South Korea's AI Basic Act: What Professional Services Firms Need to Know

South Korea's AI regulatory framework moved from ambition to obligation in January 2026. The Basic Act on Artificial Intelligence and Creation of a Trust Base — signed into law on 21 January 2025 and effective from 22 January 2026 — is now live. For international professional services firms and global enterprises with exposure to the Korean market, the window for preparation has closed. The window for compliance is open.

This briefing sets out what the legislation requires, how it intersects with South Korea's strengthened data protection regime, and what practical steps organisations with cross-border AI operations need to take now.

What the AI Basic Act Actually Does

The AI Basic Act establishes a unified, risk-based governance framework for AI systems operating in or affecting South Korea. It is not a sector-specific instrument. It applies broadly and cuts across industries — which is precisely why professional services firms, often slower to recognise their AI exposure than technology companies, need to pay close attention.

The Act defines three categories that carry compliance weight: AI generally, "high-impact AI," and "generative AI." High-impact AI is the category requiring the most immediate attention. It captures systems that significantly affect human life, safety, or fundamental rights. In practice, this means AI used in healthcare diagnostics, recruitment and hiring, credit and loan screening, and biometric processing. These are not niche applications. They are tools already embedded in the operations of law firms, consulting practices, financial advisory businesses, and HR functions worldwide.

Operators of high-impact AI systems must conduct pre-deployment impact assessments, establish risk management systems across the full AI lifecycle, maintain meaningful human oversight, and document safety measures. Transparency obligations apply in parallel: users must be notified when high-impact or generative AI is being used, and AI-generated content that could be mistaken for human output must be clearly labelled.

The Extraterritorial Dimension

The Act's reach extends beyond Korean borders. This is the element that catches many international businesses off guard.

Foreign AI operators whose systems affect the South Korean market or its users — regardless of where those systems are developed or hosted — fall within scope. Businesses that meet certain revenue or user-threshold criteria may be required to designate a domestic representative in Korea, mirroring an obligation model familiar from the GDPR. The thresholds themselves will be clarified through subordinate legislation, but organisations with material Korean user bases or revenue exposure should not wait for that detail before beginning their assessments.

Administrative fines under the Act are currently capped at KRW 30 million (approximately £17,500). That figure is modest relative to GDPR-scale penalties, and the Ministry of Science and ICT (MSIT) has adopted a grace period in 2026, deferring fines except where serious social harm is involved. However, the fines are not the primary compliance driver here. The reputational and operational consequences of enforcement action — particularly the PIPC's demonstrated willingness to order the destruction of AI algorithms trained on unlawfully obtained data — are considerably more significant.

PIPA Amendments: A Material Increase in Data Risk

Running in parallel with the AI Basic Act, South Korea's Personal Information Protection Act (PIPA) has been substantially strengthened. Amendments promulgated in March 2026, with most provisions effective from September 2026, raise the maximum penalty ceiling for severe data breaches from 3% to 10% of total global turnover. That is a significant escalation, and it places South Korea's data protection penalties within a range comparable to the most serious GDPR violations.

The amendments also extend breach notification obligations. Organisations must now notify authorities upon becoming aware of a possibility of a breach, not only after a breach has been confirmed. For firms managing large volumes of personal data through AI systems — which can ingest, process, and generate data at scale — this lowers the practical threshold for notification considerably.

From July 2027, certain entities will be required to obtain mandatory Personal Information and Information Security Management System (ISMS-P) certification, a process previously voluntary. Organisations that have not engaged with this framework should factor the certification timeline into their compliance planning now.

CEO accountability for data protection failures is also explicitly reinforced under the revised PIPA. For global enterprises, this means the personal exposure of senior leadership is no longer an abstract risk.

The PIPC's Generative AI Guidelines

The Personal Information Protection Commission (PIPC) released its Guidelines for Personal Data Processing for the Development and Utilisation of Generative AI in August 2025. These guidelines are not legally binding, but dismissing them on that basis would be a mistake. The PIPC uses them as a benchmark in enforcement actions, and compliance with them directly shapes how regulators assess organisational conduct.

The guidelines function as a lifecycle rulebook. They address legal basis documentation for training data, pseudonymisation requirements, input and output filtering controls, and the expectation of CPO-led governance over generative AI systems. For any organisation developing, fine-tuning, or deploying generative AI that touches Korean users or Korean personal data, these guidelines define the expected standard of practice.

The PIPC's enforcement posture is active. The January 2025 case in which it ordered the destruction of an AI algorithm trained on unlawfully obtained data signals clearly that the Commission is prepared to impose consequential remedies, not merely issue warnings.

What This Means for International Firms

The combined effect of the AI Basic Act, the amended PIPA, and the PIPC's enforcement activity creates a layered compliance environment that cannot be addressed in isolation. For international professional services businesses operating across multiple jurisdictions, South Korea represents one node in an increasingly complex global AI compliance map — but it is a node that requires specific, documented attention.

Firms should prioritise the following:

Inventory your AI exposure. Identify which systems used in or affecting the Korean market meet the definition of high-impact or generative AI. This includes tools used in client-facing processes, internal HR functions, and data-driven advisory services.

Conduct impact assessments before deployment. The pre-deployment impact assessment obligation under the AI Basic Act is not aspirational — it is a legal requirement for high-impact AI operators. Build this into your deployment governance process.

Review your breach notification posture. The PIPA amendment lowers the trigger for notification. Your incident response procedures should reflect the expanded obligation and the tighter timescales implied by a "possibility of breach" standard.

Assess your representative obligations. If you have material revenue or user exposure in Korea, determine whether you fall within the domestic representative requirement and take the necessary steps to comply.

Align with the PIPC guidelines on generative AI. Even where they are not binding, adherence to the PIPC's generative AI guidelines demonstrates good faith and reduces regulatory risk substantially.

Get Expert Guidance on Your Korea AI Compliance Position

South Korea's regulatory framework is now operational. The grace periods will not last indefinitely, and the PIPC's enforcement approach suggests that substantive compliance — not procedural gesture — is what regulators are looking for.

Ops Intel works with international professional services firms and global enterprises to build AI compliance programmes that are rigorous, proportionate, and designed for multi-jurisdictional environments. If your organisation has exposure to the Korean market or is managing AI compliance obligations across multiple regulatory regimes, contact Ops Intel to discuss how we can help you assess your position and put the right structures in place.