Picture a five-person team demonstrating an imaging-reading assistance program in a corner of a hospital corridor. The algorithm runs, and clinicians show interest. But moving to the next stage requires explanatory materials, risk management records, documentation of data sources, and a post-market monitoring plan. How many people on this team are there to do that work?
Korea's AI rules have come down from the act to the enforcement decree and then to subordinate notices, forming a single system. With the administrative notice procedure completed, what businesses must comply with has largely been set out in writing. At the level of international organizations, discussions have also continued on due diligence guidelines to help companies check their own AI management status. The phase in which norms become documents has passed, and what remains now is who actually carries out those documents.
As important as the strength of regulation is its distribution. The areas most likely to be classified as high-risk are those that touch the human body directly, such as medicine, diagnosis and health management. Yet a considerable share of the domestic businesses that have entered those fields are early-stage companies with staffs of a few dozen. The safety management system the law requires is one line of work for a large company's compliance organization, but for these firms it becomes a choice traded against product development.
So unless it is designed who will pay the cost of safety regulation and how, medical AI in Korea will be sorted in a way that screens out small companies instead of screening out dangerous services.
The counterargument is clear and strong. Medicine is a field where patients pay the price of failure, so allowing less verification on the grounds that a company is small is dangerous. I agree.
This is not a call to loosen the rules. It means the problem is a design that demands the same standards while leaving each individual company to build from scratch the practical burden of meeting them.
Standard document formats, shared verification datasets, and joint infrastructure that handles regulatory compliance on a company's behalf lower only the cost without lowering safety. If the situation continues in which data for clinical validation must be secured through a new contract with each hospital, in the end only those with hospital networks will survive. The criterion dividing the market shifts from safety to procurement capacity, and that is not the result the regulation intended.
Saying that a system is complete is often read as meaning it is finished. But the point at which norms are organized into provisions is rather when the cost of implementation begins to be observed. How the number of licensing applications by Korean medical AI companies moves after the notice, and whether new entries by early-stage companies decline, will be the report card for this design. Those statistics will take shape only several quarters from now.
For patients, this discussion is not abstract. Whether reading assistance programs will be installed only at large hospitals, or will also enter the consultation rooms of small and mid-sized regional hospitals, is decided here. When society shares the cost of keeping things safe, the single line of assistive findings that appears on a consultation room screen becomes visible outside the large hospitals of Seoul as well.
What regulation has to protect is not a list of technologies. It is the day of the person facing that screen.
