It was only a matter of time before other jurisdictions joined the EU in establishing formal rules around artificial intelligence development and use. South Korea now has pending legislation that will require AI providers to establish an in-country representative to ensure products comply with prescribed safety and governance requirements.
The Act on the Development of Artificial Intelligence and Establishment of Trust, or the AI Basic Act, shows some influence from the EU AI Act in how it classifies AI based on risk and how it handles human oversight, record-keeping and transparency. But stakeholders view the legislation, which is likely to become law before the end of January, as ultimately less prescriptive, leaving room for future action around enforcement and decrees.
According to Korea.net, South Korea Minister of Science and ICT Yoo Sang-Im called enactment of the law "a crucial milestone for Korea" that helps resolve "corporate uncertainty and stimulating large-scale public-private investment."
"Through close communication in the field, we will do our best to swiftly enact subordinate statutes and devise various policies toward industrial support, as well as quickly launch a national base for AI computing," Sang-Im added.
VeraSafe Privacy Counsel Kyoungsic Min, AIGP, CIPP/E, said AI deployers should take the law's year-long transition before enforcement to prepare for its requirements around risk management, user notification, explanation obligations and labeling.
"While much will depend on upcoming enforcement decrees and administrative notices, the Act signals a deliberate move toward ensuring both AI innovation and responsible oversight in South Korea," he said.
Key elements of the bill
APAC GATES Managing Director Seth Hays said the bill reflects areas of interest South Korea has already been focused on. It requires generative AI content to be labeled, a development coming as the country is in the middle of a seven-month crackdown on explicit deepfake content and after a taskforce was launched dedicated to eradicating the issue. How the labeling requirement will be enforced will come in future regulations.
It also focuses heavily on promoting the AI industry by expressly calling for the funding of data centers, attracting and developing AI talent and making data more accessible. The country is looking to scale up its AI industry and has planned a multi-trillion won investment in general-purpose AI as wells as a KRW50 billion investment into building a national AI computing center, according to the Maeil Business Newspaper.
The bill places new requirements on some categories of AI systems. High-impact AI — such as those used in essential services, health care, employment and hiring — needs advance user notification and deployers need to have risk management plans and ensure human oversight is included in its use, Min said. Large-scale AI needs to have a risk management system in place.
These elements show similarities to the EU AI Act, however, Min noted many of the requirements placed on AI systems will not materialize immediately, making the impending law less stringent for now. The AI Basic Act also encourages AI risk assessments rather than requiring them, he said.
A unique feature is the bill's requirement that overseas AI providers which meet certain user or revenue thresholds and do not have a Korean address or place of business must establish a domestic representative, Min said. Those entities will be responsible for safety assurance reports, confirming an AI system is high impact and making sure those systems are compliant with safety and trust requirements. The thresholds for that requirement will also be set by a presidential decree.
The act also requires deference to other laws where overlapping issues may arise, Min added. He pointed to personal data protection, which is governed by the Personal Information Protection Act, noting deployers would have to follow whichever requirements are more stringent between the two laws.
"Thus, AI developers must maintain compliance with all relevant laws, including those involving technical and organizational measures for data protection and privacy," he said.
Hays argued the bill does not show signs of a "Brussels effect" because it is more focused on immediate concerns facing the population rather than the "over regulation" he sees in the EU AI Act. The bill makes references to the protection of human rights, but Hays noted the country's digital rights rules is governed by its 2022 Digital Bill of Rights. Any future guidance on how to implement the AI Basic Act will be industry-friendly, he said.
"While the EU AI Act and the Korea Act share similar concerns about risk-based assessments of AI harm, there are more immediately practicable aspects of the Korean act in terms of it addressing issues such as generative AI labeling," Hays said.
Likelihood of success
The act has had a long genesis, originally being introduced in the 21st National Assembly session, which ran from 2021 to 2023, and again in the current session. Min said the legislators were originally focused on a “permit first, regulate later” approach — concerns about generative AI and issues such as deepfakes prevented the bill’s initial passage in the 21st session.
In contrast, most debate on the second iteration focused on which government body would oversee enforcement and how far regulation should extend. Min said the Ministry of Culture, Sports, and Tourism also raised concerns about requiring entities to store or disclose training data, but those provisions did not make it into the final product. Over a dozen AI bills were consolidated into the final version.
The AI Basic Act's passage through the current assembly came a few weeks after President Yoon Suk Yeol declared martial law. He was later impeached for that action and arrested 15 Jan. after a failed attempt earlier this month. His deputy prime minister, Choi Sang-mok, has been named acting president.
Despite the situation, Min said the bill's overwhelming success in the National Assembly — 260 out of 264 lawmakers approved it on final passage in late December 2024 — all but ensures its success. The acting president has 15 days to promulgate the bill or veto it once it was forwarded to him 10 Jan. Laws in South Korea typically take effect 20 days after promulgation, but the bill stipulates enforcement will not occur until January 2026.
"A presidential veto is, in itself, an unusual decision," Min said. "The AI Basic Act is supported by all parties, and there is no controversial debate surrounding the law. Therefore, I see no reason why the acting president would choose to veto this bill."
Caitlin Andrews is a staff writer for the IAPP.
