Skip to main content

    AI by country · East Asia

    AI in South Korea: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in South Korea know before starting with AI?

    South Korea has a dedicated AI law. The Framework Act on the Development of Artificial Intelligence came into force on 22 January 2026 and adds labelling and safety duties for generative and high-impact AI. The Personal Information Protection Act (PIPA) still governs personal data, including rights over fully automated decisions, and an amendment on using personal data for AI development passed in August 2026.

    At a glance

    South Korea at a glance

    Key facts about South Korea
    Data protection lawPersonal Information Protection Act (PIPA), 2011, in force and amended since
    RegulatorPersonal Information Protection Commission (PIPC) for data; Ministry of Science and ICT for the AI Framework Act
    AI policyFramework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust, in force since 22 January 2026
    Time zoneKST, UTC+9 (India is 3.5 hours behind)
    CurrencyKRW (Korean won)
    Business languageKorean

    Why now

    Why South Korea is worth watching

    Each point links to the document it comes from.

    • The Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (Act No. 20676, amended by Act No. 21311) came into force on 22 January 2026.[1]

    • Its Enforcement Decree, Presidential Decree No. 36053, was signed on 21 January 2026 and took effect the next day, according to a policy tracker.[2]

    • The PIPC released guidelines on processing personal information to develop and use generative AI on 6 August 2025.[5]

    • The National Assembly passed a PIPA amendment on 20 August 2026 that creates a legal basis to use lawfully collected personal data for AI development, under PIPC review.[4]

    • On 23 October 2026 the PIPC invited public input on how to protect and use personal information in the era of AI.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust

    In force2025Providers of generative or high-impact AI must tell users in advance that a product runs on that AI, and generative output must be marked as AI-made (Article 31). Synthetic sound, images or video that are hard to tell from real ones need a clear notice. Fines of up to KRW 30 million apply to missing the advance notice, failing to appoint a required domestic representative, or ignoring a correction order (Article 43).[1]

    Framework Act on AI: high-impact AI and foreign operators

    In force2025High-impact AI covers listed uses such as healthcare, hiring, loan screening, energy, transport and student evaluation (Article 2). Operators must check in advance whether their AI is high-impact and put in place risk management, explanation of results, human oversight and records (Articles 33 and 34). A foreign operator with no Korean office that meets user or revenue thresholds set by decree must name a representative in Korea (Article 36).[1]

    Personal Information Protection Act (PIPA)

    In force2011A person can object to, or ask for an explanation of, a decision made entirely by an automated system, including AI, that significantly affects their rights (Article 37-2). Transfers abroad need separate consent or another listed ground, such as an adequacy finding by the PIPC (Article 28-8). The PIPC can impose surcharges of up to 3% of sales related to the violation (Article 64-2).[3]

    PIPA amendment on personal data for AI development

    Passed, not yet in force2026Passed on 20 August 2026, it lets lawfully collected personal data be used for AI development where pseudonymised or anonymised data is not enough, or for public interest AI, after PIPC review. Users of this route must assess risks and disclose the practice in their privacy policy. It takes effect six months after promulgation; the exact start date is unclear as of 29 October 2026.[4]

    Where AI fits first

    Where AI fits first

    Banking and lending

    Document review, fraud alerts and customer service in Korean, with people reviewing credit decisions.

    Loan screening is listed as a high-impact use under Article 2 of the AI Framework Act, so the Article 34 safety measures apply.[1]

    Health care

    Drafting clinical notes and summarising records, with clinicians making the decisions.

    Healthcare and medical devices are listed as high-impact areas under the AI Framework Act. Health data is also sensitive data under PIPA.[1]

    Hiring and HR

    Sorting applications and drafting job descriptions, with a person making the final call.

    Hiring is a high-impact use under the AI Framework Act, and PIPA Article 37-2 lets candidates object to fully automated decisions.[3]

    Media and content

    Drafting copy, subtitles and images for marketing.

    Generative output must be marked as AI-made, and realistic synthetic images, audio or video need a clear notice (Article 31).[1]

    Your first steps

    Your first steps

    1. List every AI system you build or use and check, case by case, whether it falls in a high-impact area under Article 2 of the AI Framework Act.
    2. Add an advance notice to users and an AI-generated label on outputs for any generative AI product you offer in Korea.
    3. For high-impact AI, set up risk management, a way to explain results, human oversight and records, as Article 34 requires.
    4. Map each decision your AI makes about people and build a route to object or ask for an explanation under PIPA Article 37-2.
    5. Check the legal ground for every transfer of personal data out of Korea before you use an overseas model or cloud.
    6. If you are a foreign provider, check whether the decree thresholds require a representative in Korea.
    7. Read the PIPC generative AI guidelines and watch for the rules that will implement the August 2026 PIPA amendment.

    AI services for South Korea

    AI consulting and development for teams in South Korea

    We work remotely with companies in South Korea, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. South Korea is on UTC+9 and India on UTC+5:30, a 3.5 hour gap. Taking a 9:00 to 18:00 day in Korea and 9:30 to 18:30 in India, the overlap is about 5 hours, from 13:00 to 18:00 Korean time.

    Questions

    Common questions about AI in South Korea

    Does South Korea have an AI law?

    Yes. The Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust has been in force since 22 January 2026, together with its Enforcement Decree.

    Do I have to label AI-generated content?

    Yes, if you provide generative AI or a product that uses it. Article 31 requires advance notice to users and a mark that output was generated by AI, with a clear notice for realistic synthetic sound, images or video.

    We are not based in Korea. Does the Act apply to us?

    It can. Article 36 requires a foreign operator with no Korean office that meets thresholds set by decree to appoint a domestic representative. We did not confirm the exact thresholds from the decree text, so check them with a Korean lawyer.

    Can I train AI on customer data?

    Only with a lawful basis under PIPA today. The amendment passed on 20 August 2026 will add a route for AI development under PIPC review, but it starts six months after promulgation, and its start date is unclear as of 29 October 2026.

    What are the penalties?

    Under the AI Framework Act, fines go up to KRW 30 million for listed failures. Under PIPA, the PIPC can impose surcharges of up to 3% of sales related to the violation.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Korea Legislation Research Institute, 2026-01-20. Framework Act on the Development of Artificial Intelligence and the Cre…(elaw.klri.re.kr)
      Full title and what we used it for

      Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (English translation). Official reference translation of the Act, not legally binding. Used for Act numbers, the 22 January 2026 commencement, Articles 2, 31, 33, 34, 36 and 43.

    2. [2] Digital Policy Alert, 2026-01-22. Enforcement Decree of the Framework Act on the Development of Artificia…(digitalpolicyalert.org)
      Full title and what we used it for

      Enforcement Decree of the Framework Act on the Development of Artificial Intelligence (Presidential Decree No. 36053) entered into force. Secondary tracker. Used for the decree number and the signing and commencement dates. We did not read the decree text itself.

    3. [3] Korea Legislation Research Institute, 2023-03-14. Personal Information Protection Act (English translation)(elaw.klri.re.kr)
      Full title and what we used it for

      Personal Information Protection Act (English translation). Reference translation as amended by Act No. 19234 of 14 March 2023. Used for Articles 28-8, 34, 37-2 and 64-2. Later amendments were not checked in this copy.

    4. [4] Personal Information Protection Commission, 2026-08-27. The PIPA Amendment Bill for AI Development Passed at the National Assem…(pipc.go.kr)
      Full title and what we used it for

      The PIPA Amendment Bill for AI Development Passed at the National Assembly Plenary Meeting. Primary press release (unofficial translation by the PIPC). Used for the passage date, content, safeguards and the six-month commencement rule.

    5. [5] Digital Policy Alert, 2025-08-06. Personal Information Protection Commission released guidelines for pers…(digitalpolicyalert.org)
      Full title and what we used it for

      Personal Information Protection Commission released guidelines for personal information processing for the development and utilisation of generative AI. Secondary tracker. Used for the release date of the PIPC generative AI guidelines. A Baker McKenzie note describes them as not legally binding.

    6. [6] Personal Information Protection Commission, 2026-10-29. PIPC news list(pipc.go.kr)
      Full title and what we used it for

      PIPC news list. Primary. Used for the 23 October 2026 item inviting public input on personal information in the era of AI. We read only the headline.

    This is general information, not legal advice. Korean AI and data rules are changing, and the English texts we used are reference translations. Check with a qualified Korean lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in South Korea?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score