South Korea AI Basic Act: What Foreign Companies Must Know in 2026

South Korea's AI Basic Act (the Basic Act on the Development of Artificial Intelligence and Establishment of Trust) was passed in December 2024 and took effect on 22 January 2026. It is the world's second comprehensive AI framework law after the EU AI Act — and it explicitly applies extraterritorially.

Why foreign companies are in scope

The Act covers AI activities that affect the Korean market or Korean users, regardless of where the provider is established. Foreign companies above a certain user or revenue threshold in Korea must appoint a domestic representative responsible for compliance filings — a familiar pattern from GDPR and Korea's own PIPA.

The core concepts

• High-impact AI. Systems used in areas like energy, healthcare, medical devices, nuclear safety, biometric identification, recruitment, loan screening, and decisions that materially affect rights. These carry the heaviest duties.
• Generative AI transparency. Users must be told they are interacting with AI, and AI-generated content must be labeled as such — including deepfake-style synthetic media.
• Safety obligations for large models. Models trained above a compute threshold must implement risk identification and mitigation through their lifecycle and report on it.

Duties for high-impact AI operators

• Conduct and document a risk assessment before deployment.
• Establish risk management measures and user protection plans.
• Ensure human oversight of the system's decisions.
• Keep explanation capability — the basis of AI-driven results must be explainable to affected users.
• Verify in advance whether your system qualifies as high-impact; you can ask the Ministry of Science and ICT to confirm.

Enforcement and penalties

Compared with the EU AI Act's headline fines, Korea's are modest — administrative fines up to 30 million KRW (roughly USD 20–25k) for key breaches — but the reputational and market-access consequences are the real lever. The Ministry can investigate, order corrections, and publish results.

What an SME should do

• Check whether Korean users can access your AI-powered service today.
• Classify your use cases against the high-impact list.
• Add "you are interacting with AI" notices and generated-content labels — these are cheap to implement and required broadly.
• If you're above thresholds, line up a Korean domestic representative.

Korea rewards early movers: the Act pairs obligations with substantial government support for AI adoption, including programs aimed specifically at SMEs.