the privacy policy. A violation by the representative in respect of those matters is deemed committed by the controller.

Evidence: Written designation of the domestic representative; Screenshot of the representative’s details in the published privacy policy; Records of education and business-status inspection of the representative; Register of complaints and breach reports handled by the representative

On becoming aware that personal information has been leaked or otherwise compromised, the controller must without delay inform data subjects of the Art. 34(1) items: the data items involved; the time and circumstances; the specific steps the data subject can take to minimise harm; the controller’s response measures and damage-relief procedures; the department and contact point for reports of harm; the legal rights arising from the breach — damages under Art. 39, statutory damages under Art. 39-2 and dispute mediation under Art. 43 — and how to exercise them; and other matters prescribed by Presidential Decree. The 2026 amendment adds Art. 34(2): where the controller becomes aware of circumstances indicating a possibility of a leak, as prescribed by Presidential Decree, it must without delay inform all potentially affected data subjects of the prescribed matters. The controller must also take measures to prevent the spread of harm, including recovery and deletion, and must report to PIPC or a specialised body without delay as prescribed.

Evidence: Incident response plan covering the Korean reporting path and Korean-language notice templates; Data-subject notice text covering every Art. 34(1) item; Record of the report filed with PIPC or the designated specialised body; Assessment record of a possible leak and proof that notification was sent; Execution records of measures preventing the spread of harm, including recovery and deletion

AI incident and serious incident reporting record (register plus report drafts)

Article 29 requires technical, managerial and physical measures to ensure safety and prevent loss, theft, leakage, forgery, alteration or damage of personal information. Article 64-2(1)9 makes a leak itself surcharge-eligible unless the controller has taken all the measures necessary under Art. 29 — which makes the evidence of Art. 29 implementation the core of any defence. Article 26(4) requires the entrusting controller to supervise and train the entrusted processor, and a failure that results in a violation by that processor is itself surcharge-eligible.

Evidence: Evidence pack of safety measures across technical, managerial and physical categories; Configuration evidence for encryption, access control and log retention; Entrustment agreements plus training and supervision records for processors; Periodic security assessments with remediation closure records

Article 37-2 provides that where a decision is made by processing personal information through a fully automated system, including one applying artificial intelligence technology, and that decision significantly affects the data subject’s rights or obligations, the data subject may require the controller to refuse to apply it — except where the decision is made under Art. 15(1)1, 2 or 4. The data subject may also request an explanation of an automated decision already made. On receiving such a request the controller must, absent justifiable grounds, refrain from applying the automated decision or take necessary measures such as human re-processing and explanation. The controller must also publish, in a form the data subject can readily check, the criteria and procedure for automated decisions and the way personal information is processed.

Evidence: Inventory of automated decisions with the “significant effect” assessment; Published page describing the decision criteria, procedure and processing method; Register of refusal and explanation requests with handling and responses; Standard operating procedure and execution records for human re-processing; Written justification where a request is not acceded to on justifiable grounds

The 2026 amendment inserts Art. 30-3, expressly designating the business owner or representative as the person ultimately responsible for the processing and protection of personal information. Article 31 is strengthened accordingly: the controller must secure the staffing and budget the CPO needs, controllers meeting the Presidential Decree thresholds must file the designation, change or removal of the CPO with the competent authority, and such designation, change or removal must be resolved by the board of directors. Designating a person who does not meet the CPO qualification requirements, failing to obtain a board resolution, or failing to file, attracts administrative fines under Art. 75(2).

Evidence: Board resolution appointing the CPO and the filing acknowledgement; Documentation verifying the CPO qualification requirements; Evidence of the staffing and budget secured for the CPO; Internal governance document recording the owner’s or representative’s accountability

The 2026 amendment adds a proviso to Art. 32-2(1): controllers meeting thresholds set by Presidential Decree on revenue and processing scale must obtain privacy certification. That provision and Art. 75(2)15 (administrative fine for failing to obtain certification) commence on 1 July 2027, so the certification lead time should be planned in advance. Article 28-8(1)4 also makes holding such certification one of the routes for cross-border transfer, so certification carries both compliance and commercial value.

Evidence: Assessment of whether the size thresholds apply; Gap analysis and remediation plan for certification readiness; Certification application and certificate; Description of measures implementing the certified matters in the destination country, where used as a transfer route