The AIGP's Body of Knowledge names two AI-specific laws by country: the EU AI Act and "the South Korean AI Basic Law". The second is the one few candidates have read. It is South Korea's Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, usually called the AI Basic Act, and it has been in force since January 22, 2026. It is shorter and lighter than the EU's law, much of it is about promoting AI rather than restraining it, and its duties fall on "AI business operators" rather than on providers and deployers. This guide sets it out from the English translation published by the Korea Legislation Research Institute, as amended in January 2026: who it covers, its definitions, its duties, how it is enforced, how it compares with the EU AI Act, and what the exam can ask.
The short answer
- What it is: a framework act with two halves, promotion of the AI industry and a "foundation for trust", in force since January 22, 2026.
- Who it binds: AI business operators, both those who develop AI and those who provide products or services using it, including conduct abroad that affects the Korean market or users.
- High-impact AI: systems likely to significantly affect life, physical safety or fundamental rights in listed areas, from energy and health care to hiring, loan screening and student evaluation.
- The duties: notice to users of high-impact and generative AI, labels on generative output, safety measures for the largest models, risk management, explanation and human oversight for high-impact AI, an impact assessment the operator "shall endeavor" to carry out, and a domestic representative for some foreign operators.
- Enforcement: investigations and corrective orders by the Minister of Science and ICT, and administrative fines of up to 30 million won.
- Against the EU: no list of prohibited practices, a softer impact assessment and far lower fines.
What is the South Korean AI Basic Act?
The Act states its purpose in Article 1: "to prescribe the basic matters necessary for the sound development of artificial intelligence and the creation of a foundation for trust in artificial intelligence, thereby contributing to the protection of citizens’ rights, interests, and dignity, the improvement of their quality of life, and the strengthening of national competitiveness."
It was first enacted as Act No. 20676 of January 21, 2025, and amended by Act No. 21311 of January 20, 2026, whose addendum sets the date: "This Act shall enter into force on January 22, 2026". The same addendum delays a few amended provisions, including the latter part of Article 35(1) on impact assessments, by six months after their promulgation.
Its structure shows its balance. Chapters II and III cover national strategy, a Presidential Council on National Artificial Intelligence Strategy, an AI Safety Institute, research, training data and industry support. Chapter IV, on ensuring AI ethics and trustworthiness, holds the obligations an AI governance professional must know. Chapters V and VI cover investigations and penalties.
Who it covers
The Act applies to "AI business operators", defined in Article 2 in two kinds:
- an "AI development business operator", "A person that develops and provides AI";
- an "AI use business operator", "A person that provides AI products or AI services using AI provided by a business operator under item a".
The pair maps roughly onto the EU AI Act's provider and deployer, with one difference worth noticing: the Korean user-side operator is someone who provides products or services using AI, not every organization that uses AI internally. The Act also defines a "User", "a person that is provided with an AI product or AI service", and an "Impacted person", "a person whose life, physical safety, and fundamental rights are significantly impacted by AI products or AI services".
Its reach is not limited to Korea. Article 4(1): "This Act shall apply to any conduct outside the Republic of Korea if the conduct impacts the domestic market or users." Article 4(2) excludes AI developed and used solely for national defense or national security, as specified by Presidential Decree.
The definitions
An "AI system" is "an AI-based system that infers outputs such as predictions, recommendations, and decisions that affect real and virtual environments for a given goal with various levels of autonomy and adaptability". The core words, inference, outputs that affect environments, autonomy and adaptability, are close to those of the EU AI Act's Article 3(1) and the OECD's definition, so a candidate who knows one recognizes the others.
"High-impact AI" is the Act's equivalent of high-risk: "an AI system that is likely to have a significant impact on or pose a risk to human life, physical safety, and fundamental rights, and that is utilized in any of the following areas". The areas are energy supply, drinking water, health and medical services, medical devices, nuclear safety, biometric analysis for criminal investigation or arrests, "Judgments or evaluations that have a significant impact on the rights and obligations of individuals, such as hiring and loan screening", transport, public decision-making that affects citizens, the evaluation of students in early childhood, elementary and secondary education, and other areas set by Presidential Decree.
"Generative AI" is "an AI system that generates text, sound, images, videos, and other various outputs by imitating the structure and characteristics of input data".
The duties
Chapter IV sets the obligations.
- Transparency, Article 31. "An AI business operator that intends to provide a product or service using high-impact AI or generative AI shall notify the user in advance that the product or service is operated based on that AI." Generative output must be labeled: the operator "shall indicate that the output was generated by generative AI." And for realistic synthetic sound, images or video, the operator "shall notify or indicate in a manner that users can readily recognize the fact that such outputs have been generated by the AI system", with a lighter touch for artistic or creative works.
- Safety of the largest systems, Article 32. For an AI system whose cumulative training compute meets a threshold set by Presidential Decree, the operator must carry out "Identification, assessment, and mitigation of risks throughout the entire AI lifecycle" and establish "a risk management system capable of monitoring and responding to AI safety incidents", and report the results to the Minister.
- Knowing whether it is high-impact, Article 33. An operator "shall review in advance whether the AI falls under the high-impact AI", and may ask the Minister of Science and ICT to confirm.
- High-impact AI, Article 34. Operators must implement measures that include risk management; explanation, "to the extent technically feasible", of the final results, the main criteria used and an overview of the training data; user protection; "Ensuring human management and oversight of high-impact AI"; and documents that verify the measures.
- Impact assessment, Article 35. "Where an AI business operator provides products or services using high-impact AI, the operator shall endeavor to assess the impact on the fundamental rights of people in advance". The 2026 amendment adds that the assessment reflects "the characteristics of AI-vulnerable groups", and public bodies must give preference to products that have been assessed.
- A domestic representative, Article 36. A foreign operator with no domicile or place of business in Korea that meets thresholds on users or revenue must designate a representative in Korea in writing and report it to the Minister.
- A right to an explanation, Article 3(2). "An impacted person shall be entitled to be provided with a clear and meaningful explanation of the main criteria, principles, etc. utilized in deriving the final results of AI, to the extent technically and reasonably possible."
Two softer provisions complete the picture: operators providing high-impact AI "shall endeavor to obtain verification and certification in advance" (Article 30(3)), and universities, research institutes and operators may set up private self-regulatory AI ethics committees (Article 28).
Enforcement and fines
The Minister of Science and ICT enforces the Act. Under Article 40, the Minister may require data or investigate where a violation of the transparency labeling duties, the safety duties or the high-impact measures is suspected or reported, and "may order the AI business operator to take necessary measures to cease or correct the violation."
Fines are modest. Article 43: "Any of the following persons shall be subject to an administrative fine not exceeding 30 million won", for three failures: failing to give the advance notice of Article 31(1), failing to designate a domestic representative, and failing to comply with an order to cease or correct a violation. Other breaches reach a fine through a corrective order that is then ignored.
South Korea's AI Basic Act vs the EU AI Act
| South Korea's AI Basic Act | EU AI Act | |
|---|---|---|
| Approach | A framework act: promotion and trust together | Product-safety regulation by risk tier |
| Risk categories | High-impact AI in listed areas | Prohibited, high-risk, transparency duties, minimal |
| Prohibited practices | None listed | Article 5's list |
| Roles | AI development and AI use business operators | Providers, deployers, importers, distributors |
| Impact assessment | The operator "shall endeavor" to assess | A fundamental rights impact assessment required of certain deployers |
| Transparency | Notice and labels for high-impact and generative AI | Article 50's duties |
| Largest models | Safety duties above a compute threshold set by decree | Duties for general-purpose AI models with systemic risk |
| Top fine | 30 million won | EUR 35 million or 7% of worldwide turnover |
| Reach | Conduct abroad that affects Korea | Providers and deployers outside the EU in set cases |
The fine line is the starkest contrast. The EU AI Act's Article 99 sets "administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher" for prohibited practices; Korea's ceiling for any administrative fine is 30 million won.
How the AIGP tests it
Competency II.C asks candidates to understand "the main elements of AI-specific laws", and its indicators line up with the Act's chapters: the risk classification framework (high-impact AI), the requirements (Articles 31 to 35), "the enforcement framework and penalties for noncompliance" (Articles 40 and 43), and "the differences in requirements based on organizational context" (development and use operators). The Body of Knowledge's description of Domain II names the law, so it can appear beside the EU AI Act in questions on how the two differ.
Four facts are worth having ready. High-impact is defined by area and likely impact, with hiring and loan screening among the areas. Generative AI brings both an advance notice and a label on the output. The impact assessment is an obligation to "endeavor", not an absolute one. And the Act reaches conduct abroad that affects Korean users, with a domestic representative for qualifying foreign operators.
Where to start
The AIGP's first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards on the definitions and principles that the Korean and EU laws share. The rest of the course takes the Body of Knowledge through the laws with practice in the exam's format. The EU AI Act as the AIGP tests it covers the other law the Body of Knowledge names, and US state AI laws as the AIGP tests them the third set of laws in Domain II.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.