A Closer Look At Korea's Foundational AI Act: The Presidential Decree Clarifies A Path For Regulation And Innovation

Introduction: Korea's AI Ambitions and Regulatory Stance

The Korean government's AI journey began in December 2019 with the announcement of the National AI Strategy, which formally identified AI and semiconductors as Korea's key future industries. This commitment was reinforced at the AI Seoul Summit in May 2024, where the nation positioned itself to become a global AI leader. The National Assembly has also been active, with debates and nearly 19 different legislative proposals culminating in the enactment of the Basic AI Act in January 2025.

The law, officially titled the "Framework Act on the Development of Artificial Intelligence and Establishment of Trust Foundation," serves a dual purpose: to build trust through risk regulation and to foster AI development with government support and industrial infrastructure. It is, in essence, a foundational framework for all AI-related activities in Korea.

The government's recent announcement of a draft presidential decree explicitly signaled a shift toward a promotion-first, "minimum regulation" approach, applying only the most essential rules to the industry. This reflects the government's strong commitment to enhancing AI competitiveness by clarifying and specifying legal provisions, and to operating a reasonable and flexible regulatory system with the minimum necessary regulations.

The Long-Awaited Decree and a Path to Clarity

As Korea's first foundational AI law, the Act's enactment prompted many AI providers to seek clarity on new obligations, particularly regarding transparency requirements. They eagerly awaited subordinate regulations that would provide concrete details, such as how high-impact AI would be determined and how compliance would be achieved in practice.

However, the publication of subordinate regulations was continuously delayed. The draft of the presidential decree was finally announced in early September, just three and a half months before the law's effective date. While the decree resolves some previous uncertainties by specifying certain details, a great deal of practical guidance remains undefined and will need to be fleshed out in future guidelines. It is expected that the draft decree will be finalized this month and put up for public legislative notice in October.

This legislative delay has created significant uncertainty for regulated businesses. Fortunately, the government has adopted a clear "minimum regulation" stance, deferring penalties like administrative fines for a grace period whose length is still under discussion. While this postpones active enforcement, businesses are still obligated to comply with the law's transparency and safety requirements, with specific methods for fulfilling these duties to be specified over time.

A positive sign is the formation of a subordinate regulations task force, which aims to prepare guidelines and notices. This initiative suggests that greater clarity on the Act's application is on the horizon. Furthermore, the government has stated its intention to flexibly adapt its regulatory framework by considering AI trends in the U.S., EU, and Japan. In short, while Korea's AI Act is a proactive legislative effort, its final form remains a work in progress, and its evolution will need to be closely monitored.

Specifics of the Regulations

The AI Act itself contains only a few provisions that directly impose obligations on AI service providers. When including the draft presidential decree, the regulatory content can be summarized into four key points:

1. Transparency for High-Impact and Generative AI: This obligation requires advance notice to users for both high-impact and generative AI, as well as clear labeling of generative AI outputs. The decree clarifies that advance notices can be provided through terms of service or displayed on the user's screen. Outputs can be marked with either human- or machine-readable labels, including invisible watermarks. A stricter rule applies to deepfake content, which must be clearly recognizable to users, with consideration for the primary users' age and physical or social conditions. These obligations are exempt for internal business use or when the AI's use is already apparent.
2. Risk Management for Large-Scale AI: Large-scale AI providers—those trained with more than 1026 floating-point operations—must evaluate and mitigate risks throughout the AI lifecycle and establish a risk-management system to handle safety incidents.
3. Specific Requirements for High-Impact AI: Once an AI system is designated as "high-impact" by the Minister of Science and ICT, providers must publish key information on their website. This includes risk-management policies, organizational structures, user protection measures, a summary of training data, and the contact details of the person responsible for overseeing the system.
4. AI Impact Assessment: While not a strict obligation, providers of high-impact AI are encouraged to undergo an AI impact assessment.

Finally, the Act includes clauses on extraterritorial application, meaning it applies to activities carried out abroad if they affect the Korean market or users. Providers without a Korean office but who meet a certain user or revenue threshold will be required to designate a domestic representative. This threshold is defined by criteria similar to the Personal Information Protection Act, including a total revenue of 1 trillion KRW (approximately 750 million USD) or an average daily domestic user base of 1 million over a three-month period. The AI Act adds a new criterion: an annual revenue from AI services of 10 billion KRW (approximately 7.5 million USD) or more.

Conclusion

Korea's proactive enactment of the Basic AI Act in January 2025 marks a significant step towards becoming a global AI leader. The subsequent draft presidential decree provides a crucial first glimpse into the specifics of the regulatory framework, clarifying key obligations and dispelling some initial uncertainties. While this legislative and regulatory effort is an ongoing process, the government's clear stance on "minimum regulation," coupled with a flexible and pragmatic approach, aims to balance the needs for both industrial growth and user protection. The upcoming guidelines and notices, expected later this year, will be pivotal in providing further clarity, and their content will serve as a key reference point for other nations grappling with similar regulatory challenges in the rapidly evolving AI landscape.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.