South Korea AI Basic Act Decree

Overview

This Enforcement Decree implements the Framework Act on the Development of Artificial Intelligence and Establishment of Trust. Issued as Presidential Decree No. 36053 on January 21, 2026, it prescribes matters delegated by the Framework Act and additional matters necessary for its enforcement. Its central function is operational: it translates the Act’s institutional, industrial-development, AI safety, transparency, and compliance provisions into criteria, procedures, deadlines, organizational arrangements, and publication duties. The Decree entered into force on January 22, 2026. The portion of Appendix 1 concerning digital medical devices entered into force two days later, on January 24, 2026.

The instrument combines industry-promotion measures with safeguards for trustworthy AI. It governs support for AI research, training data, adoption, testing infrastructure, AI clusters, certification support, international cooperation, and market entry. At the same time, it operationalizes notice duties for high-impact and generative AI, a compute-based threshold for certain AI safety obligations, a high-impact AI confirmation procedure, impact-assessment content, documentation retention, and domestic-agent criteria. It is therefore both an administrative implementation decree and a principal compliance instrument under South Korea’s AI framework.

Definitions and Scope

The Decree uses and further operationalizes terms defined in the Framework Act, including AI business operator, AI service, high-impact AI, and AI safety. It defines the scope of AI excluded from the Act under Article 4(2) of the Framework Act: only AI developed or used solely for specified tasks designated by the defense, intelligence, or national-police authorities. The enumerated activities concern, among other matters, defense information networks and weapons systems, intelligence and counterintelligence, counter-terrorism, cybersecurity, supply-chain early-warning systems, and protection of strategic, defense-industry, and national-core technologies.

For the safety obligation in Article 32 of the Act, Article 24 identifies an AI system meeting or exceeding the prescribed threshold only where all criteria are met. The system must have used cumulative training compute of at least 10²⁶ floating-point operations; be configured and operated using state-of-the-art AI technology in light of technological development; and present a risk likely to have widespread and significant impacts on life, bodily safety, or fundamental rights. The Minister of Science and ICT is to publicly notify the detailed method for calculating training compute.

Governance and Institutional Framework

Articles 3 through 10 establish the operational structure for national AI policy. The Minister of Science and ICT must publish a formulated or amended national AI master plan on the Ministry website and notify relevant central administrative agencies and local governments. The Decree identifies 16 relevant central administrative agencies for the Presidential Council on National Artificial Intelligence Strategy, including the Ministry of Science and ICT, Ministry of Justice, Ministry of National Defense, Ministry of Trade, Industry and Resources, Korea Media and Communications Commission, and Personal Information Protection Commission.

The Council may obtain expert opinions, request materials and views from public and private bodies, commission research, and collect public opinion through surveys, hearings, and seminars. It is supported by a secretariat led by a chief designated by the Council chair. The framework also provides for standing committees, special committees, an advisory group of private experts, and a council of chief AI officers. A State agency, local government, or public institution receiving a Council recommendation on legal, institutional, or implementation improvements must formulate and report an improvement and action plan within three months, unless it substantiates unavoidable grounds and seeks an extension.

The Decree also provides for AI policy centers and the operation of the Artificial Intelligence Safety Research Institute. The Institute may conduct safety consultation and training, operate AI safety evaluation systems, acquire and disclose AI-safety data, and analyze, provide, and share AI-safety statistics and information. It must submit its prior-year performance and current-year business plan to the Minister by January 31 each year.

Industry Development and Infrastructure

The Decree gives detailed effect to AI-industry development measures. It permits support for AI research infrastructure, joint research with foreign specialist organizations and international organizations, training-data production and processing, data-quality initiatives, standard contracts, legal research, AI-system deployment, user-protection training, and technical assistance. These measures place research, commercialization, data resources, and user protection within the broader national AI-development framework.

The Ministry must establish and manage an integrated training-data provision system capable of unified search, systematic classification, source information, interoperability with other platforms, and information on data valuation and quality management. This framework supports access to training data while organizing information about the provenance, quality, and usability of data made available through the system.

The Decree also establishes rules for AI clusters and demonstration infrastructure. AI-cluster designation must consider alignment with the master plan, regional concentration and competitiveness, economic-development potential, duplication and connectivity with other clusters, and sustainable access to expert personnel. Dedicated cluster institutions must meet organizational, staffing, location, facility, and information-system requirements, including employment of at least five full-time support staff. Central and local authorities may request relevant public bodies, research institutes, and national or public universities to provide information needed to make AI demonstration infrastructure available.

Transparency and Generative AI Indications

Article 23 establishes concrete transparency methods. Providers of products or services using high-impact AI or generative AI must notify users in advance that the product or service operates on that AI. Notice may be placed directly on the product or service, in contracts, manuals, or terms; on the user’s screen or terminal; at the relevant place of provision; or through another method recognized by the Minister. Notices and indications must be recognizable to users, including by visual, auditory, software-enabled, and accessibility-sensitive means that account for primary users’ age and physical or social conditions.

For generative-AI indications, an operator may use a human-perceivable method or a machine-readable method. Where a machine-readable method is used, the operator must also provide at least one textual, voice, or similar notice that the output was generated by generative AI. The obligation therefore accommodates technical provenance or metadata mechanisms while retaining a user-facing disclosure requirement.

Exceptions may apply where the AI use is obvious from the product or service name, interface, exterior, or output; where use is solely internal; or where the Minister publicly notifies another justified exception based on the product, output, use pattern, or state of technology. These exceptions are limited to the specified circumstances and do not displace the general obligation to give advance notice for covered high-impact or generative AI products and services.

Frontier AI Safety Threshold

Article 24 sets the threshold for the statutory AI safety obligation by requiring all three prescribed conditions. First, the AI system must have used cumulative training compute of at least 10²⁶ floating-point operations. Second, it must be configured and operated using state-of-the-art AI technology in light of technological development. Third, it must present a risk likely to have widespread and significant effects on life, bodily safety, or fundamental rights.

The threshold is therefore not based on training compute alone. A system must also satisfy the technology and risk criteria before falling within the prescribed scope. The Minister of Science and ICT is responsible for publicly notifying the detailed method for calculating cumulative training compute, supporting a common administrative method for applying the compute criterion.

High-Impact AI Confirmation and Assessment

The Decree provides a formal process through which an AI business operator may request confirmation whether an AI product or service constitutes high-impact AI. The request must include an overview of the product or service, an overview of training data used for development and training, materials verifying the system’s use process and results, and any other relevant materials. This process allows the operator to submit information relevant to the system’s intended deployment, development inputs, and operation.

The Minister assesses the statutory field of use, risk impact, severity, frequency, sector-specific characteristics, the operator’s prior review, specialized-committee advice where obtained, and other publicly notified considerations. The Ministry must respond within 30 days after receiving a confirmation request. It may extend this period once, for up to 30 additional days, where complexity or importance makes a timely response impracticable, and must notify the requester in writing of the reason and extension period.

An operator disputing the response may seek reconfirmation within 10 days. The Minister must consult the specialized committee for reconfirmation and respond within 30 days. The specialized committee has at least 50 members and may operate five-member subcommittees for efficient advisory work. The Decree thereby establishes both an initial classification procedure and a defined mechanism for reconsideration.

High-impact AI impact assessments must address affected persons and groups, implicated fundamental rights, social and economic effects, use patterns, evaluation metrics, risk mitigation and loss recovery measures, and improvement plans. This prescribed content links assessment activity to the effects of deployment, the identification of affected interests, measurable evaluation, mitigation, recovery, and continuing improvement.

Documentation, Public Information, and Domestic Agents

High-impact AI operators must implement the measures in Article 34(1) of the Framework Act and retain supporting documents, including electronically retained documents, for five years. They must publicly post the principal content of risk-management arrangements, explanation measures, user protections, and the name and contact details of the responsible supervisor, subject to protection of trade secrets. The documentation and publication requirements connect internal compliance evidence with externally available information about key safeguards.

Article 29 defines foreign AI business operators required to appoint a domestic agent. A domestic agent is required where the operator has total revenue of at least KRW 1 trillion, AI-service revenue of at least KRW 10 billion, average daily domestic users of at least one million during the preceding three months, or a prior administrative fine under Article 43(1)3 of the Framework Act. Each listed condition functions as an independent threshold for domestic-agent applicability.

The domestic-agent framework provides a local representative for covered foreign operators. Operators must assess their total revenue, AI-service revenue, domestic user base, and enforcement history against the Decree’s thresholds when determining whether appointment is required under the Act.

Administrative Fines and Procedural Review

The Decree does not itself create a separate civil-liability regime. Instead, Article 32 provides that criteria for administrative fines under Article 43(1) of the Framework Act are set out in Appendix 2. The operative amount and application of an administrative fine therefore depend on the Act and the Appendix 2 criteria.

A prior administrative fine under Article 43(1)3 is also a standalone trigger for an AI business operator to fall within the domestic-agent criteria under Article 29. This connects prior enforcement action to the duty of certain foreign operators to designate a domestic representative.

The principal procedural review mechanism in the Decree concerns high-impact AI classification. An operator receiving a confirmation result may submit a reconfirmation request within 10 days, with the prior result and additional relevant documents. The Minister’s reconfirmation review requires consultation with the specialized committee and a response within the prescribed 30-day period.

Relationship to Other Instruments and International Cooperation

The Decree is subordinate to and implements the Framework Act on the Development of Artificial Intelligence and Establishment of Trust. It repeatedly relies on duties and concepts established by that Act, including the national AI master plan, the Presidential Council, AI Safety Institute, high-impact AI responsibilities, transparency duties, safety duties, domestic-agent appointment, surveys, delegation of functions, and administrative fines. It also repeals the former Regulations on Establishment and Operation of Presidential Council on National Artificial Intelligence Strategy, while preserving continuity through transitional provisions.

Numerous provisions coordinate with other South Korean legal instruments. These include the Framework Act on Intelligent Informatization, the Act on the Management of Public Institutions, data-industry legislation, local-government institution legislation, the Civil Act, and laws governing defense, intelligence, cybersecurity, strategic technologies, and industrial technology. The Decree’s provisions on AI cluster institutions identify eligible public and nonprofit bodies by reference to those statutes. It also allows certain high-impact AI measures to be treated as fulfilled in the cases specified in Appendix 1, including the separately effective portion concerning digital medical devices.

International cooperation is embedded in the industrial and institutional provisions rather than framed as a mutual-recognition regime. Article 11 permits collaboration and joint research with foreign organizations specializing in AI technology development, research, and investigation, as well as with international organizations. Article 16 provides for entrustment of programs supporting international cooperation and overseas market entry to public institutions or organizations engaged in AI-industry promotion, research and development, and international cooperation.

The AI Safety Institute’s operational scope includes construction and operation of AI safety evaluation systems, acquisition and disclosure of AI-safety data, and analysis, provision, and sharing of relevant statistics and information. Its operating standards may address domestic and international cooperation systems. The verification-and-certification support framework also covers international standards and their use. These provisions support engagement with foreign partners and international AI safety and assurance practices.

Implementation Timeline

Sources and References