Foreign AI companies have a narrow 2026 window to prepare for South Korea’s new AI compliance rules before enforcement risk begins to rise.
The AI Basic Act took effect on Jan. 22, 2026, but MSIT has said it will allow at least a one-year grace period before imposing administrative fines. That makes the law an immediate planning issue for enterprise vendors, cloud providers, AI platform companies, and software firms serving Korean users, especially if their products require user notices, AI-generated content labeling, risk documentation, or a domestic representative.
Foreign AI firms enter the 2026 grace period
The US International Trade Administration said in May 2026 market guidance that companies entering South Korea or serving Korean users should assess compliance before launch, especially if their tools involve generative AI, high-impact AI, or large-scale advanced AI systems.
The law, formally the Framework Act on the Development of Artificial Intelligence and Establishment of Trust, was enacted as Law No. 20676 on Jan. 21, 2025, and entered into force one year later. It defines AI systems broadly and creates obligations for generative AI, high-impact AI, and large-scale advanced AI.
Transparency is the most immediate requirement for many foreign operators. Providers using generative AI or high-impact AI must notify users in advance that AI is being used. If AI-generated images, video, or audio could be mistaken for real content, providers may also need to disclose that the output was generated by AI.
Those duties can become product work: Korean-language notices, interface labels, pop-ups, product documentation, or other user-facing disclosures built into the service. Exported or shareable synthetic content may require clearer labeling than outputs that stay inside a closed environment.
High-impact AI brings heavier obligations. The law covers systems that can affect life, safety, or fundamental rights in sectors including energy, drinking water, health care, medical devices, nuclear facilities, criminal-investigation biometrics, employment, credit and loan decisions, transportation, public benefits, and K–12 student assessment. Employment is already a pressure point across APAC as companies weigh AI-driven workforce decisions.
Compliance work moves into product teams
MSIT said in its Enforcement Decree notice that it would allow at least a one-year grace period before imposing administrative fines. That creates a practical 2026 deadline: companies can use the grace period to build disclosures, documentation, and representative arrangements now, or risk retrofitting compliance after products are already in the Korean market.
Companies should first classify Korea-facing products as generative AI, high-impact AI, or large-scale advanced AI. Large-scale advanced AI systems may face added safety obligations if they meet criteria such as cumulative training compute of at least 10²⁶ floating-point operations. The same work is growing more urgent in regulated sectors, where AI-enabled tools such as surgical robots seeking overseas approvals must clear technical, safety, and market-access hurdles before deployment.
Next comes implementation. User notices, AI-output labels, Korean-language disclosures, and exportable-content markings should be handled in the product, not just in legal copy.
Foreign companies without a Korean address or business office must determine whether they need a local representative. A draft Enforcement Decree summary says that requirement may apply to companies with more than KRW 1 trillion in prior-year total revenue, more than KRW 10 billion in prior-year AI-service revenue, or more than 1 million average daily domestic users during the relevant three-month period. It may also apply if MSIT requests materials related to an actual or potential AI-safety incident.
Foreign operators should classify the system, disclose AI use, document risk controls, and determine whether a Korean representative is required. Employee-tracking systems show why AI governance is becoming a workplace, privacy, and security issue as well as a product compliance issue.
Also read: IBM is using OpenAI models to help identify exploitable software flaws.