Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

South Korea AI Basic Act

In force South Korea · In force Jan 22, 2026 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectJan 22 · 9 months ago · Source
AI Basic Act and Enforcement Decree take effectTransparency, labeling, high-impact AI, and domestic representative obligations apply (fines deferred during the grace period).

Summaries for reference, not legal advice. Check the official text.

What it does

Korea's comprehensive AI law: transparency duties (notify users in advance that AI is used, label generative AI outputs and deepfakes), risk management, explainability and human oversight for 'high-impact' AI (e.g. hiring, lending, healthcare), safety duties for very large models (10^26 FLOPs+ training compute), and a domestic representative for large foreign providers. MSIT is running a grace period of at least one year, deferring fact-finding and fines except in serious cases.

Who it applies to
AI business operators (developers and deployers) whose activities affect the Korean market. Foreign operators without a Korean address must appoint a domestic representative if they meet any of: prior-year total revenue of KRW 1 trillion+, AI-service revenue of KRW 10 billion+, or 1 million+ average daily Korean users over the prior 3 months.
Penalties
Administrative fines up to KRW 30 million, for example for failing to notify AI use or label outputs, failing to appoint a domestic representative, or not complying with corrective orders. Fines generally deferred during the grace period of at least one year from 22 Jan 2026.
Enforced by
Ministry of Science and ICT (MSIT)
Official name
Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)
Citation
Framework Act on AI Development and Trust (promulgated Jan 2025) and its Enforcement Decree
Topics
AI
Verified 2026-09-22 trade.gov shinkim.com cooley.com
Research notes

The grace period is 'at least one year' with no fixed end date announced, so there is no enforcement deadline row. The promulgation date (21 Jan 2025) and passage (26 Dec 2024) come from general knowledge and secondary sources; law.go.kr could not be parsed. Labeling breaches may lead to corrective orders before fines.

Related

AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023
In forceChina
China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023
In forceIndia
India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026
Questions about South Korea AI Basic Act
What are the South Korea AI Basic Act compliance deadlines?
Jan 22, 2026: AI Basic Act and Enforcement Decree take effect.
When does South Korea AI Basic Act take effect?
South Korea AI Basic Act took effect on Jan 22, 2026.
Who does South Korea AI Basic Act apply to?
AI business operators (developers and deployers) whose activities affect the Korean market. Foreign operators without a Korean address must appoint a domestic representative if they meet any of: prior-year total revenue of KRW 1 trillion+, AI-service revenue of KRW 10 billion+, or 1 million+ average daily Korean users over the prior 3 months.
What are the penalties under South Korea AI Basic Act?
Administrative fines up to KRW 30 million, for example for failing to notify AI use or label outputs, failing to appoint a domestic representative, or not complying with corrective orders. Fines generally deferred during the grace period of at least one year from 22 Jan 2026.