# South Korea's AI Basic Act: Generative AI Labeling, High-Impact AI Duties, the Compute Threshold, and the Domestic Representative Rule

Source: https://superintelligencecompliance.ai/guides/south-korea-ai-basic-act  
Publisher: ZSKFL Management  
Last updated: 2026-11-02. Not legal advice.

> South Korea's AI Basic Act took effect January 22, 2026: AI notice and labeling, high-impact AI duties, a 10^26 FLOP threshold, fines up to 30 million won.

## At a glance

- South Korea’s AI Basic Act and its Enforcement Decree took effect on January 22, 2026. The Act applies to conduct outside Korea if the conduct impacts the domestic market or users (Article 4(1)).
- An AI business operator with no domicile or place of business in Korea must designate a domestic representative if it meets a Decree criterion, such as prior-year revenue of 1 trillion won or more, prior-year AI services revenue of 10 billion won or more, or an average of at least 1 million domestic users per day over the 3 months immediately preceding the end of the previous year.
- Administrative fines under the Act are capped at 30 million won. The Ministry of Science and ICT (MSIT) announced a grace period of at least one year deferring fact-finding investigations and penalties, except in highly exceptional cases. The grace period is ministry policy, not a provision of the Act or the Decree.

## What does South Korea’s AI Basic Act require?

South Korea’s AI Basic Act requires AI business operators to tell users in advance when a product or service runs on generative or high-impact AI, to label generative AI output, and to label deepfake-style output so users can readily recognize it. Operators that provide high-impact AI in the listed areas must run risk management, explanation, user protection, and human oversight measures and keep records. Operators of systems trained with at least 10²⁶ operations that meet two further Decree criteria must manage lifecycle risk and report the results to MSIT.

The Korea Legislation Research Institute (KLRI) translates the title as the Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (인공지능 발전과 신뢰 기반 조성 등에 관한 기본법), and says its translation has no legal authority or official effect.

The National Assembly passed the Act on December 26, 2024. It was promulgated January 21, 2025, as Act No. 20676, and took effect January 22, 2026, with the Enforcement Decree, Presidential Decree No. 36053; the digital medical devices portion of the high-impact definition (Article 2(4)(d)) took effect January 24, 2026. Amendment Act No. 21311 of January 20, 2026 added provisions on AI-vulnerable groups and public-sector adoption, some of which took effect July 21, 2026, under the amendment Act’s addendum. The Decree was then amended by Presidential Decree No. 36506 of July 20, 2026, in force July 21, 2026, and by Presidential Decree No. 36580 of August 18, 2026, a consequential amendment in force August 20, 2026. The Korean text marks no amendment to Decree Articles 23 through 27 or 29, the transparency, compute-threshold, high-impact, and domestic representative provisions.

## Who does the AI Basic Act apply to, including foreign companies?

It applies to “AI business operators”: corporations, organizations, individuals, and State agencies and other public entities engaged in business related to the AI industry. An **AI development business operator** develops and provides AI. An **AI use business operator** provides AI products or services using AI that a development business operator provided (Article 2(7)). AI that the Decree lists as developed and used solely for national defense or national security is excluded (Article 4(2); Decree Article 2).

The Act also applies to conduct outside Korea if the conduct impacts the domestic market or users (Article 4(1)). MSIT’s transparency guidelines put the transparency duty on operators that directly provide AI products and services to users, including international companies serving users in Korea, and not on a company that uses AI as a tool for its own work, such as a film studio using AI video tools.

An operator with no domicile or place of business in Korea must designate a domestic representative in writing and report it to MSIT if it meets any one of these criteria (Article 36(1); Decree Article 29):

- Previous-year revenue (previous fiscal year for a corporation) of 1 trillion won or more.
- Previous-year revenue in the AI services sector of 10 billion won or more.
- An average of at least 1 million domestic users per day of its AI products and services over the 3 months immediately preceding the end of the previous year.
- Having been fined for failing to comply with a corrective order (Article 43(1)3).
Revenue is converted at the previous year’s average exchange rate. The representative, which must have a domicile or place of business in Korea, acts for the operator in submitting compute-threshold safety results, requesting high-impact confirmations, and supporting the high-impact measures. Its violations in those matters are deemed the operator’s (Article 36(3)).

## Which AI Basic Act duties apply, and to whom?

**Main operator duties under the AI Basic Act, as of November 2, 2026**

| Duty | Who it applies to | Article | Status and date |
|---|---|---|---|
| Notify users in advance that a product or service operates based on high-impact or generative AI | Operators that intend to provide a product or service using high-impact or generative AI | Act 31(1); Decree 23(1) | In force January 22, 2026; fine up to 30 million won |
| Indicate that output was generated by generative AI | Operators that provide generative AI or a product or service using it | Act 31(2); Decree 23(2) | In force January 22, 2026; corrective order route |
| Notify or indicate, in a manner users can readily recognize, that realistic synthetic sound, images, or video were generated by an AI system | Operators that provide such outputs using an AI system | Act 31(3); Decree 23(3) | In force January 22, 2026; corrective order route |
| Review in advance whether the AI is high-impact; optional request to MSIT for confirmation | Operators that provide AI or products and services using it | Act 33; Decree 25 | In force January 22, 2026 |
| Risk management, explanation, user protection, human oversight, and documentation measures; post the main contents; keep documents 5 years | Operators that provide high-impact AI or a product or service using it | Act 34; Decree 27 | In force January 22, 2026; corrective order route |
| Endeavor to assess impact on fundamental rights in advance | Operators that provide products or services using high-impact AI | Act 35; Decree 28 | In force January 22, 2026; AI-vulnerable groups sentence from July 21, 2026 |
| Endeavor to obtain verification and certification in advance | Operators that provide high-impact AI | Act 30(3) | In force January 22, 2026 |
| Identify, assess, and mitigate lifecycle risks; run a risk management system; submit the results to MSIT | Operators of AI systems that meet all three Decree Article 24 criteria, including at least 10²⁶ training operations | Act 32; Decree 24 | In force January 22, 2026; corrective order route |
| Designate a domestic representative and report it to MSIT | Operators with no domicile or place of business in Korea that meet a Decree Article 29 criterion | Act 36; Decree 29 | In force January 22, 2026; fine up to 30 million won |
| Comply with an order to cease or correct a violation | Any operator MSIT finds in violation after an investigation | Act 40(3) | In force January 22, 2026; fine up to 30 million won |

## What counts as high-impact AI?

High-impact AI is an AI system that is likely to have a significant impact on or pose a risk to human life, physical safety, and fundamental rights, and that is used in a listed area (Article 2(4)):

- Energy supply
- Drinking water production
- Health and medical service systems
- Medical devices and digital medical devices
- Nuclear materials and facilities
- Biometric analysis for criminal investigation or arrests
- Judgments or evaluations with a significant impact on individuals’ rights and obligations, such as hiring and loan screening
- Major transportation operations
- Public-body decisions affecting citizens
- Evaluation of students in early childhood, elementary, and secondary education
The Decree may add areas; the Decree, as amended through August 18, 2026, adds none.

Asked to confirm, MSIT weighs the listed area, the impact, severity, and frequency of risks, the operator’s own prior review, any committee advice, and other matters MSIT prescribes and publicly notifies (Decree Article 25(2)). MSIT’s January 2026 announcement adds that whether a human is involved in the final decision is also considered, and that in that case the system is deemed controllable and excluded from high-impact AI. That test appears in MSIT’s announcement, not in the text of the Act or the Decree; MSIT says its guidelines set more detailed high-impact criteria for each area.

## What must a provider of high-impact AI do?

Article 34(1) requires measures, as prescribed by Presidential Decree, that include risk management; explanation, to the extent technically feasible, of the final results, the main criteria used to derive them, and an overview of the training data; user protection; human management and oversight; and documents that can verify the measures taken.

The operator posts the main contents of its risk management, explanation, and user protection measures, and the name and contact details of the person overseeing the system, at its office or place of business or on its website, and may leave out trade secrets; it keeps supporting documents for 5 years (Decree Article 27(1) and (2)). An AI use business operator that receives a system from an operator that has implemented all or part of those three measures, and makes no significant functional change, such as substantially altering the system’s original purpose or intended use, is deemed to have implemented all or part of those measures (Decree Article 27(3)).

The impact assessment is an effort duty: the operator “shall endeavor” to assess the impact on people’s fundamental rights in advance (Article 35(1)). Since July 21, 2026, an assessment is to reflect the characteristics of AI-vulnerable groups, considering the nature of the product or service. Decree Article 28, as amended by Presidential Decree No. 36506 from July 21, 2026, lists seven elements, requires the identification of individuals or groups likely to be affected to reflect the characteristics of AI-vulnerable groups, and allows a third party to do the work. Decree Article 1-2 defines AI-vulnerable groups; the list includes persons with disabilities, people aged 65 or older, and recipients of basic livelihood security, among others.

## What does the Act require for generative AI and deepfakes?

Advance notice may go in the product, contract, manual, or terms of use, on the user’s screen, at the place of service, or by another method MSIT recognizes (Decree Article 23(1)). The generative AI indication may be human-perceivable or machine-readable; a machine-readable mark must come with a notice, given at least once by text, voice, or other means, that generative AI produced the content (Decree Article 23(2)). For realistic synthetic sound, images, or video, the notice or label must be one users can clearly recognize, made so that users can easily check it by sight, by hearing, or with software, and made with regard to the age and physical and social conditions of the main users (Decree Article 23(3)). Where the output is an artistic or creative work or part of one, the notice or label may be given in a way that does not hinder its display or enjoyment (Article 31(3)).

All or part of these duties need not apply where AI use is evident from the product or service name, or from text shown on the user’s screen, on the product’s exterior, or in the output, where the AI is used solely for the operator’s internal business purposes, or where MSIT publicly notifies an exception (Decree Article 23(4)).

MSIT’s Guidelines on Ensuring AI Transparency, released January 22, 2026, let operators use interface indicators or logos for output shown only inside a service. Downloaded or shared text, images, or video must carry a visible or audible mark such as a watermark, or machine-readable data such as metadata after a text or voice notice. Deepfakes must be labeled so users can clearly recognize them.

## Does the Act set a compute threshold for frontier models?

Yes, with conditions. Article 32 duties apply to an AI system that meets all three criteria in Decree Article 24(1): cumulative training compute of at least 10²⁶ floating-point operations; configuration with the most advanced AI technology currently in use; and a level of risk likely to have a widespread and significant impact on human life, bodily safety, and fundamental rights. The operator must identify, assess, and mitigate risks across the AI lifecycle, establish a risk management system able to monitor and respond to safety incidents, and submit the results to MSIT. MSIT is to publicly notify how compute is counted (Decree Article 24(2)).

## How is the Act enforced, and is there a grace period?

Where a violation of Article 31(2) or (3), 32(1) or (2), or 34(1) is discovered, suspected, reported, or the subject of a complaint, MSIT may require data or have officials investigate, including on site, and may order the operator to cease or correct a violation it finds (Article 40). Administrative fines not exceeding 30 million won apply to three failures: the Article 31(1) advance notice, designating a domestic representative, and complying with a corrective order (Article 43(1)). A missing output label or high-impact measure is not fined directly; it can lead to a corrective order, and failing to comply with the order is fined.

In January 2026, MSIT said it “will grant a grace period of at least one year,” deferring fact-finding investigations and the imposition of penalties, with investigations conducted only in highly exceptional cases such as loss of life, human rights violations, or other serious social harm. Neither the Act’s addenda nor the Decree’s addenda contain a grace provision, and the duties themselves applied from January 22, 2026. As of November 2, 2026, we found no MSIT announcement fixing an end date, and no published investigation, corrective order, or fine under the Act.

## What has changed since the Act took effect?

- **January 21 and 22, 2026:** MSIT announced an AI Basic Act Support Desk for confidential and anonymous consultations, and on January 22 released the transparency guidelines.
- **March 25, 2026:** MSIT launched an AI Basic Act Improvement Working Group of about 40 experts to produce a tentative improvement plan in the second half of 2026.
- **May 21, 2026:** MSIT gave legislative notice of a Decree amendment implementing the amendment Act, on AI-vulnerable groups, public procurement, and AI research institutes.
- **July 21, 2026:** the amendment Act’s remaining provisions, including the AI-vulnerable groups sentence in Article 35(1), took effect. The same day, Decree amendment Presidential Decree No. 36506 of July 20, 2026 took effect: it defines AI-vulnerable groups (Decree Article 1-2) and requires the impact assessment to reflect them (Decree Article 28(1)1).

## How does it compare with the EU AI Act and China?

The EU AI Act prohibits listed practices and puts conformity duties on high-risk systems. The Korean Act lists no prohibited practices and has no mandatory conformity assessment; certification is an effort duty (Article 30(3)). Both reach past their borders, and each requires some foreign providers to appoint a local representative. Under EU AI Act Article 54, a provider of a general-purpose AI model established outside the EU must appoint an authorised representative in the EU before placing the model on the EU market, a duty that has applied since August 2, 2025, subject to an open-source exemption for models without systemic risk. Article 22 sets the same duty for providers of high-risk AI systems established outside the EU, from December 2, 2027 for stand-alone high-risk systems under the Digital Omnibus on AI (Regulation (EU) 2026/1744).

China had no comprehensive AI law as of October 26, 2026 and regulates by service type through filing and labeling rules. See the [EU AI Act guide](https://superintelligencecompliance.ai/guides/eu-ai-act-compliance), the [EU high-risk AI guide](https://superintelligencecompliance.ai/guides/eu-ai-act-high-risk-ai-systems), and the [China AI regulations guide](https://superintelligencecompliance.ai/guides/china-ai-regulations).

## What should a foreign company with Korean users do now?

- Map each AI product or feature users in Korea can reach, and record whether you act as a development or use business operator
- Test last year’s revenue, AI services revenue, and average daily Korean users against Decree Article 29, and designate and report a domestic representative if any criterion is met
- Put advance notice of generative or high-impact AI in terms, contracts, or the interface
- Mark generative output that is downloaded or shared outside the service with a visible or audible mark such as a watermark, or with metadata after a text or voice notice, and make deepfakes clearly recognizable
- Review each use against the high-impact areas, keep the review on file, and request MSIT confirmation where unclear
- For high-impact AI, document the Article 34 measures, post their main contents, name the oversight contact, and keep records for 5 years
- For a model trained with at least 10²⁶ operations, assess the other two Decree Article 24 criteria
- Plan for fines after the grace period, which MSIT has not given an end date, and watch for Decree changes
How this fits the other guides: the [AI compliance guide](https://superintelligencecompliance.ai/guides/ai-compliance-guide) places cross-border AI laws in its first layer.

This guide is general information as of November 2, 2026, not legal advice. Confirm the current Korean text and MSIT’s position with counsel admitted in Korea or with MSIT before acting.

## Sources

- [Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, Act No. 20676 (English translation)](https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543), Korea Legislation Research Institute via Korean Law Information Center, enforcement date January 22, 2026.
- [Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, as amended by Act No. 21311 (English translation)](https://elaw.klri.re.kr/eng_service/lawViewContent.do?hseq=73499), Korea Legislation Research Institute, January 20, 2026.
- [Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, Presidential Decree No. 36053 (English translation)](https://elaw.klri.re.kr/eng_service/lawViewContent.do?hseq=73696), Korea Legislation Research Institute, January 21, 2026; Korean and English text side by side: [KLRI bilingual view](https://elaw.klri.re.kr/kor_service/lawViewMultiContent.do?hseq=73696).
- [인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 (current Korean text)](https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=282791), Korean Law Information Center, Act No. 21311, enforcement date July 21, 2026.
- [인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 시행령 (current Korean text)](https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781), Korean Law Information Center, as amended by Presidential Decree No. 36506 (July 20, 2026) and No. 36580 (August 18, 2026), enforcement date August 20, 2026.
- [A New Chapter in the Age of AI: Basic Act on AI Passed at the National Assembly’s Plenary Session](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mId=4&mPid=2&bbsSeqNo=42&nttSeqNo=1071), Ministry of Science and ICT, December 2024.
- [The AI Basic Act Comes into Force to Lay the Foundation for Korea to Become an AI G3](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mId=4&mPid=2&bbsSeqNo=42&nttSeqNo=1214), Ministry of Science and ICT, January 2026.
- [AI Basic Act takes effect on the 22nd (in Korean)](https://www.korea.kr/news/policyNewsView.do?newsId=148958380), Ministry of Science and ICT via Korea Policy Briefing, January 21, 2026.
- [MSIT Releases Guidelines on Ensuring AI Transparency](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mId=4&mPid=2&bbsSeqNo=42&nttSeqNo=1215), Ministry of Science and ICT, January 22, 2026.
- [Legislative notice of the AI Basic Act Enforcement Decree (in Korean)](https://www.korea.kr/news/policyNewsView.do?newsId=148954629), Ministry of Science and ICT via Korea Policy Briefing, November 12, 2025.
- [AI Basic Act Improvement Working Group Launched with Participation of Industry, Academia, and Civil Society](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mId=4&mPid=2&bbsSeqNo=42&nttSeqNo=1238), Ministry of Science and ICT, March 25, 2026.
- [Legislative Notice Issued on Amendment to the Enforcement Decree of the AI Basic Act to Strengthen Support for the AI Industry](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mId=4&mPid=2&bbsSeqNo=42&nttSeqNo=1264), Ministry of Science and ICT, May 2026.
- [AI Basic Act Update: Enforcement and Key Implications](https://www.shinkim.com/eng/media/newsletter/3117), Shin & Kim LLC, February 11, 2026 (secondary).
- [Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text as of July 27, 2026, as amended by Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727), EUR-Lex, Articles 22, 54, and 113.

## Common questions

**When did South Korea's AI Basic Act take effect?**

The Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, Act No. 20676, was promulgated January 21, 2025 and took effect January 22, 2026, together with its Enforcement Decree, Presidential Decree No. 36053. A January 20, 2026 amendment added provisions on AI-vulnerable groups and public-sector adoption, some of which took effect July 21, 2026, according to the Ministry of Science and ICT.

**Does South Korea's AI Basic Act apply to foreign companies?**

It can. Article 4(1) applies the Act to conduct outside Korea if the conduct impacts the domestic market or users. An AI business operator with no domicile or place of business in Korea must designate a domestic representative if it meets a Decree criterion, such as previous-year revenue of 1 trillion won or more, previous-year AI services revenue of 10 billion won or more, or an average of at least 1 million domestic users per day over the 3 months immediately preceding the end of the previous year.

**What are the fines under South Korea's AI Basic Act, and is there a grace period?**

Administrative fines not exceeding 30 million won apply to failing to give advance notice under Article 31(1), failing to designate a domestic representative, and failing to comply with a corrective order (Article 43(1)). In January 2026, the Ministry of Science and ICT said it will grant a grace period of at least one year, deferring fact-finding investigations and the imposition of penalties except in highly exceptional cases. The grace period is ministry policy, not a provision of the Act or the Decree.