Binds Personal information controllers in Korea (and, via Art. 26(8), their processors) that make significant decisions about individuals through fully automated systems, including AI systems. Where a decision made by processing personal data with a completely automated system — expressly including systems applying artificial-intelligence technologies — significantly affects a data subject's rights or duties, the data subject may object to it and may request an explanation. On objection or an explanation request the controller must not apply the automated decision absent compelling reason, or must take necessary measures such as re-processing with human involvement and providing an explanation. Controllers must also publicly disclose the criteria and procedures for automated decisions and how personal data is processed in them.
Inserted by the PIPA amendment Act No. 19234, promulgated 14 March 2023. Addenda Art. 1(1) defers Art. 37-2 (and Art. 75(2) 24) to 'the date one year elapses after the date of promulgation' = 15 March 2024, unlike the bulk of the amendment which took effect 15 September 2023. Art. 37-2(1) excludes automatic dispositions by administrative authorities under Art. 20 of the Framework Act on Administration, and the right to object does not apply where the automated decision is made under Art. 15(1) 1, 2 or 4 (consent, statutory obligation, or performance of a contract) — in those cases only the explanation/review rights remain. Detailed procedures are set by the PIPA Enforcement Decree (Arts. 44-2 to 44-5), also effective 15 March 2024. Distinct from and additional to the AI Basic Act duties (see kr-aibasic-transparency, kr-aibasic-highimpact): this duty is triggered by personal-data processing, not by AI-operator status.
Stated maximum penalty — Administrative fine up to KRW 30 million for failing to take the measures required by Art. 37-2(3) (PIPA Art. 75(2) 24); PIPC enforcement
Binds AI business operators offering AI products/services in Korea (extraterritorial). Pre-notify users that a service uses AI; label generative and realistic synthetic outputs.
MSIT enforcement grace period of AT LEAST one year from 22 Jan 2026 before administrative fines are imposed — confirmed in an MSIT primary release (English press release on the AI Basic Act Enforcement Decree legislative notice, 12 Nov 2025: https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1191). That release states MSIT "will implement a grace period of at least one year before administrative fines are imposed" and that "efforts are currently underway to gather opinions to finalize the detailed operation plan and duration of this grace period" — so ~22 Jan 2027 is a FLOOR, not a confirmed end date, and the release states no exception or carve-out to the grace period. The 22 Jan 2026 in-force date is separately primary-sourced (law.go.kr).
Stated maximum penalty — Admin fine up to ₩30M
In force · 22 Jan 2026✓ checked 21 Aug 2026AI Basic Act ↗high confidence
Binds Operators of high-impact AI and advanced / high-compute AI. Risk management, human oversight and impact assessment for high-impact / advanced AI (MSIT administrative-fine grace period of at least one year from 22 Jan 2026).
MSIT enforcement grace period of AT LEAST one year from 22 Jan 2026 before administrative fines are imposed — confirmed in an MSIT primary release (see kr-aibasic-transparency, nttSeqNo=1191). Duration is not yet finalised by MSIT, so ~22 Jan 2027 is a floor rather than a confirmed end date, and the release states no carve-out. The 22 Jan 2026 in-force date is primary-sourced.
Stated maximum penalty — Admin fine up to ₩30M
In force · 22 Jan 2026✓ checked 21 Aug 2026AI Basic Act ↗high confidence
Questions & answers
From the data
When does AI Basic Act (Framework Act on AI) take effect in South Korea?
AI Basic Act (Framework Act on AI) is already in force, with obligations live since March 15, 2024. Comprehensive horizontal AI law in force since 22 Jan 2026.
Who must comply with AI rules in South Korea?
Current obligations bind, among others, AI business operators offering AI products/services in Korea (extraterritorial); Operators of high-impact AI and advanced / high-compute AI. Scope and thresholds vary per instrument — see each row's source for the legal text.
What are the penalties for AI non-compliance in South Korea?
Stated statutory maxima include: AI Basic Act — Admin fine up to ₩30M; AI Basic Act — Admin fine up to ₩30M. These are the maximum amounts in the instruments; actual enforcement is at the regulator's discretion.
Not legal advice. Each obligation links to its primary source and carries the date it was last checked; verify the legal text before relying on it.