The Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Framework Act) takes effect on the 22nd. It comes exactly one year after the bill passed the plenary session of the National Assembly on December 26, 2024, and was promulgated on January 21, 2025. With this, Korea becomes the world's first country to bring an AI regulatory law into full force. Since the EU was earlier in putting a legal framework in place, the term "first" attaches to the timing of full enforcement rather than the order of legislation.
The backbone of the law is the concept of "high-impact AI." It groups together AI that has a significant effect on the safety of human life and body or the protection of fundamental rights, or that risks causing harm to them, and imposes heavier obligations on that group. Ten areas of application were designated, including energy, health care, criminal investigation, and transportation. Operators of high-impact AI must put in place a management system that identifies and assesses risks across the entire AI life cycle, and must document what it contains.
Two obligations placed on ordinary operators stand out. An operator that uses AI in a service or product must inform users of that fact in advance. Voice, images, and video created by generative AI must carry a label indicating they are AI-generated, and this includes machine-readable invisible marking in addition to a visible watermark. The government has not issued an official interpretation on whether output for which AI was used only as an auxiliary tool is also subject to labeling.
The problem is the line dividing what counts as high-impact. Because the criteria include "other areas prescribed by Presidential Decree," some point out that the scope is sweeping. The Ministry of Science and ICT plans to sort cases using a flowchart that works through detailed items for each area instead of a single numerical standard. In the case of self-driving cars, Level 3, where a person intervenes, falls outside high-impact and coverage begins at Level 4, so the same technology faces different regulatory intensity depending on the level of autonomy.
Readiness on the ground has not kept pace with the schedule the law set. When Startup Alliance surveyed 101 domestic AI startups, only 2% responded that they had drawn up a plan for complying with the AI Framework Act. "Not familiar with the content and not prepared" and "aware of the law but compliance is inadequate" each came to 48.5%, meaning 98% meet the effective date without a working compliance system. That is the background to the government's decision to suspend direct regulation such as fines for at least one year from the law's entry into force and to put its weight behind guidance.
Looking outward, the regulatory clock is instead turning toward a slower pace. The EU created its AI Act first, but application of the high-risk AI provisions at its core is set for August 2026, and with the Commission putting forward a "digital simplification package" containing deregulatory measures, there are forecasts that it will slip to the end of 2027. The United States has accumulated state-by-state responses instead of a single federal law. Of the 50 states, 48 excluding Alaska and Ohio have AI-related state laws, and 13 states have gone as far as establishing penalty provisions.
The focus of state laws is concentrated at points where harm has actually surfaced, rather than spreading across industry as a whole. Deepfake regulation is the most common, followed by chatbots in 6 states, health care-related AI in 10 states, and AI use by public institutions in 13 states. Arkansas made the production and distribution of obscene deepfakes subject to criminal punishment, and California required chatbot operators to respond appropriately when a user mentions suicide. President Trump, on the other hand, signed an executive order last December blocking state-level AI regulation, so states and the federal government are moving in opposite directions.
Another variable that will determine the Korean law's effectiveness is the border. The AI Framework Act requires foreign AI companies meeting certain conditions to designate a domestic representative, but which companies fall under it and how it will be enforced when no designation is made are still not within reach. If domestic companies alone diligently pile up documents while foreign services continue to be used as before, the regulation only shakes up market share. It is in the same vein that both industry and civic groups raised concerns about vague definitions up to December 22 last year, when the advance notice of legislation for the enforcement decree closed.
The mechanisms the law leaves behind do not stop at regulation. The AI Safety Institute, which researches and assesses AI risks, opened last November on the basis of the law, and the Minister of Science and ICT must draw up a basic artificial intelligence plan every three years. A framework has also been set up for the public and private sectors to devise strategy together at the National Artificial Intelligence Committee, chaired by the president. With amendment bills being introduced one after another from both ruling and opposition parties, there is little chance that the law as enacted will stay fixed.
From the user's standpoint, what changes after the 22nd is modest. When you open a chat window you will first be told whether the other party is a person or an AI, and videos that come across your feed will carry a label saying they were made with AI. Whether that small notice also operates at the points where it leads to a hiring decision, a loan review, or a reading in the emergency room will become clear once the one-year grace period passes and fines actually begin to be imposed. The real report card for the country that flipped the switch first in the world will be graded from the moment the flowchart is made public and the first determinations start to accumulate.
