Korea's AI Basic Act reaches the product boundary

The ministry's guidance applies the transparency obligation to businesses directly providing AI products and services to users, including international companies supplying users in Korea. The Act's territorial provision likewise reaches conduct outside the country when it affects the domestic market or users. Incorporating a business overseas therefore does not settle whether its Korean product offering falls within the framework.

An application startup should assess the service customers buy on its own terms. Using another company's model to provide an AI service can place the application business in the provider chain. A customer using that tool in its ordinary operations, however, is not automatically supplying AI to others. Sales teams need to explain the controls the vendor supplies and the obligations that apply to each customer.

The Act identifies uses that can significantly affect life, physical safety or fundamental rights, including specified applications in healthcare, recruitment, credit decisions, transport and public services. AI providers must assess in advance whether their AI is high impact and may request confirmation from the ministry. That assessment concerns the application and its consequences; a generic label attached to the underlying model cannot answer it for every deployment.

For covered high-impact products, the Act includes risk management, user protection, human oversight, explanation measures within technical limits, and documentation. A venture selling into a sensitive workflow needs to cost those capabilities as part of delivering the service. Human review requires an intelligible output and an operational process for acting on it. Investors should ask whether a customer can exercise the oversight described in the product documentation during ordinary use.

MSIT announced a grace period of at least one year, during which fact-finding investigations and the imposition of penalties would be deferred. Investigations would be conducted only in highly exceptional cases, such as incidents involving loss of life, human rights violations or other serious social harm. The ministry also announced a support desk offering confidential consultations, with anonymous consultations available. Its subsequent announcement of an improvement working group reaffirmed the grace period and described continuing work on the framework.

That operating policy should be distinguished from the law's commencement. It offers time to resolve classification questions and implement the relevant controls, while the provisions already give customers a vocabulary for procurement and risk review. A sensible product roadmap uses the period to record decisions, resolve uncertain uses and make disclosures usable. Forecasting an exact end to enforcement discretion would go beyond the ministry's stated commitment of at least one year.

The consolidated statute effective on 21 July contains provisions requiring public bodies to give priority consideration to qualifying AI products and services, subject to the law's conditions and an exception where AI is unsuitable for the work. It also provides a basis for startup support through the venture investment fund of funds, following consultation with the minister responsible for SMEs and startups.

Those provisions can influence routes to market and financing, but neither is a purchase commitment to an individual company. A founder still has to establish that the product qualifies, that a buyer has a suitable problem and that deployment will deliver value. The combined investment question is whether the company can make its service understandable and dependable enough to win customers while meeting the responsibilities attached to the product it actually sells.