IM Engineer Study Notes
← Back to list
AI & Data
#AI 기본법#인공지능 규제#고영향 인공지능#생성형 AI#AI 거버넌스
Last updated · 2026-10-23

AI Basic Act (Framework Act on the Development of AI and Establishment of a Foundation of Trust)

1. Overview

A. Definition

The AI Basic Act is a framework law of the Republic of Korea that supports the promotion of the AI industry and the building of its foundations, while imposing transparency, safety, and user-protection duties on high-impact and generative AI to establish a foundation of trust. Its formal name is the "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation of Trust"; it was promulgated in January 2025 and took effect from January 2026.

The core of the AI Basic Act is that it is neither "a law of regulation only" nor "a law of promotion only." It is integrated legislation that combines promotion provisions—which widen the base of investment, talent, data, and computing through a national AI master plan and a dedicated governance body—with trust provisions that hold accountable the AI that greatly affects citizens' life, body, and fundamental rights. A professional engineer should therefore understand this law less by memorizing clauses and more as a framework for inventorying an organization's AI use cases and judging whether each is a target of promotion support, of high-impact/generative duties, or of extraterritorial application.

This law is not a matter for domestic operators alone. It includes an extraterritoriality clause so that acts performed abroad may apply if they affect the domestic market and users, and the subordinate legislation was designed to impose a duty to appoint a domestic representative on overseas operators above a certain scale. However, the concrete thresholds (revenue, number of users) and the level of administrative fines are finalized at the enforcement-decree and notice stage, so actual applicability must be confirmed against the current text on the National Law Information Center and notices of the Ministry of Science and ICT.

B. Background and Necessity

As generative AI spread rapidly, model accuracy alone became insufficient to explain social risk. The same classification model matters little when sorting photos, but when used in hiring screening, loan review, or medical assistance, concerns about discrimination and safety grow. Risk thus arises not from the algorithm's name but from the purpose, target, and context of use, and the existing Personal Information Protection Act or Network Act alone could hardly cover AI-specific problems of explainability, bias, and misuse.

Meanwhile, Korea, aiming to be an AI frontrunner on the strength of its semiconductor, telecom, and manufacturing competitiveness, worried that regulation alone could cost industrial competitiveness. As the EU finalized the EU AI Act in 2024 and the US and Japan took their own approaches, Korea chose a compromise model of "prioritize promotion while placing minimal trust safeguards." Against this backdrop, the AI Basic Act emerged as legislation that lays the legal basis for national AI policy while complementing trust with duties confined to high-impact and generative domains.

C. Application Perspective

In practice, it is effective to first ask "is our organization's AI use case high-impact," then judge "do we provide generative outputs externally," and finally place role-specific duties into requirements, architecture, and operational procedures. If only legal documents are produced and not reflected in system design, duty fulfillment breaks whenever a model is swapped or a feature changes. In particular, when an external foundation model is used via API, the provider's policy and labeling features must be reviewed together so that duties are met across the entire service flow.

2. Legal Structure and Governance

The AI Basic Act becomes clearer when understood along three axes: "promotion–foundation-building–trust." The promotion axis handles the master plan, R&D, standardization, talent development, and data-center support; the foundation axis handles data and computing resources and industry-ecosystem support; the trust axis handles high-impact/generative duties and safety assurance. A distinctive feature is a National AI Committee under the President that oversees all three axes, with the Ministry of Science and ICT establishing an AI master plan every three years.

flowchart TB
  Law["AI Basic Act (framework law)"] --> Gov["National AI Committee (under the President)"]
  Law --> Plan["AI master plan (3-year cycle)"]
  Gov --> Plan
  Plan --> Promote["Promotion & foundation axis"]
  Plan --> Trust["Trust & regulation axis"]
  Promote --> P1["R&D, standardization, talent"]
  Promote --> P2["Data & computing support"]
  Trust --> T1["High-impact AI duties"]
  Trust --> T2["Generative AI transparency"]
  Trust --> T3["Safety assurance (frontier models)"]
  MSIT["Ministry of Science and ICT"] --> Safety["AI Safety Institute"]
  MSIT --> Center["AI Policy Center"]
  Safety --> Trust

This structure does not mean "no support without regulation." Most low-risk AI is merely a target of promotion and support with no separate duties, and trust-axis duties are imposed only on the confined categories of high-impact and generative AI. That is, the AI Basic Act pursues risk-proportionate graduated regulation but sets a narrower scope of duties than the EU AI Act to reduce the burden on industry.

A. Promotion and Foundation Axis

The starting point of the promotion axis is the AI master plan. The Minister of Science and ICT establishes a master plan every three years after deliberation and resolution by the National AI Committee, covering policies for R&D support, international cooperation, standardization, workforce training, and startup support. This is significant in that it grants a legal basis and a mid-term roadmap to AI policy that had previously been scattered across individual projects.

The foundation axis targets two bottlenecks—data and computing. It provides a basis for promoting the production, collection, and use of training data and for expanding national AI data centers and high-performance computing resources. For example, if large-scale GPU resources and public data that SMEs and startups cannot secure on their own are provided as shared infrastructure, the initial investment barrier falls and the ecosystem's base widens.

The law also provides a basis for designating an AI Policy Center and operating an AI Safety Institute. The policy center is designed to handle policy research, fact-finding surveys, and international-trend analysis, and the safety institute to study safety-evaluation techniques and criteria, so that promotion and trust are connected rather than separated. This also aligns with the state's drive to accumulate "pre- and post-deployment evaluation capability" through the safety institute.

B. Governance and the Master Plan

The National AI Committee, under the President, coordinates inter-ministerial policy and deliberates the master plan and major measures. AI is a convergent issue spanning industry, science and technology, education, labor, and security, so it reflects the reality that a single ministry can hardly drive policy alone. Including private-sector experts on the committee to reflect the voice of the field is also central to the governance design.

That said, for the committee to have real coordinating power, budget, authority, and a professional secretariat must back it. If it remains a mere advisory body, ministerial projects may overlap or accountability may blur, so an implementation-check and performance-evaluation system for the master plan must operate together. From a professional engineer's view, how such governance connects to an organization's AI management system (e.g., ISO/IEC 42001 [[iso-42001-ai-management-system]]) should be seen as a design task.

3. Core Duties and Application Procedure

Trust-axis duties divide broadly into high-impact AI duties, generative AI transparency duties, safety-assurance duties, and extraterritoriality/domestic representative. Operators have a duty to review in advance whether their AI is high-impact, while requesting the Ministry of Science and ICT to confirm such status is designed as optional. Once judged high-impact, they must implement multiple measures such as risk management, explainability, and user protection.

flowchart TB
  Start["Plan AI product/service"] --> Q1{"In a high-impact domain?"}
  Q1 -->|"Yes"| High["Fulfill high-impact AI duties"]
  Q1 -->|"No"| Q2{"Provide generative outputs?"}
  High --> HR["Establish/operate risk management"]
  High --> HE["Prepare explanation methods"]
  High --> HU["Establish user-protection measures"]
  High --> HA["Impact-assessment effort (procurement preference)"]
  Q2 -->|"Yes"| Gen["Generative transparency duties"]
  Q2 -->|"No"| Low["Promotion & general controls"]
  Gen --> G1["Prior notice of AI-based operation"]
  Gen --> G2["Label AI-generated outputs"]
  High --> Gen
  HR --> Done["Operation & post-monitoring"]
  G1 --> Done

The flow above shows that duties are not "all or nothing." A single service may be both high-impact and generative, in which case duties from both axes apply in overlap. Conversely, low-risk automation becomes a target of promotion and general controls without trust-axis duties, so accurate classification must come first.

A. High-Impact AI

High-impact AI refers to AI in domains that gravely affect, or risk harming, people's safety of life and body and their fundamental rights. The law and subordinate legislation cite as examples medical devices, essential-living domains such as energy and water, operation of transport facilities, and fields that evaluate individuals' legal relations such as hiring and loan screening. The concrete targets and scope are delegated to the government, leaving flexibility to adjust as technology changes.

High-impact operators are charged with duties such as establishing and operating risk-management plans, preparing explanation methods for users, establishing user-protection measures, taking safety/reliability measures, human management and oversight, and document retention. For instance, a firm using AI in hiring screening must be able to explain which features feed the evaluation, and must provide a channel for applicants to contest results and a procedure for human re-review. This is not a mere notice sentence but must be implemented through requirements, logs, interfaces, and operational procedures to be effective.

Meanwhile, impact assessment (the Article 35 line) is understood to be stipulated as a legal "best-effort duty," yet an incentive for public agencies to give preference in procurement to products that completed an impact assessment can make it operate as near-mandatory in practice. Operators targeting the public market therefore gain procurement competitiveness by conducting impact assessment early. That said, the level of duty per clause and the detailed criteria of the enforcement decree may be amended, so one should avoid assertions and confirm the latest text.

B. Generative AI and Transparency

An operator wishing to provide a product/service using generative AI or high-impact AI must notify users in advance that the product/service operates on the basis of AI. Outputs created by generative AI (text, image, video, audio, etc.) must also be labeled as AI-generated. This aims to reduce the misrecognition and misuse of synthetic content such as deepfakes and to safeguard users' right to judge.

Implementing the labeling duty does not stop at a single on-screen phrase. In practice, API-response metadata, watermarks or machine-readable marks (e.g., C2PA-line content-provenance standards), generation-history logs, and modification records must be designed together to meet the duty repeatedly and automatically. For example, an operator using generative outputs in news or advertising video is more stable inserting marks automatically in the editing pipeline than giving notice by hand.

Transparency does not mean disclosing the whole model internals. The core is to provide information so users understand "whether they are now interacting with AI" and "whether this content is generated." Multilingual guidance, accessibility, reporting channels, and log retention must therefore be included in service requirements.

C. Safety Assurance and Frontier Models

The safety-assurance duty targets high-impact AI and large models above a certain scale. In subordinate-legislation discussions, a direction was proposed to treat frontier models whose cumulative training compute exceeds 10 to the 26th power FLOPs as separate targets of safety assurance, requiring risk identification, evaluation, and mitigation measures. This is similar in conception to the EU AI Act's systemic-risk threshold for general-purpose AI models, taking compute as a proxy indicator of risk.

Using a compute threshold has the merit of measurement objectivity, but it also has the limitation that, as technology advances and powerful models emerge from less compute, the criterion can quickly become outdated. Safety criteria therefore need complementing with multi-faceted indicators beyond compute, such as capability evaluation, red teaming, and incident reporting. Having the AI Safety Institute research and accumulate evaluation techniques and criteria can also be seen as a design mindful of such complementation.

D. Extraterritoriality and Domestic Representative

The AI Basic Act placed an extraterritoriality clause so that acts performed abroad may apply if they affect the domestic market and users. This is a device to govern the impact on domestic users of global big-tech services based on overseas servers. However, as there is debate over whether enforcement capacity and sanctions are sufficient, the domestic-representative regime complements it.

The duty to appoint a domestic representative targets overseas operators above a certain scale, with the draft subordinate legislation discussing thresholds such as headquarters revenue, domestic AI-related revenue, and domestic daily-average users. The domestic representative takes on roles of fulfilling transparency/safety duties, retaining records, and serving as a liaison with the authorities. Because the concrete threshold figures and the level of fines for non-appointment are matters finalized by enforcement decree and notice, this note avoids assertions and presupposes confirmation of the latest text.

4. Comparison and Application Cases

The AI Basic Act is often compared with the EU AI Act [[eu-ai-act-compliance]]. Both pursue risk-proportionate graduated duties, but the EU, with its fine-grained classification of prohibited–high-risk–limited–minimal risk and high fines (proportional to global revenue), leans "regulation-first," while Korea concentrates duties on the narrow categories of high-impact and generative AI and combines promotion provisions, leaning "promotion-first."

Category AI Basic Act (Korea) EU AI Act
Basic nature Promotion+trust framework law Risk-based regulation centered
Risk classification High-impact/generative centered (narrow) Prohibited, high, limited, minimal (fine-grained)
Generative labeling Prior notice + output labeling Transparency duty (label synthetic)
Large models Compute-threshold safety discussion GPAI systemic risk (10^25 FLOPs line)
Sanctions Administrative-fine centered (relatively light) High fines (revenue-proportional)
Extraterritorial Extraterritoriality + domestic representative Extraterritoriality + EU representative

The practical implication of this comparison is that an operator targeting both the European and domestic markets can generally satisfy domestic criteria by meeting the stricter EU criteria. A global firm therefore does well to take the EU AI Act as a baseline for common controls and reinforce Korea's detailed requirements—such as prior notice and output labeling—by region.

As a concrete case, suppose a domestic fintech firm provides loan consultation via a generative AI chatbot. Because this service combines loan screening (high-impact) and generative (transparency), it needs a design that (1) notifies at chatbot start that it is "AI-based consultation," (2) labels generated answers as AI, (3) places an explanation of screening results and a human re-review channel, and (4) conducts impact assessment proactively if aiming at public/financial procurement. As another case, if an overseas-headquartered video-generation service has large domestic monthly users, it may become a target for domestic-representative appointment, so a representative and record-retention system must be prepared from early market entry.

5. Deep Dive: Recent Trends and Expected Exam Directions

The key variables after enforcement are subordinate legislation and the grace period. To reduce early confusion, the government indicated a direction of operating a grace/forbearance period of at least one year and providing tailored advice to firms through an expert support desk. During 2026, detailed criteria such as enforcement-decree amendments and a transparency-assurance guideline (draft) are being arranged in sequence, so it is important to track not only clauses but also notices and guidelines.

Expected exam directions from a professional-engineer view include: (1) describing with cases the high-impact AI judgment procedure and operator duties; (2) linking generative-output labeling (watermark, C2PA) with deepfake response; (3) comparison with the EU AI Act; and (4) integrated-governance design weaving together the AI Basic Act, ISO/IEC 42001 [[iso-42001-ai-management-system]], and AI TRiSM [[ai-trism]]. As an answer strategy, it is effective to first present the whole structure in the three axes of "promotion–foundation-building–trust," then develop high-impact/generative duties with a procedure diagram, and close with application strategy and trade-offs from the engineer's view.

The AI Basic Act also does not operate alone but intersects with the Personal Information Protection Act, Copyright Act, E-Government Act, and Network Act. For example, processing personal information in training data is also subject to the Personal Information Protection Act, and the copyright attribution of generated outputs is entangled with Copyright Act issues. The capability to draw a regulatory map and discern "which law applies where" is therefore becoming ever more important.

6. Considerations and Implications

First, on application strategy, organizations should build an AI inventory ahead of enforcement and pre-classify high-impact/generative status. Classification must precede so that duties can be placed precisely into requirements, architecture, and operational procedures, and when external models are used, the boundary between provider and in-house accountability must be made clear by contract.

Second, on trade-offs, the AI Basic Act narrowed the scope of duties to reduce industry burden, but this has the two-sidedness of potentially leaving gaps in trust protection. Because duties are confined to high-impact and generative AI, blind spots may arise that are classified low-risk yet actually have large social impact, so organizations are safer running their own ethics/quality controls beyond the legal minimum.

Third, on outlook, the compute-threshold criterion can age quickly as technology advances, so it is likely to evolve toward multi-faceted indicators such as capability-based evaluation, red teaming, and incident reporting. The AI Safety Institute's accumulation of evaluation capacity and alignment with international standards (ISO/IEC 42001, NIST AI RMF) will likely govern the future effectiveness of regulation.

Fourth, on related technologies, the transparency duty connects directly to content-provenance/watermark standards such as C2PA, the explainability duty to XAI [[explainable-ai]] techniques, and the safety duty to AI red teaming [[ai-red-teaming]] and guardrails. Compliance is therefore not a separate documentation task but must be implemented as an MLOps/governance system that connects data lineage, model versions, evaluation results, and incident records into one, so as to gain both regulatory response and operational quality.

References

In one line: The AI Basic Act is Korea's integrated AI framework law combining promotion/foundation-building with trust (high-impact/generative duties, safety assurance, extraterritoriality), under which organizations must first classify use cases and then implement transparency, explainability, and safety duties through an MLOps/governance system.