The AI Basic Act, what it requires

South Korea's AI Basic Act (Act No. 20676, promulgated 21 January 2025, effective 22 January 2026) establishes the country as the second jurisdiction, after the EU, with binding AI-specific legislation covering private sector activities. The Act takes a risk-based approach with mandatory obligations for high-impact AI systems.

High-impact AI classification

The Act focuses regulatory intensity on "high-impact AI", systems in a listed domain that also carry a significant potential to affect life, physical safety, fundamental rights, or public safety. The criteria are no longer pending: Article 2, subparagraph 4 enumerates the domains, and the Enforcement Decree (Presidential Decree No. 36053) has been in force since 22 January 2026. Ten domains are listed: energy supply; the production process for drinking water; the provision of healthcare and the building and operation of healthcare delivery systems; the development and use of medical devices and digital medical devices; the safety management and operation of nuclear materials and nuclear facilities; the analysis and use of biometric information for criminal investigation or arrest; judgements or evaluations that materially affect individual rights and obligations, such as hiring and loan screening; the core operation and management of transport means, facilities and systems; decisions by the State, local governments and public institutions on eligibility for public services and the charges levied for them; and student assessment in early-childhood, primary and secondary education. A further subparagraph lets the Enforcement Decree add domains.

For high-impact AI, Article 34 requires: transparency about AI system use; risk assessment; documentation of system design, data, and decision-making processes; measures to prevent and address bias, discrimination, and inaccuracy; and human oversight for consequential decisions. The separate fundamental-rights impact assessment under Article 35 is a best-efforts duty rather than a hard requirement, incentivised by a public-procurement preference under Article 35(2).

General obligations for all AI

Regardless of risk classification: AI providers must ensure basic safety and reliability; AI-generated content must be identifiable as AI-generated; users must be notified when interacting with AI systems in certain contexts; providers must maintain records and documentation sufficient for regulatory review.

Data protection, PIPA

PIPA (Personal Information Protection Act) provides comprehensive data protection applicable to all AI processing personal data. The PIPC (Personal Information Protection Commission) enforces PIPA with authority to investigate, order corrective measures, and impose penalties. Key provisions relevant to AI: consent for collection and use (with specific consent for sensitive information); purpose limitation; automated individual decision-making provisions including the right to refuse solely automated decisions and request human review; data breach notification requirements; restrictions on cross-border data transfer.

Sector-specific regulation

Financial services. The FSC (Financial Services Commission) regulates AI in banking, insurance, and securities. The Credit Information Use and Protection Act applies to AI credit scoring. Algorithmic trading is regulated by the Financial Investment Services and Capital Markets Act.

Competition. The KFTC (Korea Fair Trade Commission) has jurisdiction over AI that may affect fair competition, including algorithmic pricing coordination and AI-driven market manipulation.

Healthcare. The Ministry of Food and Drug Safety (MFDS) regulates AI medical devices. SaMD regulations apply to AI-based diagnostic and treatment tools.

Compliance steps

Assess whether your AI systems qualify as high-impact under the classification criteria. Implement transparency requirements, disclosure that AI is in use, notification to affected individuals. Conduct risk assessments for high-impact systems. Ensure PIPA compliance for all AI processing personal data. Monitor subordinate legislation and enforcement guidelines as they are issued through 2026. For companies also operating in the EU, map the AI Basic Act requirements against EU AI Act requirements to identify overlaps and differences.

Primary sources: Library of Congress, Korea AI Basic Act · PIPC South Korea

Related reading