The Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation of Trust, known as the AI Framework Act, took effect on the 22nd. The European Union was the first to enact a comprehensive law dealing with AI, but Korea is the first case of applying an entire law all at once at a single point in time. The European Union chose to enforce its rules on high-risk and general-purpose AI in stages. Now, on the third day of enforcement, industry attention is drawn to what the law left blank more than to what it prohibits.
The new obligations fall into three broad branches. The first is the transparency obligation, under which images, video and audio created by generative AI and distributed externally must be labeled as 'AI-generated.' The second is the obligation for high-impact AI, and the third is the safety obligation attached to ultra-high-performance AI with large training compute. The government says the law's emphasis lies on promotion more than on regulation, stressing a 'principle of minimum necessary regulation.'
The party bound by the labeling obligation is the business that provides the generative AI service. Individuals who use that service do not bear the obligation. For ordinary outputs such as animation or webtoons, machine-readable methods like digital watermarks are permitted in addition to visible labels, but deepfake video must carry a visible label that users can clearly recognize. When AI is used only within an internal service, as with chatbots, it is enough to indicate the use of AI through the screen layout or a logo, and from the moment an image or video is downloaded or shared, a recognizable watermark is required.
The safety obligation is in effect an empty box. It applies to models whose cumulative compute used in training is 10 to the 26th power FLOPs or more, and the government has said no model meets this threshold. That means it is closer to a line drawn in advance for future models. High-impact AI, by contrast, is an area that requires determinations right now, but the examples the government has cited as subject to regulation amount to little more than fully autonomous driving at Level 4 or above.
This is where the controversy begins. If a person is involved in the final decision-making process, the system is excluded from high-impact AI regulation, but the standards for judging how much involvement counts as involvement have not been settled. If inserting a perfunctory approval step is enough to escape the obligation, room opens for areas that directly shake people's lives, such as hiring or loan screening, to be placed outside regulation.
The current law only defines the 'person affected,' and does not contain that person's right to ask the reason for a decision or to raise an objection. The right to demand an explanation under the Personal Information Protection Act also applies only to 'fully' automated decisions, so the moment a person intervenes once, that right closes as well.
The labeling obligation has a similar blank. If an individual erases the AI-generated label while uploading AI-made content to a platform, it is not a violation of the AI Framework Act. Cases that abuse deepfakes are handled under existing laws such as the Act on Special Cases Concerning the Punishment of Sexual Crimes or the Information and Communications Network Act, but this law has no provision aimed at the removal of the label itself. An amendment to the Information and Communications Network Act intended to fill this gap has been introduced in the National Assembly.
The strength of the sanctions is also of a different nature compared with the European Union. The European Union imposes a fine of 35 million euros or 7 percent of total worldwide annual turnover, whichever is greater, while Korea imposes an administrative fine of up to 30 million won. Unlike the European Union, which places obligations on both providers and deployers of high-risk AI, Korea places obligations only on AI businesses. The narrow range of those who bear the obligation is a more substantial difference than the size of the penalty.
The government has decided to put off fact-finding investigations and the imposition of administrative fines for at least one year for the high-impact, safety and transparency rules. In the meantime it is providing consulting through an 'AI Framework Act support desk' instead of investigations, and before the law took effect it held briefing sessions and released cases of regulatory application and guidelines for securing transparency. This grace period is closer to time for filling in the standards with actual cases than time for postponing punishment. The law also contains the basis for drawing up an artificial intelligence master plan every three years and for establishing a National Artificial Intelligence Strategy Committee.
The mechanisms on the promotion side are relatively dense. A full-cycle support system went in, covering research and development, the building of training data, support for adoption and use, startups and convergence, the securing of specialists, and the creation of AI data centers and clusters. The basis for an integrated provision system where training data can be obtained in one place was also laid. It is a design to begin filling in the support boxes while the regulation boxes are empty.
From a user's standpoint, what changes right away is one small label on the screen. A watermark is attached to downloaded images, and a notice appears in front of deepfake video. A window for asking how much AI was involved in a decision when a rejection notice arrives in a loan screening has not opened so far. Over the next year, what to watch is what else besides autonomous driving is added to the list of high-impact AI.
