South Korea's AI Basic Act and Enforcement Decree take effect

South Korea's AI Basic Act is a national AI law that pairs industrial promotion with baseline duties on trust, safety, transparency and user protection, and it took effect together with its Enforcement Decree on 22 January 2026. The US International Trade Administration advises companies offering AI products in Korea to assess compliance before launch, particularly for generative, high-impact or large-scale advanced AI.

What it is

The Ministry of Science and ICT (MSIT) implements the law and describes its approach as minimum regulation. MSIT is running a grace period of at least one year in 2026, during which fact-finding investigations and administrative fines are generally deferred, except in exceptional cases of serious social harm such as loss of life or human-rights violations. It has published guidelines on high-impact AI determination, operator obligations, impact assessments, generative AI transparency and advanced AI safety.

What it requires

Providers using high-impact or generative AI must tell users in advance that AI is being used, and may need to mark outputs as AI-generated where images, video or audio could be hard to tell from reality. Operators of high-impact AI may need risk management plans, explainability measures, user safeguards, human oversight, documentation and recordkeeping. Large-scale advanced systems, for example those trained with more than 10²⁶ FLOPs, can face additional risk identification, assessment and mitigation duties. A foreign operator with no Korean office may have to appoint a domestic representative if it had prior-year revenue of at least KRW 1 trillion, AI-service revenue of at least KRW 10 billion, or at least one million average daily domestic users over the preceding three months.

What security leaders should do

Use the grace period to build the evidence the law expects rather than waiting for enforcement to start. Add the Korean disclosure and labelling duties to the product security review for any customer-facing AI feature, and make sure records of risk management, human oversight and system logs are retained in a form you could hand to a regulator. If your organisation may cross the domestic-representative thresholds, agree early who owns regulatory contact and incident communication in Korea.