Two things that are commonly misread
Korea's AI Framework Act has applied since 22 January 2026. Companies outside Korea tend to get two things wrong about it, and they pull in opposite directions.
It reaches further than expected. An "AI business operator" is not only a company that develops and supplies AI. It also covers a company that uses AI to provide a product or service. Adding an external model to an existing service brings you inside the Act.
It bites less hard than expected. The Act carries no surcharge. The only monetary sanction on business operators is an administrative fine capped at 30 million won, and it is available for three violations only. A company that has calibrated its Korean risk from the Personal Information Protection Act — where a surcharge can reach a share of turnover — will read this Act as more dangerous than it is, and the Personal Information Protection Act as less.
When a domestic representative is required
If the company has no address or place of business in Korea, a separate duty applies: appoint a domestic representative under article 36(1).
The thresholds are in article 29(1) of the Enforcement Decree, and one of them catches companies that assume they are too small: revenue in the AI services segment of 10 billion won brings the duty even where total revenue is modest. Failure to appoint is one of the two violations that draw a fine directly, with no investigation step in between.
High-impact AI is where the burden actually divides
This is the point in the Act where the load changes most. If a system is high-impact, a set of duties attaches at once. If it is not, that burden disappears entirely.
The assessment runs against ten domains in article 2(4). The one that reaches ordinary commercial businesses most widely is (g): judgments or evaluations that materially affect an individual's rights or obligations — hiring and loan screening are the standard examples.
Two points about the procedure are easy to invert.
The mandatory step is the review, not the confirmation. Article 33(1) requires an AI business operator to review in advance whether its AI is high-impact, and says it may ask the Minister of Science and ICT to confirm the position where necessary. Failing to carry out the review is what departs from the provision. Concluding on review that the system is not high-impact, without asking for confirmation, does not.
The impact assessment is a best-efforts duty for private operators. Article 35(1) says the operator "shall endeavour" to assess. But article 35(2) requires public bodies to give priority to products and services that have been assessed — so for anyone selling into the public sector the assessment becomes necessary in practice even though it is not mandatory in form.
How the duties are actually enforced — three tiers
Reading the fine provision alone gives a misleading picture. Article 40(1) lists the grounds on which the Minister may investigate, and laying that list against the fine provision splits the duties into three tiers.
| Tier | Provisions | What happens if you breach |
|---|---|---|
| Direct fine | art. 31(1) prior notice · art. 36(1) domestic representative | administrative fine, immediately |
| Two-step | art. 31(2) and (3) generative and deepfake labelling · art. 32(1) and (2) safety · art. 34(1) the six high-impact duties | investigation → corrective or suspension order → fine only if the order is not obeyed |
| No route of their own | art. 33(1) prior review · art. 35(1) impact assessment | not even listed as grounds for investigation |
The third tier is the one worth sitting with. The two duties that take the most work to discharge — reviewing whether your system is high-impact, and assessing its impact — are not grounds on which an investigation can be opened. Art. 40(3) lets the Minister order a breach of "this Act" to stop once an investigation has found one, so a missing prior review can still surface inside an investigation opened on other grounds; but nothing in the Act starts that process for these two duties alone, and the impact assessment is a best-efforts duty in any case.
That is not an argument for skipping them. The prior review is what tells you whether the second tier applies to you, and a company that never did it cannot show why it concluded it was outside. But it does mean the Act's pressure does not fall where the effort falls.
The grace period is not a deferral
The enforcement grace period announced for the Act is an administrative policy, not a transitional provision in the statute. The duties have existed since 22 January 2026. What the grace period says is that fact-finding investigations and fines will not, as a rule, be pursued during it.
Given the three tiers above, that matters less than it sounds. Only two violations draw a fine directly; everything else already runs through an investigation and an order before any money is at stake.
Where the Personal Information Protection Act picks up
The AI Framework Act is not the whole of the regulation. Where an AI system makes decisions about people, the Personal Information Protection Act attaches its own duties on automated decisions and on sensitive-data processing, and those sit inside its own sanction regime, which this Act does not have: refusing a data subject's objection to an automated decision without justification is an administrative fine matter (art. 75(2)24), while processing sensitive data without consent can draw a penalty surcharge (art. 64-2(1)3). Training data brings in the Copyright Act separately.
Related
- What takes effect when — including the AI training exception to the Personal Information Protection Act, in force 9 March 2027
- Breach notification — the 72-hour clocks
- Domestic representative — the parallel duty under the privacy legislation
- Korean guide — the full version, with every provision and the linked notes
Frequently asked questions
Q. Does Korea's AI Framework Act apply to a company that only uses AI, not one that develops it?
Yes. The definition of an AI business operator covers both those who develop and supply AI and those who use AI to provide products or services. A company that adds an external model to an existing service is inside the Act.
Q. Does Korea's AI Framework Act have fines like the EU AI Act?
No. The Act carries no surcharge. The only monetary sanction on business operators is an administrative fine of up to 30 million won under article 43(1), and it is available for three violations only: failure to give prior notice under article 31(1), failure to appoint a domestic representative under article 36(1), and failure to comply with a suspension or corrective order under article 40(3). A company calibrating its risk from the Personal Information Protection Act, where surcharges can reach a share of turnover, will overestimate this Act and underestimate that one.
Q. When does a foreign company need a domestic representative under Korea's AI Framework Act?
Where it has no address or place of business in Korea and meets one of four thresholds in article 29(1) of the Enforcement Decree. One of them is revenue in the AI services segment of 10 billion won, which can be met even where total revenue is modest. Failure to appoint is one of the two violations that draw an administrative fine directly.
This page is general information on Korean law and is not legal advice; whether a particular system is high-impact depends on its facts. Korean is the governing language of the statutes cited — the English renderings here are unofficial. The Act is recent and its subordinate rules are still developing; check the current text before relying on a provision.