South Korea May Regret Being First with New AI Law

On January 22, South Korea introduced its AI Basic Act, which it claimed to be “the world’s first comprehensive body of laws to regulate artificial intelligence.” The government claims the legislation will help propel the country to be a leader in the global race for AI leadership by establishing a “foundation for trust” while also protecting the interests of citizens.

The new law — the Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trustworthiness — comprises six chapters with 43 articles, and stipulates stringent compliance requirements on both domestic and foreign companies The law loosely defines a “high-impact AI” category of applications, such as those related to nuclear safety, drinking water supply, transportation, healthcare and financial credit evaluation and loan decisions, stipulating that human oversight of such applications is mandatory. Companies must also provide advance notice to users about products and services using such “high impact AI” to meet an “explainability” requirement. A “user protection plan” must also be in place.

Moreover, in order to counter misinformation and deepfake images, the law also imposes a “transparency” requirement, calling for clear watermarks or audible labelling when AI outputs are “difficult to distinguish from reality.” Even for games and animations, in order to minimize the intrusiveness of such labels, they are still required to be placed within the metadata. An administrative fine of up to ₩30 million won ($20,400) can be imposed for infractions of such labelling requirements, after a one-year grace period.

Concerns from startups

Although the government says the new law was passed after “extensive consultation,” South Korea’s Startup Alliance has expressed its frustration at the vagueness of the language in the law. The Alliance found in its survey that 98% of 101 local AI startups do not have systems in place to comply with the law, and nearly half of them admit to be unfamiliar with its details. As the Ministry of Science and ICT (MSIT) will be responsible for confirming whether a system qualifies as high-impact AI and the process to review will take 30 days, with an extension of up to another 30 days, certain new service rollouts will inevitably face uncertain delays.

No wonder the Alliance’s co-head, Lim Jung-wook, was quoted as asking, “Why do we have to be the first to do this?”

Indeed, that is a fair question. Even the much heralded AI Act of the European Union, legislated in 2024, is still in the middle of a phased rollout process, with only the prohibitions on “unacceptable-risk” AI systems and limited obligations for generative AI being in force at present. The majority of its rules, including those governing high-risk AI, will not be enforced until August of 2026. South Korea seemed to have caught the “AI safety bug” after hosting the 2024 AI Seoul Summit, the second after the first AI Safety Summit in the UK in 2023, and local politicians apparently just had to do something quickly in order to ‘be at the forefront.’

A history of being the first, then paying the price

As a vibrant representative democracy and an early adopter of broadband and digital technologies, South Korea has traditionally not been shy to take a bold lead, undertaking novel approaches to legislate and regulate. However, such legislative populism, in the name of protecting the masses, often does not end well, as being the first often means a there is no opportunity to observe regulatory experiences from other countries. In other words, being the first to regulate could easily mean being the first to fail to predict all the unintended consequences of a particular intervention.

For instance, in 2009, South Korea’s Information and Communications Network Act was amended to require websites and online game operators to implement a real-name registration system, after an earlier online bullying incident led to the suicide of a famous Korean female actor. Not long after, in 2011, many of the real-name databases were compromised by hackers, exposing the real names and personal data of millions of citizens on online forums across Asia for others to attempt to gain access to gaming sites. Eventually, in 2012, the country’s Constitutional Court ruled this “first in the world” real-name requirement to be unconstitutional.

With an active and often populist legislature, some of South Korea’s past digital regulations, in the legislators’ zeal and eagerness to “protect the people,” could rightly be criticized as trying too hard, going too far and too fast. For example, in 2020, the Personal Information Protection Act (PIPA), the Information and Communications Network Act (Network Act) and and the Credit Information Use and Protection Act — jointly referred to as the “Data 3 Law” — included provisions to punish persons responsible for data breaches with up to 2 years’ imprisonment or a fine of up to ₩20 million won (US$13,800). However, blaming and punishing the victims of sophisticated attacks was not a great idea to promote cybersecurity best practices, and ended up discouraging small companies from adopting digital technologies. By 2023, the laws were largely revised to include only smaller administrative fines and corrective measures, rather than carrying criminal liabilities.

Now is not a good time for South Korea’s protectionist instinct?

South Korea’s legislature also has a propensity for protectionist legislation. For instance, the country’s “sender pays” regime for telecommunications interconnection charges is often seen as against the principle of net neutrality. While favoring domestic telecommunications carriers and domestic Internet companies against foreign Internet platforms and service providers, such as Meta or Netflix, many of the servers of those global service providers were moved from South Korea to other neighboring Asian economies where no such charges existed. Some analysis argued that as a result the South Korea end user experience, in terms of network speed, resilience and reliability, suffered, and it might even end up costing more for the users.

Indeed, in the AI Basic Act, international companies without a South Korean representative office but meeting a threshold of ₩1 trillion won (US$689 million) in revenues, ₩10 billion won (US$6.89 million) in AI revenues, or 1 million average daily users in the country, must nominate a domestic agent to be a local accountable representative, as far as compliance to the provisions of the law is concerned. Although only a small number of foreign firms will fall into this category to be regulated, such as Google and OpenAI, they are already complaining about the rules discouraging innovation or creating compliance uncertainty.

However, this time on the other hand, local companies are complaining that the new law will put a disproportionately higher burden on them as compared to foreign companies. In response to all the different concerns from South Korean AI companies, the country’s President Lee Jae-Myung appeared sympathetic and urged lawmakers to “listen to the concerns of the industry.” In any event, it appears that the law will not sit well with the US government, whose AI Action Plan is all about pushing the adoption of the US AI technology stack, while the two countries continue to negotiate the Trump tariffs.

South Korea is in a good place, stay calm and carry on

In Stanford University’s Global AI Vibrancy Tool, South Korea was 4th out of 36 countries in 2024 across multiple AI indicators, based on the country’s strengths in human capital, positive national sentiment toward AI, and its excellent Internet infrastructure. Clearly the country also occupies an important position in the semiconductor supply chain, especially in memory chips. In addition, the country has just announced a “Unicorn Bridge” program to select and incubate 50 AI companies, with each receiving ₩600 million won (US$0.4 million) in government subsidies and ₩10 billion won in special guarantees. The top 20 companies will receive even more as a bonus.

South Korea is in a good position when it comes to competition. While more needs to be done, of course, overly aggressive regulations may indeed bring unintended consequences, and the country’s history of being the first to over-regulate should be a caution. Over-zealous legislation can be a risky affair for a relatively small market and a “middle power” country such as South Korea, especially in today’s volatile geopolitical reality.