SEOUL, 22 AUG 2026 — South Korea's AI Basic Act and its Enforcement Decree took effect on 22 January 2026, making Korea the first jurisdiction after the European Union with a comprehensive national law governing artificial intelligence.
Seven months on, the substantive obligations apply, the maximum administrative fine is ₩30,000,000 — roughly US$20,000 — and even that is suspended for at least a year except where serious harm is involved. The grace period ends five months from now.
What the Act requires
Two obligations do most of the work. Any business producing AI-generated content visible to Korean users must notify them in advance and label output that would be hard to distinguish from material not generated by AI. Separately, systems falling into the high-impact categories carry lifecycle risk management, impact assessments and compliance reporting.
Deferral of fines is not deferral of duties. The obligations bind now; what is suspended is the penalty for breaching them, and the exception covers cases involving loss of life or human rights violations.
The extraterritorial provision is the part that reaches ASEAN
Most coverage of this law has focused on what it asks of Korean companies. The clause that matters to a business in Singapore, Kuala Lumpur or Jakarta is the one about foreign providers.
A provider without a domestic address must appoint a domestic representative in Korea if it crosses any of three thresholds: prior-year revenue of ₩1 trillion or more, AI service segment revenue of ₩10bn or more, or average daily Korean users above one million.
The threshold to watch is the second one: ₩10bn in AI-service revenue. That is roughly US$7m, a figure a regional software business with a Korean customer base could hit. The obligation attaches only to the AI segment, not the whole company, but it is low enough to catch businesses that do not consider themselves multinationals.
Appointing a domestic representative is not a licence application, just an administrative step. But it gives Korean regulators a point of contact to serve papers to, which is the point. Any company that assumed this law could not reach them needs to check their AI revenue against that ₩10bn threshold.
A fine of twenty thousand dollars is not a deterrent, and may not be meant as one
The most striking part of the law is the penalty, which is tiny compared to the EU's.
The EU AI Act reaches €15m or 3 per cent of global turnover, whichever is higher. Korea's ceiling is a fixed ₩30m with no turnover multiplier at all, which for any company large enough to trigger the extraterritorial thresholds is an immaterial number. As a financial deterrent it does not function.
The generous reading is that this is deliberate. A first-mover statute in a jurisdiction that wants to remain attractive to AI investment can establish duties, definitions and a reporting relationship without the confrontation that large penalties invite, and can raise the ceiling later once the framework has bedded in. Getting the categories and the risk-management expectations into law is the durable part; the number is adjustable.
The sceptical reading is that a law with immaterial penalties and a year of suspended enforcement is a signal rather than a constraint, and that the domestic criticism of the draft decree — for limited scope and delayed penalties — was aimed at exactly this.
Both readings predict the same near-term behaviour: compliance driven by reputational and procurement pressure rather than by fear of the fine.
Why the real cost is documentation, not penalties
The fine is a distraction. The real cost of compliance is documentation, and that cost lands whether or not a regulator ever comes asking.
High-impact systems require lifecycle risk management and impact assessments. This means someone in engineering has to document what the system does, what could go wrong, who is affected, and what the controls are — and then keep that document current. That is expensive in engineering time, regardless of the penalty for getting it wrong.
That cost is incurred whether or not a regulator ever asks. It is also the cost that transfers: an organisation that has done this work for Korea has most of what the EU AI Act's high-risk regime asks for, and a good deal of what any subsequent Asian framework is likely to ask.
The Korean law acts as an early forcing function for this work. A company that does it now will find compliance in the next jurisdiction much cheaper.
What the labelling requirement actually demands
The generative AI provision is the one most likely to affect consumer-facing products across the region, and its wording is broader than a watermarking rule.
The requirement for advance notification and labelling of hard-to-distinguish output is a product design problem, not a metadata one. A watermark satisfies a detection tool, but telling a user they are about to see AI-generated content means changing the UI.
For a regional company shipping one product across several markets, this is the familiar problem of the strictest jurisdiction setting the build. It is usually cheaper to label everywhere than to maintain a Korean variant, which is how a national transparency rule becomes a regional default without any other regulator acting.
What remains unconfirmed
No enforcement action under the Act has been reported, and with fines deferred none would be expected yet. It is not yet clear how many foreign providers have appointed domestic representatives, if the regulator is actively assessing the thresholds, or how the high-impact categories are being interpreted at the margins.
Whether the grace period will be extended beyond 22 January 2027 is not stated, nor is whether the fine ceiling will be revisited. The status of the criticism levelled at the draft decree over limited scope, and whether the final decree addressed it, is not established in the material reviewed.
What to watch for
January is the date that matters. If the grace period lapses on schedule, the Act becomes enforceable in a jurisdiction with a real regulator and a defined process, and the first case will establish far more than the statute does.
Watch also for a penalty amendment. A ceiling that does not scale with turnover is the obvious thing to revisit once the framework is established, and a proposal to raise it would confirm the generous reading of the current number.
The third signal is interpretive guidance on the high-impact categories. The definitions of employment and financial services are broad. Where the regulators draw the line will determine if this law governs only high-stakes decision systems or a much wider range of business software.
View author profile → · Editorial policy
