New sweeping AI law leaves tech industry unsure, unprepared ahead of next month's enactment

AI letters and a robot hand are atop a computer motherboard in this illustration created on June 23, 2023. [REUTERS/YONHAP]

 
With just one month left before the first comprehensive AI law takes effect in Korea, confusion continues to mount across the country’s tech industry. 
 
Set to take effect on Jan. 22, the Basic Act on the Development of Artificial Intelligence and the Establishment of Foundation for Trustworthiness — commonly referred to as the AI Basic Act — is facing sharp criticism from industry insiders who say the law remains vague and will be difficult to implement in practice.
 

Related Article

• New AI data center projects give rise to hopes of regional development, more employment around Korea

• Gov’t to tap National Growth Fund for $20B investment in AI, chips

• Music industry laws not keeping pace with speed of AI, to the detriment of artists

• Ghibli-style AI drawings could be breaking Korean copyright law, legal researchers say

 
The Ministry of Science and ICT completed a 40-day legislative notice period for the law’s enforcement decree on Nov. 12. Lawmakers hailed the legislation as the first-ever nationwide framework law governing AI, but companies fret over the limited timeframe they will have to prepare for an unclear set of guidelines. 
 
“It’s like being asked to build a skyscraper without a blueprint,” an official at a Korean internet company said.
 
 
‘High-impact AI’ and industry risks


Industry concerns center on provisions governing “high-impact AI,” defined as systems that could pose significant risks to life, safety or fundamental rights, and on a requirement to disclose when content has been generated using AI. 
 

The National Assembly passes the AI Basic Act during a plenary session in Yeouido, western Seoul, on Dec. 26, 2024, with 260 votes in favor, one against and three abstentions out of 264 lawmakers present. [NEWS1]

 
Under Article 33 of the law, providers of AI products and services must assess in advance whether their technology falls into the high-impact category. Companies say the criteria remain broadly defined. Under the AI Basic Act, “high-impact AI” refers to artificial intelligence systems used in areas that may significantly affect or pose risks to human life, physical safety or fundamental rights. 
 
The law defines the scope to include energy supply; drinking water production, healthcare and medical devices; nuclear facility management; biometric data used in criminal investigations; decisions affecting individual rights or obligations such as hiring and lending; transportation systems; public service decision-making and other areas affecting human life or physical safety. 
 

Falling into any of these categories and being labeled high-impact AI is a risk for companies, as it would immediately entail a plethora of heavier obligations such as mandatory risk management measures. Startups could be particularly vulnerable, according to Jung Ju-yeon, a senior policy analyst at Startup Alliance, a network of entrepreneurs and startup stakeholders.
 
“The level of obligations required of high-impact AI is far higher than for general AI. Many of the sectors where startups are active, such as health care and education, could easily fall into that category,” she said. “Once the law takes effect, companies are likely to avoid areas with potential legal risks from the planning stage onward.”
 
 
Who makes the call? 
 

Words reading ″Artificial intelligence AI,″ and miniature robot and toy hands are pictured in this illustration made on Dec. 14, 2023. [REUTERS/YONHAP]

 
A recent Startup Alliance survey of 101 domestic AI startups found that only 2 percent said that they were preparing concrete response plans. Nearly 98 percent said they either were unaware of the law’s details or had not yet developed specific compliance strategies.
 
Companies have also questioned a provision allowing businesses to request confirmation from the government on whether their AI systems qualify as high-impact. 
 
“It’s not even clear how many AI experts there are in Korea, and there’s little trust in what standards or methods that small pool of experts would use,” the head of a domestic AI startup said.
 
“AI services are not fixed products but are constantly updated. If we have to go through administrative procedures every time, it becomes an unbearable burden for startups.”
 
 
Possible toll on domestic development
 
Larger firms say they face similar challenges. An executive at a global platform operator, speaking on condition of anonymity, said the law would force companies to build Korea-specific compliance frameworks and could delay the launch of new services in the country.
 
“In the end, we have to build legal mechanisms that apply only in Korea,” the executive said. “The AI ecosystem involves complex relationships among partners and customers, which means contracts and terms of service must clearly define responsibility through compliance frameworks. With just a month left and unclear standards, it’s hard to know how to prepare.” 
 
“As a company that is operating globally, there is a strong chance we will delay launching services in Korea for the time being,” the executive said.
 

A screen reads 'AI' in reference to artificial intelligence as attendees gather during Rivian's first Autonomy and AI Day, showcasing developments in self-driving technology, in Palo Alto, California, on Dec. 11. [REUTERS/YONHAP]

 
The law’s requirement to label AI-generated content has also drawn criticism. Industry officials question whether uniform disclosure rules would meaningfully protect users.
 
A media content industry source said companies already have technical alternatives. “Even without mandating visible labels, there are plenty of technical and platform-level measures, such as guardrails, to prevent misuse,” the source said. “It’s frustrating to be boxed in by regulatory checklists.”
 
 
Fine grace period fails to reassure 
 
The government has said it will suspend the imposition of fines under the AI Basic Act for at least one year to limit potential side effects. Companies say that this does little to ease concerns about reputational damage.
 
“The mere possibility of complaints, investigations or fact-finding can hold back business decisions and operations,” the official said. “[The prospect of a government] fact-finding process itself can directly hurt brand trust.”
 
Lee Seong-yeob, a professor at Korea University’s Graduate School of Management of Technology and head of its Center for Technology Law and Policy, called for broader regulatory restraint. 
 
“If no serious AI risk arises from intentional misconduct or gross negligence, regulators should consider postponing everything from [fact] finding to enforcement,” he said.
 
Lee pointed to Europe for comparison. “The EU’s AI Act also requires conformity assessments for high-risk AI, but the European Commission delayed its application after concluding that guidelines and institutional preparations were not sufficient,” he said. “There is broad agreement that applying regulation before building the necessary foundations is not realistic.”


This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY EO HWAN-HEE [kim.juyeon2@joongang.co.kr]