HyperTeamsRegulation and compliance
What you will learn Which layer of the law your initiative lands on, what is due when, and what gets missed by misreading the "grace period."
As of August 2026. Dates, amounts, and thresholds may be amended. Check the current statute before relying on a figure.
This chapter is an operational overview, not legal advice. If there is any chance your use qualifies as high-impact AI, bring legal in.
It is already in force
In Phase 2 you checked "governance and security requirements" as one line item. This chapter unfolds that line item, and the first fact to establish is this:
Korea's AI Framework Act took effect on 22 January 2026.
This is not something to prepare for — the obligations already exist. Korea is the second jurisdiction after the EU to bring comprehensive AI legislation into force.
Does it apply to us?
The most common misconception is "we don't build AI, so it doesn't apply." The law splits businesses into two types.
| Type | Who | Example |
|---|---|---|
| AI developer | develops and supplies AI directly | companies that build models |
| AI user-business | supplies a product or service using someone else's AI | most companies that wire in an API |
The second category is overwhelmingly larger. A shop with a chatbot, a SaaS with AI summaries, a call centre with automated triage — all here. Overseas businesses are covered too when they affect users in Korea.
Three layers
Obligations stack. Each layer down is heavier.
graph TD
A["Layer 1 — every AI business<br/>baseline duties"] --> B["Layer 2 — using generative AI<br/>notice and labelling"]
B --> C["Layer 3 — high-impact AI<br/>risk management, explanation, oversight, 5-year retention"]Layer 3 — is it high-impact AI?
This is the judgement that matters. AI used in areas that "may materially affect, or pose a risk to, human life, physical safety, or fundamental rights" is high-impact AI. The fields named in the law:
| Field | How it shows up in practice |
|---|---|
| Medical devices and digital medical devices | diagnostic support |
| Healthcare delivery systems | patient triage |
| Energy supply, drinking-water production | plant control |
| Nuclear energy | safety-related decisions |
| Criminal investigation using biometric data | face matching |
| Hiring, loan screening and similar rights/obligations decisions | CV screening, credit assessment |
| Operation of transport systems | autonomous driving, traffic control |
| Public-service decisions | benefit eligibility |
| Student assessment | grading, placement |
The two bold rows catch ordinary companies most often. If AI does the first pass on job applications, that is high-impact AI.
A high-impact classification brings five requirements.
The last line is the one most often missed. It is not enough to have taken the measures — you need documentation confirming you took them, kept for five years. That leads straight into the audit trail.
Layer 2 — three duties for generative AI
If you use generative AI, these three apply even without a high-impact classification.
| Duty | What | Where |
|---|---|---|
| Prior notice | tell users before providing the service that it runs on AI | terms of service, on-screen notice |
| Output labelling | mark output as AI-generated | visible (logo, wording) or invisible (watermark, metadata) |
| Deepfake labelling | audio, images, or video hard to distinguish from reality must be clearly recognisable as such | explicit on screen |
There are exemptions from labelling.
The second matters. Internal workflow automation is not subject to labelling. But the moment it reaches an outside user — a chat widget, an email agent — layers 1 and 2 both apply.
"We're in the grace period" is the riskiest reading
The government is running a grace period of at least one year. Here is where the misunderstanding creeps in.
The grace period suspends administrative fines, not the legal obligations themselves.
The duties have existed since 22 January 2026. Even during the grace period, a serious incident — loss of life, infringement of rights — triggers investigation. And failing to give the required notice carries a fine of up to 30 million won.
In practice the fine is not the big risk. Deferring on the strength of the grace period and then having to reconstruct documentation retroactively costs far more. Five-year retention documents cannot be manufactured after the fact.
Personal data is a separate axis
Complying with the AI Framework Act does not discharge the Personal Information Protection Act. The operational standard is the Personal Information Protection Commission's Guide to Personal Data Processing for the Development and Use of Generative AI, issued in August 2025.
The guide splits the generative-AI lifecycle into four stages with criteria for each.
| Stage | What to settle here |
|---|---|
| 1. Purpose setting | what the personal data is used for |
| 2. Strategy | which data, on what legal basis |
| 3. Training and development | training-data handling and safeguards |
| 4. Deployment and operation | runtime controls and user rights |
It also separates the roles of model developer and model user — the responsibilities differ, and most companies should read against the model user column.
If you have users abroad
| Framework | Character | Where it fits |
|---|---|---|
| EU AI Act (Reg 2024/1689) | legally binding | mandatory with EU users. Fines up to €35M |
| NIST AI RMF | voluntary | your internal risk-management operating model |
| ISO/IEC 42001 | certifiable | external proof for customers and regulators |
The common 2026 combination is NIST for internal operations, ISO 42001 for external proof, and the applicable law in each jurisdiction for legal duties. Standing all three up typically takes 8–12 months.
When, by phase
| Point | What to do |
|---|---|
| Phase 1 — problem definition | first-pass judgement on whether this touches a high-impact field |
| Phase 2 — assessment | confirm high-impact status, settle the personal-data basis, start legal review |
| Phase 3 — POC | design notice/labelling, place the human oversight points |
| Phase 4 — rollout | produce documentation and start the 5-year retention process |
It clusters in Phase 2 for the same reason Phase 2 gave: approvals and reviews take longer than the technical work.
Common misconceptions
"But we don't build models"
You are covered as an AI user-business. Supplying a product or service using someone else's AI brings you in scope, and in practice this is the far larger group. "We didn't build it" is not a defence.
"If it's internal only, is there nothing to do?"
Generative-AI labelling is exempt; the rest remains. High-impact fields such as CV screening apply regardless of whether the use is internal. And personal data law does not distinguish internal from external at all.
Check yourself
1. Why does the Act apply to a company that builds no models?
Answer
Because it is classified as an AI user-business. The law distinguishes AI developers from AI user-businesses, and supplying a product or service using someone else's AI puts you in the latter — by far the larger group.
2. Why is "we can prepare later, it's the grace period" wrong?
Answer
The grace period suspends fines, not obligations. The duties have existed since 22 January 2026, and serious incidents still trigger investigation. In particular, documents subject to five-year retention cannot be created retroactively.
3. What does AI first-pass CV screening add?
Answer
It qualifies as high-impact AI, bringing five requirements — a risk management plan, an explanation method, user protection measures, human management and oversight, and documentation of all of it retained for five years.
With the legal requirements settled, time to build and measure → Phase 3 — design and run a POC