Korea’s AI Basic Act and AI regulation: what foreign companies must do in 2026

The law in outline

The Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation of Trust — the AI Basic Act (인공지능 기본법, ingong jineung gibonbeop) — was passed by the National Assembly in December 2024, promulgated in January 2025 and took effect on 22 January 2026, with its enforcement decree finalised the day before. It merged nineteen bills into one. Most of it is industrial policy: a national AI master plan, a presidential AI committee, funding for data, compute and start-ups, and support for companies adopting AI. A smaller part regulates, and that part is what matters to foreign businesses.

The regulation is built on three tiers. All providers of generative AI and high-impact AI to users have transparency duties (투명성 확보 의무). Providers of high-impact AI (고영향 인공지능, goyeonghyang ingong jineung) have additional risk management duties. Developers of the largest models — trained with more than 10²⁶ floating-point operations — have safety duties. Foreign companies above size thresholds must appoint a domestic agent. The Ministry of Science and ICT (MSIT) enforces it, with the AI Safety Institute, set up in November 2024, as its technical arm. AI used solely for national defence or security is excluded.

Who it applies to

The Act regulates AI business operators (인공지능사업자, ingong jineung saeopja) — both developers (인공지능개발사업자) that build AI and users (인공지능이용사업자) in the business sense: companies that use AI to offer products or services. It does not regulate individuals or end users. It applies to acts outside Korea that affect the Korean market or Korean users, so a foreign SaaS company, app or model provider serving Korean customers is in scope whether or not it has a Korean entity.

Purely internal use — an AI tool used by staff for drafting or analysis, with no output reaching customers — falls largely outside the transparency duties. A company that puts AI into what it sells to Koreans does not. For a foreign-owned Korean subsidiary reselling a group’s AI product, both the group as developer and the subsidiary as provider to users may have duties; the decree lets a deployer that does not materially change a compliant system rely on the developer’s compliance.

Transparency and labelling

Under Article 31 of the AI Basic Act, a business that offers products or services using high-impact or generative AI must tell users in advance that AI is being used. The decree allows notice through the product itself, contracts, terms of use, on-screen displays or posted notices — an onboarding screen and a line in the terms usually suffice.

Outputs of generative AI (생성형 인공지능, saengseonghyeong ingong jineung) must be indicated as AI-generated. Machine-readable marks such as invisible watermarks or metadata are allowed, provided users are told at least once that outputs are marked. Where the output is realistic synthetic audio, images or video (딥페이크, dipeikeu) that is hard to tell apart from reality, the disclosure must be clear to the person seeing or hearing it; for artistic and creative works, disclosure may be given in a way that does not spoil the work. Exemptions cover internal business use and cases where AI use is obvious from context.

Failure to give advance notice is one of the few violations that carries a fine. For most foreign SaaS and app providers, this is the main practical obligation: update terms, add an in-product notice, and switch on output marking where the product generates content.

Simplified from the Act, the enforcement decree and MSIT guidance.

High-impact AI

High-impact AI is AI that may significantly affect human life, physical safety or fundamental rights and is used in the areas listed in Article 2 of the Act: energy supply; production of drinking water; healthcare and medical devices; nuclear materials and facilities; analysis of biometric information for criminal investigation; decisions on hiring and on loan screening and similar evaluations of rights and obligations; transport; decisions by public bodies on eligibility for services and benefits; and student evaluation in education. Being in a listed area does not make a system high-impact automatically; the effect on people decides. A business can ask MSIT to confirm whether its system qualifies.

Providers of high-impact AI must, under Article 34: establish and run a risk management plan; explain, as far as technically feasible, the final result, the main criteria used and an overview of the training data; put in place user protection measures; ensure human management and oversight; and keep documents showing these measures — for five years under the decree. They should publish the key points, excluding trade secrets, and make reasonable efforts to carry out a fundamental rights impact assessment (영향평가, yeonghyang pyeongga) under Article 35; public bodies buying AI are told to prefer products that have done one. Compliance with equivalent obligations under sector laws counts.

For foreign HR-tech, credit-scoring, health-tech and edtech companies entering Korea, this is the part that changes product and contract work. A recruitment platform ranking Korean candidates, or an underwriting model used by a Korean lender, should expect the customer to ask for the documentation the Act requires.

Korea regulated AI the way it regulates most things new: promote first, label second, and keep the stick small but visible.

Voixa Korea

Frontier models

Developers of AI systems trained with cumulative compute above 10²⁶ floating-point operations must, under Article 32, identify, assess and mitigate risks across the life cycle, run a risk management system for safety incidents, and submit the results to MSIT. The threshold is ten times the EU AI Act’s systemic-risk presumption and currently catches only a handful of the largest models worldwide. For almost every company reading this, the frontier duties belong to its model supplier, not to it.

Domestic agent for foreign providers

A foreign AI business operator with no address or place of business in Korea must appoint a domestic agent (국내대리인, gungnae daeriin) under Article 36 if, under the decree, it had total revenue of KRW 1 trillion or more in the previous year, AI service revenue of KRW 10 billion or more, or an average of one million or more daily Korean users over the last three months of the previous year — or has been fined for ignoring an MSIT order. The appointment is made in writing and reported to MSIT. Any person or company with a Korean address can act; unlike under the personal data law, it need not be an affiliate.

The agent submits frontier-safety results where relevant, requests MSIT confirmation of high-impact status, and supports high-impact compliance; its failures count as the provider’s. A foreign company that already has a Korean subsidiary or branch is not required to appoint a separate agent under this Act, but should decide which Korean entity will deal with MSIT. Failing to appoint a required agent carries a fine. See digital services for Korean users for the parallel agent duties under privacy, telecoms and e-commerce law.

Enforcement and fines

MSIT can request documents, investigate and inspect premises where it suspects a violation, and order corrective measures or suspension. Fines under Article 43 are administrative and capped at KRW 30 million per violation, for a short list of breaches: failing to give advance notice of AI use, failing to appoint a required domestic agent, and failing to comply with suspension or corrective orders. There is no fine for most substantive duties, and no turnover-based penalty like the EU’s.

The government has announced a guidance period (계도기간, gyedo gigan) of at least one year from January 2026 during which it will generally not carry out fact-finding investigations or impose fines, except for serious incidents. That is an administrative policy, not a statutory exemption, and its end date and scope may be extended or narrowed. The sensible reading: use 2026 to build the inventory, notices, labels and documentation, because the obligations already apply and Korean customers and public buyers are already asking.

Personal data: PIPA still does most of the work

For most AI products, Korea’s Personal Information Protection Act bites harder than the AI Act. Training and running AI on personal data needs a legal basis — consent, contract, legitimate interest within the Act’s limits, or pseudonymisation for research and statistics — and personal data sent abroad for processing needs a basis for overseas transfer. The Personal Information Protection Commission (PIPC) has issued guidance on using publicly available data for AI training and on the development and use of generative AI, and has investigated and sanctioned global AI services over data handling. See PIPA for foreign companies.

Since March 2024, Article 37-2 of PIPA gives individuals rights over fully automated decisions (자동화된 결정, jadonghwadoen gyeoljeong) that significantly affect their rights or obligations: to refuse the decision or ask for an explanation and human review, with exceptions. Companies using automated decisions must publish the criteria and procedures. An AI hiring screen or credit decision for Korean individuals triggers both PIPA’s automated-decision rights and the AI Act’s high-impact duties.

Copyright: training data and outputs

Korea’s Copyright Act has no specific text-and-data-mining exception. Training on copyrighted works relies on general fair use under Article 35-5, which Korean courts have not yet tested for AI training; licensing disputes with news publishers and broadcasters are under way. On outputs, the Ministry of Culture and the Korea Copyright Commission take the position that material generated by AI without human creative contribution is not a protected work and cannot be registered as one; works with sufficient human creative input can be registered for the human contribution, with AI-generated parts identified. Contracts with Korean customers should say who owns outputs, who bears infringement risk and how training on customer data is handled.

Deepfakes, elections and sector rules

Other laws were amended before the AI Act. Since 2024, creating, distributing, possessing or viewing sexually explicit deepfakes is a crime under the Act on Special Cases Concerning the Punishment of Sexual Crimes, and election campaigning with deepfake video, images or audio is prohibited in the 90 days before an election under the Public Official Election Act. Platforms are expected to remove such content quickly.

Sector regulators add their own rules. The Financial Services Commission has AI guidelines for financial institutions covering governance, fairness and explanation, and outsourcing rules apply to AI services bought from abroad. The Ministry of Food and Drug Safety regulates AI-based software as medical devices under the Digital Medical Products Act, in force since January 2025. Hiring decisions remain subject to employment discrimination law, and online platforms to consumer and fair trade rules. A foreign company should map its product to the sector first and the AI Act second.

Regulatory sandboxes

Where Korean rules block an AI product — telemedicine features, autonomous mobility, new financial services — the regulatory sandbox regimes allow temporary permission or a demonstration exemption. Applications go to the relevant ministry: MSIT for ICT, the trade ministry for industrial convergence, the Financial Services Commission for fintech, with regional regulation-free special zones as another route. A foreign company usually applies through its Korean subsidiary or with a Korean partner.

What to do now

1. Inventory: list every AI system in products or services offered to Korean users, with its role — developer or provider — and area of use.
2. Notices: add advance notice of AI use to onboarding, terms and UI for Korean users.
3. Labels: switch on output marking; add visible disclosure for realistic synthetic media.
4. High-impact screening: document whether any system is in a listed area and significantly affects people; if unsure, consider asking MSIT.
5. High-impact measures: where applicable, risk management, explanation, human oversight, user protection and five-year records.
6. Agent: check the thresholds; appoint and report a domestic agent if needed, or designate the Korean subsidiary as the point of contact.
7. PIPA: legal basis for training and use, overseas transfer, automated-decision rights.
8. Contracts: output ownership, IP warranties, data use and compliance cooperation with Korean customers.

A worked example

A German HR-tech company sells a candidate-screening tool to Korean employers from Berlin, with about 40,000 daily Korean users and no Korean entity. Its tool ranks applicants for hiring — a listed high-impact area — and generates interview summaries. It is below the domestic-agent thresholds, but within the Act. It adds an AI notice to the candidate portal and to the employer terms, marks generated summaries as AI-generated, and documents its risk management, explanation method and human-review step for employers, keeping records for five years. Because rankings of Korean candidates are automated decisions under PIPA, it builds a route for candidates to request an explanation and human review, publishes the criteria, and puts the overseas transfer of applicant data on a proper legal basis. Korean customers receive a compliance pack with the documentation the Act requires, which in practice now decides tenders.

Mistakes we see

1. Assuming the Act only applies to Korean companies — it reaches services aimed at Korean users.
2. Reading the guidance period as an exemption.
3. No advance notice of AI use in Korean terms and UI.
4. Generated content without marks, especially synthetic images and voice.
5. Ignoring PIPA while focusing on the AI Act.
6. Not checking the agent thresholds for daily Korean users.
7. Contracts silent on outputs, IP and training on customer data.

Korean terms you will meet

Questions readers ask

About the author

Alexander Baranov

Founder of the BCA Group · cross-border corporate and tax adviser since 2008

Alexander advises foreign founders and groups on company formation, tax structuring and corporate law in more than 40 jurisdictions across Europe, the Gulf, Asia and Latin America. He is the author of nine books on international business and tax and writes regularly for professional finance and tax journals. He works in English, German, Spanish and Russian.

This guide is based on the Korean statutes cited in the text and on our own filings. It is reviewed when the law or official rates change.

Ask Alexander on WhatsAppContact