EveryAILaw.comDoes AI Basic Act require Risk Assessment?
South Korea • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 6 specific requirements for Risk Assessment across 1 provision:
- High-impact domains — Art. 2(4) defines high-impact AI by domain, not by model size: energy supply, drinking water, healthcare services, medical and digital medical devices, nuclear materials and facilities, biometric analysis for criminal investigation, judgments significantly affecting rights such as employment or loan decisions, and transport operations
- Self-review and confirmation — Art. 33 requires operators to review in advance whether a system is high-impact, and allows them to request confirmation from the Minister of Science and ICT
- Operator obligations — Art. 34 requires a risk management plan; explanation measures covering final outputs, the principal criteria used, and an overview of training data, to the extent technically feasible; user-protection measures; human oversight; and retained documentation of the measures taken
- Impact assessment — Art. 35 is a best-effort duty — operators "shall endeavor" to assess impacts on fundamental rights; public institutions are to prioritise products that have been assessed
- Vulnerable-group reflection — Art. 35(1) latter part (added by Act No. 21311, in force 2026-07-21) requires that where an impact assessment is conducted, it must reflect the characteristics of AI-vulnerable groups (persons with disabilities, older persons, and others prescribed by Presidential Decree under Art. 3(5)), considering the nature of the product or service
- Compute-threshold safety duty — Art. 32 imposes separate safety measures on models whose cumulative training compute meets the threshold set by Presidential Decree; the threshold value itself lives in the decree, not the Act
High-Impact AI Risk Management #
Requirements
| Requirement | Details |
|---|---|
| High-impact domains | Art. 2(4) defines high-impact AI by domain, not by model size: energy supply, drinking water, healthcare services, medical and digital medical devices, nuclear materials and facilities, biometric analysis for criminal investigation, judgments significantly affecting rights such as employment or loan decisions, and transport operations |
| Self-review and confirmation | Art. 33 requires operators to review in advance whether a system is high-impact, and allows them to request confirmation from the Minister of Science and ICT |
| Operator obligations | Art. 34 requires a risk management plan; explanation measures covering final outputs, the principal criteria used, and an overview of training data, to the extent technically feasible; user-protection measures; human oversight; and retained documentation of the measures taken |
| Impact assessment | Art. 35 is a best-effort duty — operators "shall endeavor" to assess impacts on fundamental rights; public institutions are to prioritise products that have been assessed |
| Vulnerable-group reflection | Art. 35(1) latter part (added by Act No. 21311, in force 2026-07-21) requires that where an impact assessment is conducted, it must reflect the characteristics of AI-vulnerable groups (persons with disabilities, older persons, and others prescribed by Presidential Decree under Art. 3(5)), considering the nature of the product or service |
| Compute-threshold safety duty | Art. 32 imposes separate safety measures on models whose cumulative training compute meets the threshold set by Presidential Decree; the threshold value itself lives in the decree, not the Act |
Penalties
| Violation | Fine |
|---|---|
| Administrative fine | Up to KRW 30 million (Art. 43) |
| Criminal penalties | Art. 42 |
| Supervisory action | The Minister of Science and ICT may require data submission, conduct on-site inspections, and issue corrective orders (Art. 40); one-year guidance period runs to Jan 2027 |