1. What are the obligations under the AI Framework Act?
The ‘Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Framework Act),’ enacted with the goals of ‘fostering the AI industry’ and ‘creating an environment for safe use’ and taking effect on January 22, 2026, differs in many respects from existing IT systems and services, so confusion inside a company is inevitable, beginning with organizational composition and the establishment of governance.
To aid understanding of this policy direction for artificial intelligence, the Ministry of Science and ICT published five guidelines, and the Financial Services Commission accordingly released an updated version of the guidelines previously published for financial companies and the financial sector.
The matters made obligatory for AI development business operators and AI user business operators who are subject to this AI Framework Act differ by scale, but they can be summarized in five main items.
- Securing AI transparency (Article 31 of the Act): prior-notice obligation (paragraph (1)), obligation to label AI-generated output (paragraph (2)), deepfake notice obligation (paragraph (3))
- Securing AI safety (Article 32 of the Act): risk identification, assessment, and mitigation (paragraph (1), subparagraph 1), establishment of a risk management system (paragraph (1), subparagraph 2), submission of results (paragraph (2))
- Responsibilities of high-impact AI business operators (Article 34): establishment and operation of risk management measures, establishment and implementation of explainability measures, establishment and operation of user protection measures, human management and supervision, documentation of measures to ensure safety and reliability, and management of the implementation of matters deliberated by the committee
- Impact assessment of high-impact AI products and services (Article 35): when providing a product or service that uses high-impact AI, assess in advance the degree of impact on fundamental human rights
- Designation of a domestic agent (Article `36): in the case of a business operator` above a certain size, designate a domestic agent in writing and file a report. (*) Criteria for a certain size: previous-year revenue of KRW 1 trillion or more, previous-year revenue in the AI service segment of KRW 10 billion or more, a daily average of 1 million or more domestic users over three months, and a business operator with a history of administrative fines imposed under the Act
2. What do the five guidelines under the AI Framework Act contain?
A summary of the five guidelines provided by the Ministry of Science and ICT shows that an enterprise-wide response system must ultimately be in place.
- Guideline for Securing AI Transparency: It mainly covers customer touchpoints (UI/UX), such as watermarking of AI-generated content and notice of the fact that an AI service is being used.
- Guideline for Securing AI Safety: It consists of engineering compliance matters such as preventing technical defects in AI models, blocking data poisoning, ensuring system robustness, and lifecycle risk management.
- Guideline for Determining High-Impact AI: It consists of legal interpretation of whether an AI service operated by an AI development or user business operator falls within the legal category of ‘high-impact AI’ (social infrastructure, criminal investigation, recruitment, and so on).
- AI Impact Assessment Guideline: It consists of periodic risk assessment and management of services classified as high-impact AI.
- Ethics Guideline for High-Impact AI Business Operators: It performs the role of spreading across the enterprise, and providing training on, the social responsibility and ethical principles of AI development and user business operators (guarantee of human rights, respect for diversity, and so on)
3. How should preparation for responding to the AI Framework Act proceed?
The first task, as with preparation for any other new compliance response, must begin with forming an enterprise-wide TFT. Which organizations should participate in this TFT can be inferred from the five guidelines of the Ministry of Science and ICT.
| Guideline | Key Requirements | Responsible Organization |
| Securing transparency | Insertion of watermarks in AI-generated output, notice of the fact that an AI service is used, and so on | Service planning / marketing |
| Securing safety | Prevention of technical defects in AI models, blocking of data poisoning, assurance of system robustness, and lifecycle risk management | CTO / development / information security |
| Determination of high-impact AI | Assessment of, and response to, whether a service falls within the legal category of ‘high-impact AI’ (social infrastructure, criminal investigation, recruitment, and so on) | Legal / compliance |
| Performance of an AI impact assessment | Periodic risk assessment and management of services classified as high-impact AI | Quality management / risk management |
| Ethics of high-impact AI business operators | Enterprise-wide dissemination of, and guidance on, the social responsibility and ethical principles of AI development and user business operators (guarantee of human rights, respect for diversity, and so on) | ESG / strategy / HR |
After the enterprise-wide TFT is formed, a phased approach to establishing an AI management system is as follows.
Step 1. Understand the current state
- Inventory every AI service currently developed or operated in-house
- Identify the type of AI (in-house developed model, external outsourcing, external linkage), the service organization, the usage volume, and so on
- A primary risk assessment with the legal team of whether the service constitutes high-impact AI is essential
Step 2. Formalize R&R and enact governance regulations
- Define R&R in consideration of the layers of the organizational system from an enterprise perspective, and build consensus
- Produce policies, guidelines, procedures, and standards for each stage of the AI lifecycle (planning-design-development-evaluation and verification-operation monitoring)
Step 3. Build standardization for each stage of the AI lifecycle, and promote it
- Standardize the work procedures for each stage of the AI lifecycle on a platform (system)
- Validate the platform (system) through a pilot application, and revise and supplement it
- Provide training and other promotion to maximize enterprise-wide use of the platform (system)
Step 4. Share results and a continual improvement system
- Share the results of operating the established management system and platform
- Formalize the operating system for continual improvement