Korea’s AI Basic Act Goes Live With $20K Fine Cap and 10^26 Wall

Twenty thousand US dollars. That is the maximum administrative fine Korean regulators can issue against an AI company that breaks the country’s first national AI law, which entered force on 22 January 2026.

The AI Basic Act, formally the Act on the Development of Artificial Intelligence and Establishment of Trust, makes South Korea the second jurisdiction after the European Union to publish a comprehensive risk-based AI statute. Korea’s Ministry of Science and ICT (MSIT) will run a one-year fine grace period through January 2027, deferring penalties while operators line up compliance. The law covers AI developers and AI-using business operators in Korea, plus foreign firms whose systems reach Korean users above set thresholds. Frontier models trained on 10^26 floating-point operations or more sit in a separate safety bucket almost no domestic player can hit.

That last detail is the part most foreign coverage skipped. Strip out the cumulative-compute language and a regulatory wall remains that almost every Korean lab walks under.

Who Falls Inside the Net

The Act applies to anyone the law calls an AI business operator, and MSIT’s January decree splits that into two categories. AI developers build, train or sell AI models. AI-using business operators deploy AI inside their own products or services for Korean users. Both face obligations, though the heavier ones cluster on developers.

MSIT’s decree extends jurisdiction to foreign companies whose AI services reach Korean residents. There is no carve-out for offshore-only firms. If a US-based generative model serves chat queries to Korean accounts, the operator is on the hook the moment it crosses the local-presence thresholds.

What the Act does not do, according to Omdia’s January 2026 regulatory note on the Korean AI Basic Act, is reach the end-user. The EU’s law touches deployers and users alike. Korea’s stops at the developer and the business deploying the model. End consumers stay outside the framework.

The MSIT English-language summary of the Basic Act defines the regulated entity as any operator engaged in business “related to the AI industry,” a phrasing wide enough to bring in cloud platforms, model fine-tuners and chatbot integrators in a single sweep.

Three Tracks, Different Rules

The Act runs three parallel obligation regimes, and the decree clarifies which class of system catches which set of duties. Generative AI systems must label outputs and notify users they are interacting with AI. High-impact systems deployed in critical sectors must document risk, log decisions and provide human oversight. Frontier high-performance models must file safety plans with MSIT and report life-cycle risk outcomes.

Sector lists for the high-impact track will sit inside ministerial sub-rules due over the next several months. Cooley’s 27 January client alert on the AI Basic Act warned operators not to assume their sector is safe until the relevant ministry publishes its specific guidance.

The Compute Wall That Excludes Most of Korea

The 10^26 FLOPs threshold is the Act’s headline number, and almost no Korean firm is anywhere near it. Frontier US labs cleared that ceiling around 2024. Naver’s HyperCLOVA X family and LG’s EXAONE series, the country’s two biggest domestic foundation models, sit at least one order of magnitude below.

That gap matters. The decree’s safety regime, the most stringent of the three tracks, only fires when a model crosses both 10^26 FLOPs and a significant impact on life, physical safety, public safety, or fundamental rights. Both conditions, not either. ITIF’s September 2025 report on Korean AI policy, written by analysts Hodan Omaar and Daniel Castro, argued the safety bar is high enough in practice that domestic enforcement falls almost entirely on US frontier developers serving Korean users.

The ITIF brief made one point that local commentary has avoided: Korea’s safety regime is configured against compute scale rather than deployment context. A small model fine-tuned for a sensitive medical use can hide under the threshold. A much larger general-purpose model with no clinical exposure trips it.

Compute thresholds are a design choice the EU made too, with its 10^25 FLOPs trigger for general-purpose models with systemic risk. Korea pushed the bar an order of magnitude higher. Whether that gap reflects domestic frontier capability or a quiet decision to keep Korean labs outside the safety perimeter is the live policy question.

Foreign vendors should expect the threshold to draw the most attention from MSIT inspectors during the grace period. The ministry has every incentive to show the safety regime has teeth, and US labs are the only realistic test subject.

The Domestic Representative Trigger

Foreign AI operators without a Korean address must appoint a domestic representative once they cross any one of three quantitative thresholds. The decree fixes those thresholds in clear numbers.

• KRW 1 trillion in total annual revenue in the previous year, roughly $720 million at May 2026 exchange rates.
• KRW 10 billion in AI-services revenue in the previous year, about $7.2 million.
• One million daily active Korean users averaged over the three months before year-end.

The local agent must hold a registered Korean address and respond to MSIT inquiries on the foreign operator’s behalf, including safety-measure submissions for frontier models and high-impact-status confirmations. The US Department of Commerce trade.gov market briefing on the Korean AI Basic Act flagged the third trigger as the one most likely to catch US generative-AI vendors with consumer footprints.

Fines That Cap at KRW30 Million

The penalty ceiling is the single largest gap between Korean and EU enforcement. KRW30 million, about $20,300 at current rates, is the maximum administrative fine. It applies to failure to disclose AI use, failure to appoint a domestic representative, and refusal of MSIT inspections.

Compare that to the EU AI Act’s 7% global-turnover ceiling, which can reach roughly $38 million for prohibited-practice violations. A single Korean fine would not buy a frontier developer one day of training compute.

MSIT has signaled enforcement will lean on corrective orders rather than fines for the first 12 months. Where a service threatens safety, the ministry can order suspension under the Act’s enforcement decree, a power that bites even when the cash penalty does not.

Critics inside the Korean bar have called the fine ceiling symbolic. Supporters say a soft launch builds compliance muscle without choking a domestic AI sector still chasing US and Chinese rivals on capital and talent.

Where Seoul Broke From Brussels

The Basic Act borrows the EU’s risk-based architecture but breaks from it on three structural choices. Korea publishes no list of banned AI uses. The EU bans eight outright, including social scoring and untargeted facial-recognition scraping. Korea also writes no general-purpose AI category and no copyright-compliance language for training data.

Innovation-led, not rights-led. That is how the Future of Privacy Forum’s analysis of the Korean AI Framework Act framed the difference. The EU starts from a fundamental-rights baseline. Korea starts from an industrial-policy baseline and adds risk controls on top.

Korea’s broader strategy pairs regulation with KRW100 trillion in announced AI infrastructure spending through 2027, the Library of Congress Global Legal Monitor entry on the Korean AI legal framework noted. Read together, the message to operators is straightforward: build here, ship here, and the regulatory cost will stay light enough to absorb.

Frequently Asked Questions

Do I Have to Appoint a Korean Representative if My AI Service Has Korean Users?

Only if you cross one of three thresholds. Total annual revenue above KRW1 trillion, AI-services revenue above KRW10 billion, or one million daily Korean users averaged over the three months before year-end. If you sit below all three, no domestic representative is required, though MSIT may still ask for safety information through other channels. Threshold questions go through the official AI Basic Act portal.

When Will MSIT Start Issuing Actual Fines?

Not before 22 January 2027. MSIT confirmed a one-year grace period during which the ministry will use corrective orders and guidance instead of financial penalties. Suspension orders for safety-threatening services remain available immediately. Operators should treat 2026 as a remediation year, document compliance work in writing, and budget for active fine exposure starting in early 2027.

Does the Act Apply to My Open-Source Model?

Probably yes, if the model is offered to Korean users in any commercial form, including hosted APIs and paid fine-tuning services. The law defines covered entities by business activity, not licensing model. Pure non-commercial research releases may sit outside the scope, but the decree does not carve them out explicitly. Track MSIT’s sector guidance and watch for upcoming open-source clarifications expected in mid-2026.

What Counts as a High-Impact System?

AI deployed in healthcare diagnostics, energy and utilities operations, transport-safety functions, public-service delivery, hiring decisions, educational evaluation, and finance-related credit and risk scoring. The full sector list is being finalized through ministerial sub-rules across 2026. If your system touches any of those areas, assume it is high-impact and start documenting risk-management procedures now rather than waiting for the final list.

How Much Compute Triggers the Frontier Safety Track?

Cumulative training compute of 10^26 floating-point operations or more, combined with a system that materially affects life, safety, or fundamental rights. Both conditions must apply. As of May 2026, no Korean foundation model is publicly known to clear 10^26 FLOPs. The threshold mostly catches large US frontier labs serving Korean accounts, not domestic developers.

MSIT’s decree clarifies the law more than the law clarifies itself, and that pattern will hold through 2026 as the ministry publishes sector-by-sector sub-rules. Operators that wait for full text to lock before starting compliance work will burn the grace period.

The bigger question for foreign capitals watching Seoul is whether Korea’s lighter-touch model becomes a template for other Asian markets. Japan, Singapore and Indonesia have all signaled they want a regulatory floor that does not strangle domestic AI sectors before those sectors grow. Korea has just shown them what that floor looks like.

Disclaimer: This article reports on South Korea’s AI Basic Act and accompanying presidential decree as of May 2026 and does not constitute legal advice. Regulatory thresholds, sector definitions, and ministerial sub-rules remain subject to revision throughout the 2026 implementation period. Operators with potential Korean exposure should consult licensed Korean counsel before relying on any specific threshold, fine ceiling, or compliance interpretation cited here. Currency conversions reflect rates accurate at publication and may shift.