Series Index
Part 1 | Attorney Hong Seung-kwon: “AI Arrives in the Legal Profession”
Part 2 | How Should Lawyers Use AI?
Part 3 | Dividing Roles Between AI and Lawyers
Part 4 | AI Legal Advice Isn’t Enough—Here’s Why Lawyers Still Matter
Part 5 | Attorney Hong Seung-kwon: Korea’s AI Law—KRW 30 Million Fine Threshold
By Hong Seung-kwon
Principal Attorney, PAN Law Firm (skh@law-pan.com)
Reflections on the Framework Act on AI
The recently enacted Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust is significant in that it represents the first basic law within Korea’s legal system to recognize artificial intelligence as an independent subject of regulation. In this installment, I provide a brief overview of my observations on the so-called AI Framework Act from the perspective of a practicing attorney.
The Act consists of six chapters. Chapter 1 sets forth the purpose, definitions, basic principles, and scope of application. As the first comprehensive framework law on artificial intelligence, Article 2, which defines key terms, is particularly important.
The Act defines key concepts, including artificial intelligence, AI systems, high-impact AI, generative AI, and AI business operators. High-impact AI refers to AI systems that may significantly affect human life, bodily safety, or fundamental rights. Generative AI refers to AI systems that generate outputs—such as text, sound, images, or video—by imitating the structure and characteristics of input data.
Chapter 2 establishes the governance structure for the sound development of AI and the creation of a foundation of trust. It provides for the establishment of a National AI Strategy Committee under the President and allows for the creation of an AI Policy Center and an AI Safety Research Institute.
Chapter 3 addresses AI technology development and industrial promotion. It includes measures to build and activate the AI industry ecosystem, such as standardization initiatives, training data policies, workforce development, startup support, and international cooperation.
Chapter 4 concerns AI ethics and reliability. It authorizes the establishment of AI ethical principles by Presidential Decree. It also requires business operators to disclose when services are based on AI and obligates them to establish risk management systems to ensure AI safety.
Chapter 5 contains supplementary provisions, including mandatory fact-finding surveys on AI. It provides administrative enforcement tools such as requests for data submission, on-site investigations, and corrective orders, thereby enhancing the Act’s effectiveness.
Finally, Chapter 6 addresses criminal penalties and administrative fines—arguably the area that draws the greatest public interest.
With respect to criminal sanctions, Article 42 applies only in cases of violation of the confidentiality obligation under Article 7(9), which pertains to the National AI Committee. If a committee member, public official, or related person who has obtained confidential information in the course of performing their duties discloses it or uses it for purposes other than official duties, they may be subject to imprisonment of up to three years or a fine of up to KRW 30 million.
For example, this could include leaking a company’s AI safety evaluation materials submitted during committee deliberations or privately exploiting internal information obtained during policy review. It is unlikely that ordinary companies operating AI services would immediately face criminal liability under this provision.
By contrast, Article 43 establishes administrative fines, which are expected to serve as a more direct enforcement mechanism in practice. An administrative fine of up to KRW 30 million may be imposed in three circumstances.
First, violation of the transparency obligation under Article 31(1). If a business operator provides products or services utilizing high-impact AI or generative AI without informing users in advance, it may be subject to a fine. For instance, failing to clearly notify users that they are interacting with an AI chatbot or distributing content generated by generative AI without appropriate disclosure may trigger sanctions.
Second, violation of the obligation under Article 36(1) to designate a domestic representative. AI business operators that meet certain criteria and lack a domestic address or place of business must appoint a local representative. Failure to do so may result in an administrative fine.
Third, failure to comply with a suspension or corrective order under Article 40(3). If the competent authority identifies violations through an investigation and orders corrective measures, non-compliance may lead to a fine.
In summary, while the Enforcement Decree detailing the Act’s specific provisions has yet to be finalized and clear standards remain to be fully established, the enactment of this Framework Act carries substantial meaning. It sets baseline regulatory standards in a rapidly evolving AI industry.
Those engaged in the AI sector would be well advised to reduce uncertainty through proactive inquiries and prior consultations. I hope this brief overview proves helpful in navigating the new legal landscape.
