BKL’s AI Team is launch a newsletter series to introduce and analyze the subordinate guidelines of the Framework Act on AI released by the Ministry of Science and ICT (the “MSIT”). The fourth topic is “Responsibilities of High-Impact AI Business Operators.”
I. RESPONSIBILITIES OF BUSINESS OPERATORS INVOLVED IN HIGH-IMPACT AI
AI systems used in specific areas such as energy, healthcare, nuclear power, transportation, and education, which are likely to have a significant impact on, or pose risks to, human life, physical safety, and fundamental rights, constitute high-impact AI (Article 2, Subparagraph 4 of the Framework Act on AI (“AIFA”)). With respect to high-impact AI, the following measures must be disclosed on the company website or equivalent platform (Article 34(1) of the AIFA and Article 26 of the Draft Enforcement Decree).
To prevent overlapping regulations, if an AI development business operator fulfills its obligations, the obligations of the AI utilization business operator will be deemed satisfied (Article 26(2) of the Draft Enforcement Decree). In addition, where the same or similar measures are already taken under other laws, the obligations under the AIFA will also be deemed satisfied (Article 26(5) of the Draft Enforcement Decree).
To enhance the trust and safety of high-impact AI, MSIT has released a draft public notice (the “Public Notice of Responsibilities”) and guidelines (the “Guidelines”) on the responsibilities of business operators and has initiated the process of collecting opinions from industry and other stakeholders.
II. PROPOSED PUBLIC NOTICE: OVERVIEW AND KEY PROVISIONS ON BUSINESS OPERATOR RESPONSIBILITIES
-
(Establishment and Operation of Risk Management Plan) The proposed public notice stipulates that risk management policies and organizational systems must be established and operated when preparing a risk management plan (Article 4(1) of the Proposed Public Notice of Responsibilities). Accordingly, AI business operators must prepare and maintain a written risk management plan, comply with it throughout the entire life cycle of the AI system, periodically review and update it, and manage any changes (Article 4(2) and (3)).
-
(Establishment and Implementation of Explanation Plan for AI and its Learning Data, etc.) To ensure transparency and explainability, the explanation plan for learning data must include details on the systematic management of learning data information. The specific explanation plan must be made publicly available, for example, by posting it on a website (Article 5).
-
(Establishment and Operation of User Protection Plan) During the development stage, the plan must include measures such as lawful and safe data collection and management, safe algorithm design and model development, and testing and evaluation that account for exceptional circumstances (Article 6(1)). During the operation stage, measures must include monitoring and response systems, collection of user feedback and continuous improvement based on that feedback, protection of users’ rights, and compensation in the event of damages (Article 6(2)).
-
(Human Oversight and Supervision) During development, standards for human intervention in AI operations must be established, and methods for intervention, such as emergency suspension, must be prepared (Article 7(1)). During operation, business operators must establish plans and measures for regular inspections to detect performance degradation or errors and must also provide education and training to improve understanding of AI’s scope and capabilities (Article 7(2)).
-
(Preparation and Retention of Documents that Enable Confirmation of Measures to Ensure Safety and Reliability) Documents evidencing compliance with the obligation to ensure the safety and reliability of high-impact AI, referred to as safety and reliability documents, must be prepared and maintained by AI business operators. These documents must be periodically inspected and updated to reflect the latest technologies and methodologies (Article 8(1) and (2)).
Because obligations vary depending on the lifecycle stage of high-impact AI and the nature of those obligations, the scope of responsibilities is distinguished between AI development and utilization business operators, as outlined below.
III. PROPOSED GUIDELINES: OVERVIEW AND KEY PROVISIONS ON BUSINESS OPERATOR RESPONSIBILITIES
IV. IMPLICATIONS AND RESPONSE
The Proposed Public Notice of Responsibilities and Guidelines requires high-impact AI business operators to establish a new AI governance system by imposing specific and practical obligations, such as the preparation of a risk management plan, an explanation plan, user protection measures, and document management procedures. Consequently, ensuring reliability and responsible operation in AI development and utilization is expected to become a critical factor in corporate competitiveness.
To this end, companies must establish risk maps and pre-assessment procedures to systematically identify and manage risk factors throughout the entire process of AI development and utilization. In addition, companies must also establish a continuous monitoring system linked to internal audit functions or risk management committees.
Furthermore, companies need to strengthen compliance by clearly defining and formalizing relevant standards and procedures set forth in applicable laws and regulations and embedding them internally through regular education and training.
* * *
BKL’s AI Team continues to monitor domestic and international regulatory developments concerning artificial intelligence. Leveraging its expertise, the team provides comprehensive advisory and practical support to help companies deploy AI technologies safely while minimizing legal risks. Please feel free to contact us with any inquiries.
[Korean version]
