Two things that are commonly misread
Korea’s AI Framework Act has applied since 22 January 2026. Companies outside Korea tend to get two things wrong about it, and they pull in opposite directions.
It reaches further than expected. An "AI business operator" is not only a company that develops and supplies AI. It also covers a company that uses AI to provide a product or service. Adding an external model to an existing service brings you inside the Act.
It bites less hard than expected. The Act carries no surcharge. The only monetary sanction on business operators is an administrative fine capped at 30 million won, and it is available for three violations only. A company that has calibrated its Korean risk from the Personal Information Protection Act — where a surcharge can reach a share of turnover — will read this Act as more dangerous than it is, and the Personal Information Protection Act as less.
When a domestic representative is required
If the company has no address or place of business in Korea, a separate duty applies: appoint a domestic representative under article 36(1).
The thresholds are in article 29(1) of the Enforcement Decree, and one of them catches companies that assume they are too small: revenue in the AI services segment of 10 billion won brings the duty even where total revenue is modest. Failure to appoint is one of the three violations that draws a fine directly, with no investigation step in between.
High-impact AI is where the burden actually divides
This is the point in the Act where the load changes most. If a system is high-impact, a set of duties attaches at once. If it is not, that burden disappears entirely.
The assessment runs against ten domains in article 2(4). The one that reaches ordinary commercial businesses most widely is (g): judgments or evaluations that materially affect an individual’s rights or obligations — hiring and loan screening are the standard examples.
Two points about the procedure are easy to invert.
The mandatory step is the review, not the confirmation. Article 33(1) requires an AI business operator to review in advance whether its AI is high-impact, and says it may ask the Minister of Science and ICT to confirm the position where necessary. Not having done the review is what departs from the provision. Concluding on review that the system is not high-impact, without asking for confirmation, does not.
The impact assessment is a best-efforts duty for private operators. Article 35(1) says the operator "shall endeavour" to assess. But article 35(2) requires public bodies to give priority to products and services that have been assessed — so for anyone selling into the public sector it becomes necessary in practice even though it is not mandatory in form.
How the duties are actually enforced — three tiers
Reading the fine provision alone gives a misleading picture. Article 40(1) lists the grounds on which the Minister may investigate, and laying that list against the fine provision splits the duties into three tiers.
| Tier | Provisions | What happens if you breach |
|---|---|---|
| Direct fine | art. 31(1) prior notice · art. 36(1) domestic representative | administrative fine, immediately |
| Two-step | art. 31(2) and (3) generative and deepfake labelling · art. 32(1) and (2) safety · art. 34(1) the six high-impact duties | investigation → corrective or suspension order → fine only if the order is not obeyed |
| No route | art. 33(1) prior review · art. 35(1) impact assessment | not even listed as grounds for investigation |
The third tier is the one worth sitting with. The two duties that take the most work to discharge — reviewing whether your system is high-impact, and assessing its impact — have no enforcement path attached to them at all.
That is not an argument for skipping them. The prior review is what tells you whether the second tier applies to you, and a company that never did it cannot show why it concluded it was outside. But it does mean the Act’s pressure does not fall where the effort falls.
The grace period is not a deferral
The enforcement grace period announced for the Act is an administrative policy, not a transitional provision in the statute. The duties have existed since 22 January 2026. What the grace period says is that fact-finding investigations and fines will not, as a rule, be pursued during it.
Given the three tiers above, that matters less than it sounds. Only two violations draw a fine directly; everything else already runs through an investigation and an order before any money is at stake.
Where the Personal Information Protection Act picks up
The AI Framework Act is not the whole of the regulation. Where an AI system makes decisions about people, the Personal Information Protection Act attaches its own duties on automated decisions and on sensitive-data processing, and those carry the surcharge regime this Act does not have. Training data brings in the Copyright Act separately.
Related
- What takes effect when — including the AI training exception to the Personal Information Protection Act, in force 9 March 2027
- Breach notification — the 72-hour clocks
- Domestic representative — the parallel duty under the privacy legislation
- Korean guide — the full version, with every provision and the linked notes
Frequently asked questions
Q. Does Korea’s AI Framework Act apply to a company that only uses AI, not one that develops it?
Yes. The definition of an AI business operator covers both those who develop and supply AI and those who use AI to provide products or services. A company that adds an external model to an existing service is inside the Act.
Q. Does Korea’s AI Framework Act have fines like the EU AI Act?
No. The Act carries no surcharge. The only monetary sanction on business operators is an administrative fine of up to 30 million won under article 43(1), and it is available for three violations only: failure to give prior notice under article 31(1), failure to appoint a domestic representative under article 36(1), and failure to comply with a suspension or corrective order under article 40(3). A company calibrating its risk from the Personal Information Protection Act, where surcharges can reach a share of turnover, will overestimate this Act and underestimate that one.
Q. When does a foreign company need a domestic representative under Korea’s AI Framework Act?
Where it has no address or place of business in Korea and meets one of four thresholds in article 29(1) of the Enforcement Decree. One of them is revenue in the AI services segment of 10 billion won, which can be met even where total revenue is modest. Failure to appoint is one of the three violations that draws an administrative fine directly.
This page is general information on Korean law and is not legal advice; whether a particular system is high-impact depends on its facts. Korean is the governing language of the statutes cited — the English renderings here are unofficial. The Act is recent and its subordinate rules are still developing; check the current text before relying on a provision.