I. Background
On December 26, 2024, the Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation of Trust (the “Act”) was passed by the Korean National Assembly in its plenary session. The Act is scheduled to take effect one (1) year after its promulgation. Upon its implementation, the Act is expected to have a significant impact on the related industries by expanding support for AI development and innovation, while introducing various regulations to ensure the AI reliability and mitigate associated risks.
BKL previously issued a Legal Update introducing the key provisions of the Act (Link) on December 10, 2024 following its approval by the National Assembly’s Science, ICT, Broadcasting, and Communications Committee and was pending plenary approval. This newsletter provides an in-depth comparison between the Act and the EU AI Act, alongside an analysis of its anticipated industry-wide impacts and outlook.
II. Analysis of the Key Provisions of the Act
A. Key Provisions of the Act
The Act can be categorized into two primary areas: (1) the establishment of a national support system to promote AI technology and related industries, and (2) the imposition of specific obligations on AI operators (particularly those involved in ‘high-impact AI’ and ‘generative AI’).
For more detailed information, please refer to BKL’s Legal Update dated December 10, 2024.
(1) National Support for AI Development:
Key provisions include:
-
The Minister of Science and ICT, in collaboration with relevant ministries, is required to establish a framework plan for the promotion of AI technology and the AI industry and the enhancement of national competitiveness, every three (3) years (Article 6).
-
The establishment of the National AI Promotion Committee, under the direct authority of the President (Articles 7 and 8) and various government support initiatives for the promotion of AI technology and the AI industry, as well as support for SMEs and startups (Articles 13 to 18, 21, and 22).
-
The government’s obligation to implement policies for the establishment and operation of AI data centers (Article 25).
(2) Obligations for AI Operators (primarily ‘high-impact AI’ and ‘generative AI’ operators)
Key obligations include:
-
‘High-impact AI’ and ‘generative AI’ operators are required to ensure transparency (Article 31) and safety (Article 32) in the use of AI.
-
Operators involved with ‘high-impact AI’ are obligated to establish and implement risk management measures and user protection plans, and to ensure human oversight and supervision of ‘high-impact AI’ (Article 34). Additionally, AI operators without a registered address or business office in Korea but falling under criteria set by Presidential Decree are required to designate their domestic representatives (Article 36).
-
The Minister of Science and ICT has the authority to conduct investigations and to issue cessation or rectification orders (Article 40(3)), and to impose fines of up to KRW 30 million on AI operators for non-compliance therewith (Article 43(1)3).
B. Comparison with the EU AI Act
Following the EU’s adoption of the EU AI Act on May 21, 2024, Korea became the second jurisdiction to enact a dedicated AI framework law. The Act and the EU AI Act differ significantly in the following aspects: (1) regulatory targets, (2) regulatory scope, and (3) sanction mechanisms. Below, we provide a detailed comparison of these two legislative frameworks.
The Act and the EU AI Act share the common feature of adopting a risk-based approach, which differentiates regulatory application according to the level of risk associated with AI. However, the Act specifically defines and regulates ‘high-impact AI’ and ‘generative AI’ only, whereas the EU AI Act categorizes the risks of AI into four types: ‘Unacceptable risk,’ ‘high risk,’ ‘limited risk,’ and ‘low risk.’ The term ‘high-impact AI’ in the Act primarily refers to AI used in areas such as healthcare, transportation, and energy, where human safety, health, or fundamental rights are at stake. While this is comparable to the ‘high-risk AI’ category under the EU AI Act, the Act employs the value-neutral term ‘impact’ rather than ‘risk.’
Additionally, the Act defines ‘AI developers,’ who develop and provide AI to the entities subject to regulation, and ‘AI users,’ who offer AI products or services based on AI provided by AI developers, collectively as ‘AI operators’ (Article 2(7)), imposing common obligations on these entities.
On the other hand, the EU AI Act categorizes entities involved with high-risk AI into ‘provider,’ ‘deployer,’ ‘importer,’ and ‘distributor,’ and imposes related obligations on them in a differentiated manner (Articles 23 to 29 of the EU AI Act). As shown above, compared to the Act, the EU AI Act imposes a higher level of obligations on importers and distributors of high-risk AI, as well. These entities are obligated to ensure that compliance with the applicable requirements is not obstructed while a high-risk AI system is under their responsibility. Distributors, in particular, are obligated to implement corrective actions, recalls, or withdrawals if a high-risk AI system fails to comply with the relevant requirements.
The EU AI Act stipulates broader exceptions compared to the Act. The Act only exempts ‘AI developed or utilized exclusively for national defense or security purposes’(Article 4(2)), whereas the EU AI specifies additional exceptions where AI is used for certain purposes, including: (1) National defense or security, (2) research, testing, and development conducted prior to market launch or service deployment, (3) development and use exclusively for scientific research and development, and (4) use for purely personal non-professional activities (Article 2 of the EU AI Act).
Both the Act and the EU AI Act introduce a voluntary impact assessment system and a domestic representative system. However, the EU AI Act imposes a stricter level of sanctions, under which AI operators in violation of law may face fines of up to 7% of their global sales or €35 million, with the amount adjusted based on the size of the company (lower fines are applicable for SMEs and startups). In contrast, the Act imposes a maximum fine of KRW 30 million regardless of company size.
In conclusion, regulations under the EU AI Act appear more detailed, segmented, and stringent than those under the Act, whereas the Act focuses more on developing and promoting the AI sector through government support. However, the narrower scope of exceptions under the Act results in broader applicability, requiring operators to carefully determine the applicability of each regulation.
III. Industry-Specific Impact and Anticipated Outlook of the Act
A. Analysis of Industry-Specific Impact of the Act
The Act is anticipated to significantly influence various aspects of AI-related industries, requiring businesses to carefully analyze their specific obligations and take appropriate measures to address them.
For the rapidly growing mobility industry, AI systems for, e.g., autonomous vehicles, fall under ‘high-impact AI,’ which has significant impact on health and safety. As such, companies must enhance safety assessments, data transparency, and user notification systems to comply with the transparency and safety requirements under the Act. .
AI systems in the medical device and healthcare sectors are also categorized as ‘high-impact AI’ because of their profound impact on health and safety. Specifically, in the medical device sector, the Digital Healthcare Products Act (“DHPA”), which governs clinical trials, approvals, and quality control for digital medical products such as AI-based software, is already in effect. This makes it crucial for businesses in this sector to prepare proactively. The Ministry of Food and Drug Safety recently clarified in a DHPA briefing that “AI-related regulations are also addressed in the AI Framework Act by the Ministry of Science and ICT, and AI medical devices will not be subject to additional safety regulations if they comply with the DHPA.” It further stated that “The regulations outlined in the AI Framework Act will be incorporated into the DHPA to avoid overlapping regulations.”
However, this clarification does not entirely exempt AI medical devices from the scope of the Act. Accordingly, businesses operating in this sector must ensure compliance with the DHPA while closely monitoring government support policies and potential regulatory updates under the Act.
For financial institutions, AI systems used in credit rating, recruitment, and borrowing processes—which may significantly affect individuals’ rights and obligations—are likely to fall under the purview of the Act. The Financial Services Commission (“FSC”) has already issued ‘AI Guidelines’ recommending that financial institutions implement appropriate internal controls and approval procedures for high-risk services that could pose material risks to individuals’ rights, benefits, safety, and freedoms, including risks of undue discrimination.
While some financial institutions have incorporated these guidelines into their AI operations, the Act may impose additional obligations beyond what is currently covered. Consequently, financial institutions must carefully examine the Act’s regulatory provisions and adjust their AI systems accordingly. Moreover, as the scope of ‘high-impact AI’ services under the Act is narrower than that of ‘high-risk services’ specified in the FSC’s guidelines, institutions must remain vigilant regarding future enforcement practices to ensure compliance.
B. Evaluation and Future Outlook of the Act
The enactment of the Act has prompted mixed reactions from industries affected by its provisions. On one hand, it is viewed positively for establishing a legal framework to promote AI technology and industry at the government level, a move expected to encourage future investments. On the other hand, concerns remain regarding the ambiguity of its regulatory provisions, which creates uncertainty in the business environment.
One major criticism centers on the definition of ‘high-impact AI,’ which is considered overly abstract and broad, making it difficult to establish clear standards for risk management or prohibitive measures. While the use of the term ‘impact’ is more neutral compared to the EU’s ‘high-risk AI,’ there is apprehension that this neutrality might lead to an unwarranted expansion of regulatory targets.
Another significant concern involves the lack of clarity in the implementation requirements of the fact-finding investigation provision under Article 40. Critics fear that investigations could be initiated based on simple petitions or anonymous reports. In response, the government has expressed its intent to address this issue through subordinate regulations, ensuring that fact-finding investigations are not driven by the private interests of petitioners or anonymous complaints. Nevertheless, it remains essential for the legislative process surrounding these subordinate regulations to effectively address the issue of uncertainty.
Additionally, the Act has been criticized for prioritizing industrial promotion over proactive regulation, resulting in the absence of detailed and effective regulatory measures for high-impact AI. Compared to the EU AI Act, which imposes stricter sanctions on AI technologies that may be unethical or socially harmful, the Act has been faulted for its lack of equivalent safeguards. There is also criticism that the Act fails to provide adequate protective measures for issues such as copyright and data privacy arising from AI applications. During the drafting process, various stakeholders had raised concerns. For example, the Director of the Ministry of Culture, Sports and Tourism proposed including a declaratory provision requiring the disclosure of AI learning data related to creative activities. Similarly, five media organizations, including the Korea Newspaper Association, urged generative AI operators to disclose learning data transparently and allow copyright holders appropriate access to it. However, these recommendations were ultimately not included in the final version of the Act. It is anticipated that such issues will be addressed through subordinate regulations or other legislative measures in the future.
Moving forward, the Act’s provisions are expected to be supplemented and clarified through enforcement decrees, addressing many of the current gaps. It is vital for the government to incorporate the criticisms raised by stakeholders and concretize the scope and requirements of the regulations. Accordingly, AI-related operators must review the law’s applicability to their operations and prepare to comply with its requirements. Furthermore, they should actively participate in the formulation of enforcement decrees, public notices, and guidelines to ensure the regulations are both rational and practical.
[Korean version]
