Last reviewed: May 1, 2026
The European Union and South Korea both built risk-based AI laws — but they made different design choices on classification, enforcement, penalty structure, and the relationship between regulation and innovation policy. The EU AI Act runs on four risk tiers with mandatory pre-market conformity assessment, prohibited practices, and centralized enforcement through the AI Office. Korea’s AI Basic Act (effective January 22, 2026) runs on an 11-sector “high-impact AI” classification with voluntary certification, no prohibited practices, and split enforcement across MSIT, PIPC, and the National AI Strategy Committee. Both regimes treat AI seriously and produce real obligations, but they treat companies differently. This article maps the divergence on twelve dimensions, walks through the high-impact-vs-high-risk classification mismatch, and translates the comparison into a five-step dual-market compliance baseline. For the Korea-side perspective on the same comparison see Post 75: South Korea AI Basic Act — Article-by-Article English Guide and Post 77: High-Impact AI in South Korea — 11 Sectors Mapped. For US, UK, China, and Singapore comparators see our EU vs US, EU vs UK, EU vs China, and EU vs Singapore keystones.
Key Takeaways
- Both regimes are risk-based, but the risk vocabularies differ meaningfully. The EU classifies by “high-risk” (Annex III’s 8 areas plus prohibited and limited-risk tiers). Korea classifies by “high-impact” (Article 2(4)’s 11 sectors). 8 of Korea’s 11 sectors map to EU areas; 3 are Korea-only (nuclear facilities, K-12-only education, broader rights-affecting decisions); 2 EU areas have no Korea equivalent (migration/asylum, expanded law enforcement beyond biometrics).
- Korea has no prohibited practices. The EU AI Act bans 8 categories outright (Article 5) — social scoring, real-time biometric ID in public, manipulative AI, exploitation of vulnerabilities, etc. The AI Basic Act prohibits none of these through AI-specific provisions; activities are addressed through separate sectoral laws.
- Penalty headlines mislead. EU AI Act maximum: €35 million or 7% global turnover. Korea AI Basic Act maximum: KRW 30 million (~$21K). But Korea’s PIPA was amended in February 2026 to allow fines up to 10% of total turnover, effective September 11, 2026 — making PIPA the real enforcement risk for AI processing personal data.
- Korea reinforces innovation through legislation in a way the EU does not. Chapter 3 of the AI Basic Act dedicates 14 articles to R&D funding, sandbox programs, government procurement preferences, and SME compliance support. The EU AI Act has no equivalent innovation chapter.
- Korea is roughly seven years ahead of the EU on operational sandboxes. Korea’s ICT, financial, and industrial sandboxes have been live since approximately 2019. The EU AI Act’s sandbox deadline is August 2, 2026 — most Member States have not started.
Two risk-based approaches — similar but not the same
The EU and South Korea reached similar high-level conclusions about AI regulation independently: AI deployment carries risk to fundamental rights, the most consequential systems should face heightened obligations, and risk classification is the right organizing principle. They reached those conclusions through different processes and arrived at different operational choices.
The EU AI Act (Regulation (EU) 2024/1689) was negotiated for three years across 27 Member States, the European Parliament, the European Commission, and civil society. The result is a horizontal binding regulation with 113 articles, structured around four risk tiers (unacceptable, high, limited, minimal) and detailed substantive requirements for high-risk systems (Articles 8-15). Implementation is phased: prohibited practices effective February 2, 2025; GPAI obligations August 2, 2025; high-risk obligations August 2, 2026 (with conditional extensions to August 2, 2027 for some).
The AI Basic Act (Law No. 20676) was passed by the Korean National Assembly on January 21, 2025 and took effect on January 22, 2026. It is Asia’s first comprehensive parliamentary AI law. The Act has 43 articles across 6 chapters and is structured around an 11-sector “high-impact AI” classification with mandatory transparency and risk management obligations for those sectors. Implementation is phased through a one-year grace period: administrative fines apply only after January 2027 except for serious incidents involving loss of life or human rights violations.
Both regimes use “risk” as the organizing concept. But Korea explicitly chose “high-impact” rather than “high-risk” terminology. As Korean lawmakers explained during legislative debate, this was a deliberate framing choice — “high-impact” emphasizes the sectors and uses where AI affects significant decisions, rather than the inherent technological dangers. The substantive overlap with EU “high-risk” is real, but the framing matters operationally because it produces different boundary cases.
The other foundational difference is the relationship between regulation and innovation. The EU AI Act is purely regulatory — its purpose is to prevent harm. The AI Basic Act is a “promotion + regulation” hybrid. Chapter 3 dedicates 14 articles to industry promotion, R&D funding, sandbox programs, and government procurement preferences. No major AI law from any other jurisdiction includes an equivalent innovation chapter. This dual purpose shapes everything from agency design (the National AI Strategy Committee chaired by the President includes industry promotion in its mandate) to operator obligations (SMEs receive special compliance support under Article 17).
Classification compared — high-impact vs high-risk
The EU’s high-risk classification operates through Annex III’s eight enumerated areas plus Article 6’s safety-component pathway:
| Annex III Area | Examples |
|---|---|
| 1. Biometrics | Remote biometric identification; biometric categorization based on protected attributes; emotion recognition |
| 2. Critical infrastructure | Safety components in road traffic; supply of water, gas, heating, electricity |
| 3. Education and vocational training | Determining access; evaluating learning outcomes; assessing appropriate level |
| 4. Employment, workers’ management, access to self-employment | Recruitment; promotion; termination; task allocation; performance monitoring |
| 5. Access to essential services and benefits | Public assistance eligibility; credit-worthiness assessment; emergency response prioritization; insurance pricing |
| 6. Law enforcement | Risk assessment of natural persons; polygraph; deepfake detection; crime analytics |
| 7. Migration, asylum, border control | Polygraph; risk assessment; processing applications |
| 8. Administration of justice and democratic processes | Assisting judicial decisions; influencing voter behavior |
Korea’s high-impact classification operates through Article 2(4)’s eleven sectors:
| Korea High-Impact Sector | Trigger |
|---|---|
| (a) Energy supply | AI managing energy generation, transmission, distribution |
| (b) Drinking water production | AI in water treatment, quality monitoring, distribution |
| (c) Healthcare provision | AI in clinical decision support, patient triage, health system management |
| (d) Medical devices and digital medical products | AI-powered SaMD; covered by Medical Device Act + Digital Medical Product Act |
| (e) Nuclear facilities management | AI monitoring nuclear materials, reactors, waste |
| (f) Biometric ID for criminal investigation | AI face/fingerprint/iris recognition for law enforcement |
| (g) Employment, loan screening, rights-affecting decisions | The catch-all — most B2B AI touching individual rights |
| (h) Transportation systems | AI operating vehicles, traffic management, logistics |
| (i) Government decisions affecting citizens | Welfare eligibility, tax assessment, regulatory enforcement |
| (j) K-12 student evaluation | AI tutoring, automated grading, performance prediction |
| (k) Other areas by Presidential Decree | Open-ended expansion clause |
The mapping between the two regimes:
| Korea Category | EU Annex III Equivalent | Notes |
|---|---|---|
| (a) Energy supply | Area 2(a) Critical infrastructure | Direct overlap |
| (b) Drinking water | Area 2(b) Critical infrastructure | Direct overlap |
| (c) Healthcare | Area 5(a)-(c) | Direct overlap |
| (d) Medical devices | Area 5 + Article 6(1) MDR | Direct overlap |
| (e) Nuclear facilities | No equivalent | Korea-only |
| (f) Biometric ID (criminal) | Area 1 (subset) | EU broader (not just criminal) |
| (g) Employment/loans/rights | Areas 3-4 | Korea broader — catches any rights-affecting AI |
| (h) Transportation | Area 2(c) | Direct overlap |
| (i) Government decisions | Area 8 | Direct overlap |
| (j) K-12 evaluation | Area 3(a) | EU broader — covers vocational training |
| (k) Presidential Decree expansion | Delegated acts | Same mechanism |
| N/A | Area 6 (law enforcement beyond biometrics) | EU-only |
| N/A | Area 7 (migration/asylum/border) | EU-only |
Three sectors are Korea-only (nuclear facilities being the most operationally consequential). Two areas are EU-only (migration/asylum AI is the most-cited EU-specific category given Korea’s narrower immigration AI footprint). The catch-all in category (g) is broader than the EU equivalents — it captures any AI used for “decisions significantly affecting individual rights and obligations,” which most B2B AI touching credit, HR, or insurance qualifies under.
For dual-market practitioners: an AI system can be high-impact in Korea but not high-risk in the EU (nuclear facility AI), or vice versa (migration AI). Both frameworks must be checked independently. A unified mental model — Annex III as the master taxonomy with Korea-specific overlays — works for most use cases but breaks at the three Korea-only and two EU-only sectors.
Compliance obligations — what differs
For systems classified as high-impact (Korea) or high-risk (EU), the substantive obligations overlap in concept but differ in form.
The EU AI Act’s high-risk obligations (Articles 8-15) cover risk management (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency (Article 13), human oversight (Article 14), accuracy/robustness/cybersecurity (Article 15), plus Article 16 obligations of providers, Article 17 quality management system, Article 26 deployer obligations, Article 27 FRIA, and Article 49 EU AI database registration.
Korea’s high-impact obligations (Article 34 of the AI Basic Act, plus Decree Article 27) impose six mandatory duties:
- Risk management plan — must be published on operator’s website
- Explanation mechanism — must explain AI outputs, main criteria, training data overview
- User protection plan — measures protecting users from AI harm; published on website
- Human oversight — designated person responsible for supervision; named contact
- Documentation retention — 5-year retention of records (electronic included)
- Committee-determined matters — additional obligations as decided by the AI Committee
Plus Article 31 transparency (notify users before AI use; label generative AI outputs; mark realistic AI-generated content with creative-work exception), Article 32 safety obligations for compute-heavy systems (10^26 FLOP triple-criteria), Article 35 impact assessments (soft duty), and Article 36 domestic representative requirement for foreign operators meeting thresholds.
The substantive overlap is significant — both regimes require risk management, transparency, human oversight, documentation retention. The procedural differences are operationally consequential:
- Format expectations. EU obligations are specified in technical documentation per Annex IV; Korea publishes governance artifacts on the operator’s public website. A multinational must produce both, in different formats.
- Conformity assessment. EU requires pre-market conformity assessment for high-risk systems (Article 43, self or third-party). Korea provides voluntary certification under Article 30 with government procurement preference for certified systems.
- Impact assessment status. EU AI Act FRIA is mandatory for public-sector deployers and high-risk system deployers in some cases (Article 27). Korea Article 35 uses “noryeok hayeoya” (“should endeavor”) language — a soft duty, not mandatory, but with government procurement priority for systems with completed assessments.
- Right to explanation. Korea Article 3(2) provides a general right to explanation for any AI system’s outputs (“within technically and reasonably feasible scope”). The EU AI Act’s Article 86 right to explanation applies only to high-risk AI. Korea’s right is broader in scope but less developed in remedy.
For dual-market deployers, the cleanest path is to build EU AI Act compliance first (the higher procedural floor) and layer Korea-specific obligations as additions: web-published governance artifacts, transparency notifications in Korean, domestic representative if thresholds are met.
Conformity assessment vs voluntary certification
This is one of the sharpest structural differences. The EU has built a mandatory pre-market gate; Korea has built a voluntary one with government incentives.
EU conformity assessment (Article 43): high-risk AI systems must complete conformity assessment before being placed on the market. Two paths — Annex VI self-assessment (available for most Annex III categories) and Annex VII third-party assessment (mandatory for biometric identification when harmonized standards are not fully applied). Process: provider verifies compliance against Articles 8-15, issues EU Declaration of Conformity, affixes CE marking, registers in EU AI database. As of May 2026: zero notified bodies designated for AI Act assessments, zero harmonized standards published in OJEU, EU AI database not operational. For full procedural detail under current infrastructure constraints, see our EU AI Act conformity assessment guide.
Korea voluntary certification (Article 30): operators may voluntarily verify and certify their AI systems. The certification itself is “noryeok hayeoya” (“should endeavor”) — entirely voluntary. The incentive is Article 16(3) government procurement preference (effective July 21, 2026): organizations with voluntarily certified AI systems receive priority consideration for government contracts. This creates a soft enforcement mechanism — public sector buyers will favor certified vendors, which cascades into private-sector buyer expectations.
Korea also provides a unique mechanism the EU does not: Article 33 formal classification confirmation. Operators can request MSIT confirmation of whether a system qualifies as high-impact AI. The 50-member High-Impact AI Expert Committee (established under Decree Article 25) provides advisory classification within 30 days (extendable by 30 more), with appeal available within 10 days. This is the kind of certainty mechanism the EU AI Act lacks — EU practitioners must self-classify under Article 6 and Annex III without comparable advisory recourse.
| Dimension | EU Conformity Assessment | Korea Voluntary Certification |
|---|---|---|
| Mandatory? | Yes for high-risk | No |
| Pre-market gate | Yes | No |
| Document output | EU Declaration of Conformity + CE marking + registry filing | Certification certificate |
| Self vs third-party | Annex VI (self) or VII (third-party) | Self-certification with optional independent verification |
| Incentive structure | Penalty for non-compliance up to €15M / 3% global turnover | Government procurement preference for certified systems |
| Classification advisory | None | Article 33 — 30-day MSIT confirmation, 50-member expert committee |
| Status (May 2026) | Infrastructure largely unbuilt; zero notified bodies | Operational since AI Basic Act effective date |
Korea’s voluntary approach has produced more operational certainty than the EU’s mandatory approach has so far delivered — at least until EU notified bodies are designated and harmonized standards published.
Penalties — KRW 30M vs €35M and why that’s misleading
The headline penalty comparison favors the EU dramatically. The EU AI Act caps fines at €35 million or 7% global annual turnover for prohibited practices (Article 99 Tier 1), €15 million or 3% for other AI Act violations (Tier 2), and €7.5 million or 1% for incorrect information (Tier 3). The AI Basic Act caps administrative fines at KRW 30 million (~$21K) under Article 43 for failing to notify users about high-impact or generative AI, failing to designate a domestic representative, or failing to comply with MSIT cessation/correction orders. Korea also has criminal penalties under Article 42 — up to 3 years imprisonment or KRW 30 million for leaking Committee secrets.
The headline comparison misses three things.
First, PIPA is the real Korean enforcement risk for AI processing personal data. Korea’s Personal Information Protection Act was amended in February 2026 to allow fines up to 10% of total turnover for serious violations, effective September 11, 2026. PIPA also introduces CEO personal supervisory liability. The PIPC has already imposed fines exceeding KRW 15 billion on Korean tech companies. Any AI system processing Korean personal data faces PIPA penalties alongside AI Basic Act fines. For most enterprise AI deployments, PIPA exposure is the binding constraint, not Article 43.
Second, EU enforcement has not yet started. As of May 2026, zero AI Act enforcement actions have been initiated. The Member State competent authorities are still being designated. The first significant enforcement is expected after the August 2, 2026 high-risk obligations effective date. The €35 million cap is the headline; the actual enforcement timeline is mid-2027 onwards for material cases. Korea, by contrast, has issued PIPC fines against AI deployments using PIPA authority since 2024.
Third, regulatory certainty has cost in both regimes. EU’s high penalties combined with infrastructure gaps (no harmonized standards, no notified bodies) create uncertainty about what compliance looks like. Korea’s lower penalties combined with the active grace period and AI Basic Act Help Desk create relatively higher operational certainty. Companies optimizing for compliance predictability often find Korea easier to operationalize despite the EU’s higher headline maximum penalties.
| Penalty layer | EU | Korea |
|---|---|---|
| AI-specific maximum | €35M or 7% global turnover (prohibited) | KRW 30M (~$21K) |
| Data protection | GDPR €20M or 4% global turnover | PIPA up to 10% total turnover (Sep 2026) |
| Sectoral statute | Member State financial/health/transport laws | Sectoral statutes (Banking Act, Healthcare Basic Act, etc.) |
| Criminal | Generally none under AI Act | Up to 3 years (Art. 42) for narrow offenses |
| Enforcement track record (AI-specific, May 2026) | Zero actions | KRW 15B+ in PIPC AI-related fines |
| Personal liability | None under AI Act | CEO supervisory liability under PIPA (Sep 2026) |
The honest summary: build for PIPA in Korea and for AI Act + GDPR in the EU. The AI-specific penalty headlines are not where the financial risk concentrates in either jurisdiction.
Enforcement and authority structure
Both regimes split AI enforcement across multiple authorities, but the splits look different.
EU enforcement structure:
- EU AI Office (within Commission DG CNECT): exclusive competence over GPAI providers (Article 75); coordinates Member State authorities; issues guidance via the AI Act Service Desk
- Member State competent authorities (typically national DPAs or sector regulators): implement the AI Act in their territories; conduct market surveillance under Articles 73-74
- EDPB and national DPAs: enforce GDPR alongside the AI Act; coordinate via the European Data Protection Board
- Sector regulators (EBA, EIOPA, ESMA for financial; EMA for medical; etc.): apply sector-specific rules layered onto AI Act
Korea enforcement structure:
- Ministry of Science and ICT (MSIT): lead authority for AI Basic Act; investigation powers under Article 40; issues cessation and correction orders; runs the AI Basic Act Help Desk and Improvement Task Force
- National AI Strategy Committee: presidential-level committee with up to 60 members; mandatory institutional response to recommendations under Article 8(3); but no direct enforcement power
- Personal Information Protection Commission (PIPC): enforces PIPA for AI systems processing personal data; has issued the largest AI-related fines in Korea
- Korea Fair Trade Commission (KFTC): handles AI-related competition issues
- Sector regulators (FSC for financial; MFDS for medical devices; etc.): apply sector rules
The structural difference: Korea has clearer hierarchy (MSIT leads on AI; PIPC leads on data; KFTC leads on competition) but faces “jurisdictional overlap” problems that scholar Yo Sop Choi identified in 2025 (Network Law Review). The EU has more diffuse coordination across 27 Member States plus the AI Office, which produces consistency challenges but allocates clear competence under the AI Act.
The 50-member High-Impact AI Expert Committee under Decree Article 25 is operationally distinctive. It provides advisory classification on whether a system qualifies as high-impact AI. The EU has no equivalent body — practitioners self-classify under Article 6 and Annex III without comparable formal advisory recourse.
Innovation provisions — Korea’s Chapter 3 + sandbox infrastructure
Chapter 3 of the AI Basic Act (Articles 13-26) is what makes Korea’s regime structurally different from the EU’s. It dedicates 14 articles to industry promotion. No major AI law from any other jurisdiction includes an equivalent innovation chapter:
- Article 13: R&D funding for AI research
- Article 14: AI standardization promotion
- Article 15: Training data management platform
- Article 16(3): Government procurement preference for AI products (effective July 21, 2026)
- Article 17: Special compliance support for SMEs
- Article 22-2: AI Research Institutes (added in January 2026 amendment)
- Article 24: Shared testing and demonstration facilities
- Article 25: AI data center development
The EU AI Act has none of this. The EU’s innovation support comes through separate instruments — Horizon Europe research funding, the AI Pact voluntary commitments, AI Factories under the EU Chips Act — but these are not part of the AI Act itself.
Korea’s regulatory sandbox infrastructure is similarly distinctive. Three sandbox programs operate concurrently:
- ICT Regulatory Sandbox (MSIT, since approximately 2019): the primary AI sandbox. February 2025 designations included AI using CCTV video data and AI on financial intranets.
- Financial Regulatory Sandbox (FSC, April 2019): over 100 designated “innovative financial services” since launch. AI credit scoring, fraud detection, robo-advisory. 2026 Fintech AI Development Program offers up to KRW 350M subsidies (60-75% coverage).
- Industrial Convergence Sandbox (MOTIE, since approximately 2019): AI in manufacturing, energy, transportation convergence.
The EU AI Act sandbox framework (Articles 57-63) is well-designed but largely unbuilt. As of May 2026, Spain has the only fully operational EU AI sandbox (8 companies admitted); Denmark has run two rounds; most Member States have not started. The August 2, 2026 sandbox deadline is approaching with most national infrastructure unbuilt.
Korea’s seven-year head start on operational sandboxes is a real competitive advantage for companies testing AI in regulated environments. For companies with AI products that conflict with existing regulations, Korea offers a working pathway today; the EU offers a planned pathway. For full Korean sandbox detail, see Post 83: South Korea’s AI Regulatory Sandbox.
Where requirements diverge for dual-market companies
Five areas create dual-compliance work that cannot be unified across both regimes.
1. Three Korea-only sectors and two EU-only areas. Nuclear facilities AI, K-12-only education AI, and broader rights-affecting AI in Korea need Korean compliance only. EU migration/asylum AI and law enforcement AI beyond biometrics need EU compliance only. The mismatch is operationally manageable but requires checking both frameworks per system rather than relying on one.
2. Mandatory vs voluntary conformity assessment. EU mandatory pre-market conformity assessment under Article 43 cannot be satisfied by Korean voluntary certification under Article 30. Companies serving both markets need EU conformity documentation produced specifically for that purpose, regardless of Korean certification status.
3. Different formats for governance artifacts. EU technical documentation per Annex IV is structured for EU AI database registration and notified body review. Korean Article 34 obligations require web-published governance artifacts (risk management plan, user protection plan, named human oversight contact). Different audiences, different formats — even when the substance is identical.
4. Data protection regimes differ on AI-specific provisions. GDPR Article 22 generally prohibits solely-automated decisions with legal/significant effect. Korea’s PIPA Article 28 covers automated decision-making with explicit principles but not the same general prohibition. PIPA also provides CEO supervisory liability that GDPR does not. AI training data on Korean personal data flows through PIPA cross-border restrictions; EU personal data flows through GDPR.
5. Right to explanation differs. Korea Article 3(2) right to explanation applies to all AI systems within “technically and reasonably feasible scope.” EU AI Act Article 86 right to explanation applies only to high-risk AI. EU practitioners can decline explanation requests for non-high-risk systems; Korean practitioners face requests across all systems.
Practical guidance for dual-market companies
For organizations operating AI in both EU and Korean markets, the path is consistent and tractable. Five steps:
-
Map your AI systems against both Annex III (8 areas) and Article 2(4) (11 sectors). Most enterprise AI systems trigger one or both classifications. Pay particular attention to the three Korea-only sectors (nuclear, broad K-12 evaluation, rights-affecting) and the two EU-only areas (migration, broader law enforcement) where unified compliance does not work.
-
Build EU AI Act compliance as the procedural baseline. EU technical documentation per Annex IV, FRIA where applicable, post-market monitoring, conformity assessment preparation, EU AI database registration when operational. The EU has the higher procedural floor; building for it covers most Korean substantive expectations.
-
Layer Korean Article 34 obligations on top. Web-published risk management plan, web-published user protection plan, named human oversight contact, 5-year documentation retention, transparency notifications in Korean. Use Article 33 to request formal MSIT classification confirmation if your system is on the boundary.
-
Treat PIPA + GDPR as the primary penalty risk. Korean PIPA caps at 10% total turnover (effective September 11, 2026); GDPR caps at 4% global turnover. AI-specific penalties (KRW 30M Article 43; €35M Article 99) are the headline but data protection penalties are the financial-risk binding constraint for most enterprise AI.
-
Use Korea’s sandboxes if your AI is novel or regulation-conflicting. The ICT sandbox (MSIT), Financial sandbox (FSC), and Industrial Convergence sandbox (MOTIE) all accept foreign companies with Korean operations. Korea offers a working sandbox today where the EU offers a planned framework with August 2, 2026 Member State deadline.
For deeper context on each jurisdiction: Annex III explained for EU high-risk taxonomy; EU AI Act penalties guide; GPAI obligations for foundation models; South Korea AI Basic Act guide for Korean Article-by-Article coverage; South Korea High-Impact AI sectors for sector-by-sector breakdown; South Korea PIPC AI Enforcement for enforcement detail; South Korea AI Regulatory Sandbox for sandbox procedural detail.
For sibling cross-jurisdiction comparisons: EU vs US, EU vs UK, EU vs China, and EU vs Singapore.
Sources
- Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). 13 June 2024. Articles 2, 5, 6, 8-17, 26, 27, 43, 49, 50, 53-55, 57-63, 71-75, 86, 92, 99; Annex III; Annex IV; Annex VI; Annex VII.
- AI Basic Act of South Korea (Act on the Development of Artificial Intelligence and Establishment of Trust, Law No. 20676). Effective January 22, 2026. Articles 1-43.
- AI Basic Act Enforcement Decree (Presidential Decree No. 36053). Effective January 22, 2026. Articles 1-33.
- Ministry of Science and ICT. AI Basic Act Help Desk and AI Basic Act Improvement Task Force. Operational as of January 22, 2026; 40-expert task force launched March 25, 2026.
- Personal Information Protection Act (PIPA), South Korea. Amended February 12, 2026; 10% turnover penalty effective September 11, 2026.
- CSET Georgetown. “Framework Act on the Development of Artificial Intelligence — English translation.” July 2025. https://cset.georgetown.edu/
- Library of Congress. “South Korea: Comprehensive AI Legal Framework Takes Effect.” Global Legal Monitor, February 20, 2026. https://www.loc.gov/item/global-legal-monitor/2026-02-20/south-korea-comprehensive-ai-legal-framework-takes-effect/
- Kim and Chang. “AI Basic Act and the Revised Key Guidelines Now in Effect.” January 2026. https://www.kimchang.com/en/insights/detail.kc?idx=34018
- Shin and Kim. “AI Basic Act Update: Enforcement and Key Implications.” 2026. https://www.shinkim.com/eng/media/newsletter/3117
- Baker McKenzie. “South Korea’s AI Basic Act.” February 2026.
- IAPP. “South Korea Overhauls PIPA and Ties Fines to CEO Accountability.” March 2026.
- ECIPE. Nigel Cory. “Korea’s New AI Law: Not a Progeny of Brussels.” 2026.
- KoreaTechDesk. “Korea’s AI Law Enters Its Next Phase as Real-World Feedback Shapes Policy.” March 28, 2026. https://koreatechdesk.com/korea-ai-basic-act-calibration-phase-policy-update-2026
- DigitalToday. “MSIT AI Basic Act Improvement Task Force Launch.” March 25, 2026.
- MLex. “South Korea Designates Two AI Projects for Regulatory Sandbox.” February 13, 2025.
- Pertama Partners. “Korea Fintech AI Development Program.” February 2026.
- Choi, Yo Sop. “The New AI Regulation in Korea: Problems of Jurisdictional Overlaps.” Network Law Review, Fall 2025.
Reg Intel is not a law firm and does not provide legal services. This article is for informational purposes only and should not be relied upon as legal advice. Consult qualified counsel for your specific compliance situation.