AI Basic Act · EU AI Act
AI Framework Act (Korea) / European Union AI Act
What is the AI Basic Act?
- Korea’s AI Basic Act takes effect in 2026 · EU AI Act applies in phases
- A structure where obligations vary with the level of risk (high impact)
- First step: list where AI is used inside the company
What the AI Basic Act and the EU AI Act really change is the format of the approval paperwork for adopting AI. The old “AI tool purchase request” only listed features, price, and expected benefits. Now it must state who the AI affects and how, and who makes the final check on its results. The key point is that regulation targets the use, not the technology. The same language model is largely unrestricted when summarizing internal meeting minutes, but carries heavy obligations when screening job applications. Building your inventory by use case, not by model name, is the first task.
The two laws have similar maps but different scales. The EU divides systems into four tiers (prohibited, high-risk, limited-risk, and minimal-risk) and phases in application: prohibitions from February 2025, general-purpose AI model obligations from August 2025, and high-risk system obligations in 2026–2027. Korea sets a single threshold, “high-impact AI,” and points to areas with major effects on life, safety, and fundamental rights, such as healthcare, energy, hiring, and loan screening. It separately requires labeling of generative AI outputs and the designation of a local representative for foreign operators. Don’t confuse it with the Personal Information Protection Act: where the privacy law asks “what data was processed, and how,” the AI law asks “what did that decision do to a person.”
The most common mistake in practice is concluding, 'we don’t export directly to the EU, so this doesn’t apply to us.' Extraterritorial application looks at whether the output reaches the EU market, so even Korean suppliers that serve as tier-1 vendors receive AI-related questions in their customers’ supply chain due diligence questionnaires. Without documents to back up the answers, negotiation of contract terms can stall for months. Another is the misconception that 'high-impact means we can’t use it'. High-impact does not mean prohibited; it means obligations for explanation, records, and human involvement apply. Conversely, assuming you are done once you add a generative AI label is also risky. The label is just the most visible line among many obligations, and the real damage comes when AI output that no one reviewed goes out as a customer notice.
John KimInstructor John Kim, author of B2B Marketing Design and CEO of Nanum Consulting
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ lectures, helping non-technical staff put AI to work right awayThe EU published a draft in 2021 and finalized the AI Act in 2024, setting a global model for risk-based regulation. Korea passed its AI Basic Act in December 2024, taking an approach that pairs promotion with regulation. Both laws scale obligations to the level of risk.
Consider a hypothetical case. Company A, an auto parts manufacturer with 1,200 employees, gets 35% of its revenue from exports to the EU. The annual supply chain due diligence questionnaire from a German customer included an item on 'AI system usage and risk classification' for the first time, and the company had not a single document to base an answer on. The quality assurance and legal teams took on a joint 3-month response project.
- A senior manager on the legal team interviewed 14 department contacts and broke 23 internal AI tools down by use. The list grew to 31 uses, more than the number of tools.
- Three of them were caught in the “affects people” column: first-round résumé screening, attendance anomaly detection, and visual inspection judgments. The HR director said, “We have never filtered anyone on a score alone,” but there was no file with a record to show it.
- In line with the principle that AI output is never the final decision, we changed the ATS screens so that, in recruitment screening, a staff member re-checks every filtered applicant and enters a reason of at least 30 characters.
- We set criteria for adding an 'AI draft, reviewed by owner' notice to external content and gave a 2-hour training to 6 marketing team members. A PR assistant manager asked, 'Where does a draft end?' so we drew the line: add the label when AI-drafted content makes up 30% or more.
- Three months later, the company answered 11 of 12 AI items on a German client’s questionnaire with supporting documents and passed without conditional approval. For the same questionnaire from two other partners, reply preparation dropped from three weeks to four days.