South Korea: The AI Basic Act and Its Obligations for "High-Impact" AI

South Korea got there ahead of most: while other countries were still debating bills, it already has a comprehensive AI law in force — with a one-year grace period before the fines start to bite.

One of the world's first comprehensive laws

South Korea's AI Basic Act took effect on January 22, 2026, making the country one of the first in the world to have an operative comprehensive AI law — ahead of Brazil, India, and most US states, which were still in the legislative process as of that date.

The "high-impact" AI categories

The law introduces specific obligations for "high-impact" AI systems in critical sectors: employment, healthcare, financial services, public safety, and education. These categories require risk management across the entire lifecycle, impact assessments, and compliance reporting — a structurally similar approach to the EU AI Act's "high-risk" tier, though with its own list of sectors.

Mandatory labeling for generative AI

Beyond high-impact systems, the law also establishes mandatory labeling requirements for certain generative AI applications — part of a pattern that's now repeating globally (EU AI Act Article 50, California SB 942): synthetic content needs to be identifiable as such.

A one-year grace period before real sanctions

The law includes an initial one-year grace period for administrative fines and corrective orders, prioritizing guidance and ecosystem development over immediate punitive enforcement — a transition approach similar to what the EU AI Act used for its GPAI obligations (a one-year gap between entry into force and actual enforcement of sanctions).

The extraterritorial reach that surprises foreign companies

One critical detail: the law applies extraterritorially to any foreign company whose AI activities affect users in the Korean market — you don't need a physical presence in South Korea to fall under its scope. Any company serving Korean users with an AI product, regardless of where it's based, should assess whether its systems fall into any of the high-impact categories before the grace period ends.