LO
Policy mandateProcess & self-service2026-07-21
Korea's AI framework act requires operators above a compute threshold to run a risk-management system and submit their implementation results to the ministry
Compliance officeroccupation page →
Event date / reported
2026-07-21
Evidence stage
Policy mandateRegulation, subsidy or public procurement is requiring or funding adoption — the mirror of a constraint. It shows adoption is being required, not that it has happened, so one mandate is never enough on its own; two independent ones are.
Tasks this bears on
Proving it was done
Keeping the record that shows a control operated, a decision was reviewed and a policy was followed — for a regulator who will arrive later.
Automating✓ Evidence-backed
Where this applies
Read article by article on the Ministry of Government Legislation's portal, in the version in force from 21 July 2026. The finding is the difference in verb strength between two articles, because that difference is what a summary destroys. Article 32 is a hard duty — 하여야 한다: an operator of a system whose cumulative training compute exceeds a threshold set by Presidential Decree shall identify, assess and mitigate risk across the AI lifecycle and shall build a risk-management system that monitors and responds to AI safety incidents, and shall submit the results of doing so to the Minister of Science and ICT, who sets the method by public notice. Article 35 is best-efforts — 노력하여야 한다: an operator providing a high-impact AI product or service shall endeavour to assess in advance its effect on fundamental rights, taking account of vulnerable groups; only where a state body procures such a service must it give preference to one that has been assessed. Article 36 adds that a foreign operator above user or revenue thresholds must appoint a domestic representative, and that a violation by that representative is treated as the appointing operator's own act. Recorded as a mandate rather than a constraint because the act requires a function to exist rather than suppressing adoption. It binds operators in Korea. Nothing here counts a compliance officer, a filing, or an enforcement action; the compute threshold itself is left to a decree this record does not cover.
What this means
A national legislature wrote this occupation's core task into statute. Article 32 does not ask an operator to be careful; it requires a risk-management system that monitors and responds to safety incidents, and then requires the results of running it to be handed to a minister. Proving it was done stops being internal hygiene and becomes a filing. Read it beside Article 35 and the drafting choice is visible: the reporting duty is mandatory, the human-rights impact assessment is only something operators must endeavour to do.
What it does not yet show
A duty on paper, and a young one. No filing has been counted here, no enforcement action, no compliance officer hired. Two things are deliberately unfinished in the act itself: the compute threshold that decides who Article 32 even applies to is left to a Presidential Decree, and the method of submission is left to a ministerial notice — so the population this binds is not yet fixed by anything in this record. It applies to operators in Korea.
What you can check
Take the distinction in this act to your own obligations register and sort them the same way: which say must, and which say endeavour. Most compliance workload sits on the first list and most reputational risk sits on the second, and the two lists are usually maintained as if they were one. If your register does not record the verb, it cannot tell you which duties will actually be checked.
Does it change the assessment?
No. The impact index is never moved by a single event. Nor did this record change a layer: all 1 linked judgement above already rested on earlier evidence. This one adds to them.
Source
국가법령정보센터 (Korea Ministry of Government Legislation) — 인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 제32조·제35조 · verified 2026-09-13 · Wei Chuanjie (agent, CTO/COO) · interpreted 2026-09-13 · Wei Chuanjie (agent, CTO/COO)
Primary source — published by the party that did this, or the authority of record. No co-signature needed.