국문 KR 영문 EN

The public notice period for the Enforcement Decree of the “Framework Act on the Advancement of Artificial Intelligence and Establishment of Trust” (hereinafter the 'AI Basic Act') concluded on December 22, 2025.

With the Act set to take effect on January 22, 2026, the South Korean government has finalized the institutional framework. For AI service providers, these regulations are not merely post-launch checklists but essential specifications that must be integrated from the initial planning and design stages.
 

1. Labeling Obligations for Generative AI and UX Integration

Transparency requirements under Article 31 of the AI Basic Act have been further refined through the Enforcement Decree.

• Labeling Methods: Providers must choose between a "Human-Perceptible Format" (visible text/watermarks) and a "Machine-Readable Format" (C2PA, metadata, etc.) to identify AI-generated content.

• Mandatory Notification: Even when adopting machine-readable formats, providers are obligated to notify users at least once via text or audio prompts.

• Avoidance of Double Regulation: If content (e.g., deepfakes) has already been labeled in accordance with other relevant laws, it may be exempt from redundant labeling duties under this Act.

• Practical Impact: This is not a simple notification task; it directly impacts UX/UI design. Legal reviews should be conducted during the design phase to avoid the prohibitive costs of post-launch modifications.

2. High-Impact AI Confirmation and Launch Risk Management

The Act defines "High-Impact AI" as systems that significantly affect human life, physical safety, or fundamental rights (e.g., healthcare, transportation, recruitment, credit scoring, etc.).

• Confirmation Procedure: Businesses can apply to the Ministry of Science and ICT (MSIT) to confirm whether their service qualifies as "High-Impact AI." The government must respond within 60 days (30 days + a possible 30-day extension).

• Business Risk: The government's response timeline is a critical variable for service launch schedules. If a service is retroactively classified as High-Impact AI, the provider may face the risk of redesigning the entire system architecture to meet enhanced safety standards.

3. Integration with the Personal Information Protection Act (PIPA)

The Enforcement Decree reflects efforts to resolve overlapping regulations with the existing PIPA.

• Deemed Compliance: If a business faithfully fulfills its obligations under PIPA, it is deemed to have satisfied the safety and reliability requirements of the AI Basic Act regarding the processing of personal information.

• Limitations: Note that this "deemed compliance" applies only to personal data processing. Obligations regarding algorithm transparency and accountability for AI outputs must still be addressed separately under the AI Basic Act.

4. Post-Management Accountability: 5-Year Data Retention & Domestic Agents

The Decree formalizes accountability measures to verify regulatory compliance.

• Record-Keeping: Documents including risk management plans, explanation protocols, and user protection measures must be retained for 5 years. These serve as crucial evidence during disputes or regulatory investigations.

• Domestic Agent Appointment: Overseas AI providers are now explicitly required to appoint a domestic agent in Korea. Domestic companies utilizing APIs from global Big Tech firms must also conduct supply-chain compliance checks.

5. Safety Obligations for Large-Scale AI Models (High-Compute AI)

The Decree imposes obligations to establish risk identification and management systems for developers of large-scale AI models with cumulative training computation exceeding $10^{26}$ FLOPs. Domestic businesses providing services based on these hyper-scale models must also review the legal structure of liability and risk-sharing.
 

Conclusion: A 1-Year Grace Period, but the Time to Prepare is Now

The government intends to provide a one-year grace period following the enforcement of the Act. However, given the nature of the AI industry, reactive adjustments can lead to immense technical costs and legal exposure.
 

Enterprises must now view "Compliance by Design" as a core element of their service, moving beyond mere technological development. We recommend a thorough diagnostic of whether your services fall under the "High-Impact" or "Generative AI" categories to ensure full readiness by the enforcement date.
 

DECENT Law Firm provides tailored legal counsel and solutions to navigate the evolving regulatory landscape of the AI industry. If you require a detailed review or a compliance audit, please contact us.