Korea AI Basic Act compliance, generated from your own systems.
Korea's Framework Act on the Development of AI and Establishment of a Foundation for Trust (인공지능 기본법) creates the country's first horizontal AI regime, with elevated duties on 'high-impact AI', generative-AI labelling and a domestic-representative requirement for foreign operators.
The Act layers risk-and-safety duties on top of standard AI development. High-impact AI carries documentation, risk-management and user-rights obligations; generative AI carries labelling and pre-use notice; foreign operators above thresholds must appoint a domestic representative.
Article 2 defines 'high-impact AI' as AI used in life, safety or fundamental-rights-sensitive domains — explicitly including healthcare, energy, public services, criminal justice, finance, social welfare, transport, education and biometric identification, with implementing rules to be set by Presidential Decree. Domain assignment is the gating analysis.
Operators of high-impact AI must (i) establish a risk-management plan across the AI lifecycle, (ii) maintain documentation of training data, model design, evaluations and limitations, (iii) provide pre-use information to users, (iv) ensure human oversight and recourse, and (v) report serious safety incidents to MSIT (Ministry of Science and ICT). These duties parallel — but are not identical to — the EU AI Act's Articles 9–15.
Generative AI carries a separate set of obligations: clear pre-use notice that the user is interacting with generative AI, and identifiable labelling of generated output as AI-generated. The 22 September 2025 Mandatory Labelling Measures provide implementation detail.
Foreign AI operators whose users in Korea exceed thresholds defined by Presidential Decree must appoint a domestic representative for the purpose of MSIT correspondence and enforcement. The National AI Committee, chaired by the President, sets cross-government policy.
The files this framework actually requires.
The Act names the duties but not the document set. Hael generates the artefacts MSIT will request from a high-impact-AI operator.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
The Act asks for the operator's plan, documentation, notice and labelling. Hael holds them in the shape MSIT will recognise.
Discover, classify, produce — for Korea AI Basic Act.
Find the systems in Korea AI Basic Act scope, including embedded third-party AI.
Assess each against Korea AI Basic Act's risk tiers and obligations.
Generate the Korea AI Basic Act records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
Korea's high-impact AI risk-management plan and technical documentation overlap substantially with the EU AI Act Article 9 risk-management process and Annex IV technical file, and with a NIST AI RMF Profile. The generative-AI labelling obligation parallels Article 50 of the EU AI Act. Build the substantive artefacts once; render to MSIT's format.
Be ready for the Korea AI Basic Act, ahead of 22 January 2026.
Bring an AI system serving Korean users. We'll register it, run the high-impact classification, and show the risk-management plan, technical documentation, user-information record and (where relevant) generative-AI labelling Hael would generate.