The AI Basic Act: Korea's comprehensive AI framework
South Korea's Framework Act on Artificial Intelligence (인공지능 기본법), enacted in December 2024, represents a significant step in Korea's AI governance development. The Act establishes a risk-based framework that distinguishes between general AI and "high-impact AI" (고영향 AI) — AI deployed in contexts where errors could have serious consequences for individuals or society. High-impact AI contexts include: employment and human resource decisions, credit assessment and financial services, education and examination assessment, medical diagnosis and healthcare, and public safety and law enforcement.
High-impact AI deployers face specific obligations under the Act: notification to users that they are interacting with AI, transparency about AI capabilities and limitations, human oversight mechanisms ensuring individuals can request human review of AI decisions, impact assessment requirements for certain deployments, and registration with designated regulatory authorities. The specific implementation details are elaborated in subordinate regulations and sector-specific guidance that continued to develop through 2025 and 2026.
PIPA and AI: personal data obligations
Korea's Personal Information Protection Act (PIPA), substantially amended in 2023, creates specific obligations for AI systems processing personal data. The PIPA's automated decision-making provisions — modelled partly on GDPR Article 22 — give individuals the right to refuse decisions made by automated means if those decisions significantly affect their legal status or have major consequences. Where such decisions are made, the data subject can request explanation of the decision and human review. For financial services, employment, and healthcare AI, these rights are particularly significant.
The Personal Information Protection Commission (PIPC) has been active in developing AI-specific guidance under PIPA, including guidance on AI training data consent, transparency obligations for AI systems, and the application of automated decision-making rights in commercial contexts. PIPC enforcement on AI matters has increased significantly, with investigations into major Korean tech companies' AI data practices.
