South Korea Framework Act on AI Development and Trust (AI Basic Act): AI Compliance Requirements

AI Basic Act Enforcement Decree enacted; MSIT announces one-year grace period

The Enforcement Decree (Presidential Decree) for the AI Basic Act was enacted by the Korean Cabinet on January 21, 2026 and took effect with the Act on January 22, 2026. It sets the domestic-representative thresholds (prior-year total revenue ≥ KRW 1 trillion / prior-year AI-service revenue ≥ KRW 10 billion / ≥ 1,000,000 average daily Korean users over the preceding three months). MSIT has stated it will grant a one-year grace period before imposing administrative fines, to allow businesses to prepare; generative-AI transparency/labelling duties (Art. 31) apply from the effective date. (Verified 2026-06-14 against Cooley, FPF, Securiti and Library of Congress reporting; the previously listed "MSIT Implementation Guide" (which claimed a KAISI online registration system and a 60-day representative window) could not be verified and was removed as unsourced.)

On 23 May 2024 the PIPC ruled that Kakao Corp. violated the Personal Information Protection Act after attackers exploited a KakaoTalk open-chat vulnerability to harvest and sell participants' personal information, and Kakao failed to report the leak and notify users. This is a data-security and breach-notification matter (PIPA security-safeguard and notification duties), not an algorithmic / automated-decision case — included as the most significant recent PIPC enforcement bearing on platforms with Korean users.

Outcome: IMPOSED: a KRW 15.1 billion fine plus a KRW 7.8 million penalty surcharge, with corrective orders and public disclosure of the result (PIPC, 23 May 2024).

The FIRST case where Korea's PIPA was applied to an AI system at all. PIPC found ScatterLab violated PIPA by using ~9.4 billion KakaoTalk messages from 600,000 users to train its "Iruda" AI chatbot without valid consent, failed to delete/encrypt personal information, posted AI training artifacts on GitHub containing identifiable user messages, and collected data from 200,000+ children under 14 without parental consent. This is the foundational Korean precedent for AI training-data consent requirements — directly on point for the AI Basic Act's audience.

Outcome: IMPOSED: a KRW 103,300,000 (~$92,900 USD) fine, corrective orders; ScatterLab agreed to implement PIPC's corrective actions (PIPC, 28 April 2021).

Kakao Pay transferred Korean users' personal data to Alipay (an Alibaba affiliate) without proper consent to calculate "NSF" risk scores as part of Apple Pay's payment-evaluation process, affecting ~40 million users. PIPC's most significant remedy was not the fine but an order to DESTROY the AI model built from the unlawfully transferred data — a directly on-point precedent that an AI model itself can be ordered destroyed as a PIPA remedy, not merely penalized with a fine.

Outcome: IMPOSED: KRW 8,370,000,000 total (~$5.7-5.8M USD; Kakao Pay KRW 5.968B, Apple Distribution International KRW 2.45B + KRW 2.2M) PLUS an order to destroy the AI model (PIPC, 24 January 2025).