EU AI Act vs South Korea AI Basic Act: High-Risk vs High-Impact AI Explained

Two countries now have comprehensive, economy-wide AI laws in force. The European Union went first with the AI Act. South Korea followed with the Framework Act on the Development of Artificial Intelligence and Establishment of Trust, usually called the AI Basic Act, which took effect on 22 January 2026.

Both laws aim their heaviest duties at a small group of AI systems that can seriously affect people's lives. The EU calls these systems "high-risk". Korea calls them "high-impact". The labels sound alike, but the two regimes work very differently. They differ in how a system qualifies, what the operator has to do, who checks the work, and what happens when things go wrong.

This guide compares the two side by side. It covers the tests for high-risk and high-impact AI, the generative AI labelling rules, the compute thresholds for frontier models, the domestic representative requirement, fines, and the dates that matter as of November 2026. It ends with a practical plan for companies that serve both markets.

EU AI Act

Regulation (EU) 2024/1689, amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Korea AI Basic Act

Passed 26 Dec 2024, promulgated 21 Jan 2025, in force with its Enforcement Decree since 22 Jan 2026

Key regulated tier

EU: high-risk AI systems · Korea: high-impact AI

Lead authority

EU: national market surveillance authorities plus the AI Office · Korea: Ministry of Science and ICT (MSIT)

Maximum fine

EU: up to €35M or 7% of global turnover · Korea: up to KRW 30 million (about US$21,000)

Best for

Compliance, legal and product teams shipping AI in both the EU and Korea

The short answer

The EU AI Act is a product-safety law. A high-risk system must meet detailed technical requirements, pass a conformity assessment and carry a CE mark before it reaches the market. The Korean AI Basic Act is a framework law. It names high-impact AI, requires operators to take and publish a set of organisational safeguards, and gives the government powers to investigate and order corrections. It has no pre-market certification step and only modest fines.

What the EU means by "high-risk AI"

Under the EU AI Act, a system is high-risk in one of two ways:

• Annex I route: the AI is a product, or a safety component of a product, covered by EU harmonisation law that already requires third-party conformity assessment. Examples include medical devices, machinery, toys, lifts and radio equipment.
• Annex III route: the AI is used in one of eight listed areas. These are biometrics, critical infrastructure, education, employment, access to essential private and public services (including credit scoring and insurance pricing), law enforcement, migration and border control, and the administration of justice and democratic processes.

Article 6(3) allows an exception. An Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it only performs a narrow procedural task. A provider using that exception must document its assessment. The exception never applies to systems that profile people.

Once a system is high-risk, the provider must meet a full set of requirements:

• A risk management system that runs across the whole lifecycle (Art. 9)
• Data and data governance controls (Art. 10)
• Technical documentation and automatic logging (Arts. 11–12)
• Transparency and instructions for deployers (Art. 13)
• Human oversight measures designed into the system (Art. 14)
• Accuracy, robustness and cybersecurity (Art. 15)
• A quality management system, conformity assessment, CE marking, EU database registration and post-market monitoring

Deployers carry their own duties under Article 26. Some deployers, such as public bodies and companies doing credit scoring or life and health insurance pricing, must also complete a fundamental rights impact assessment under Article 27.

What Korea means by "high-impact AI"

Korea's AI Basic Act defines high-impact AI as an AI system that may significantly affect, or pose a risk to, human life, physical safety or fundamental rights, when used in specified areas. MSIT's summary lists ten areas:

Being in a listed area is not enough on its own. The Enforcement Decree requires the area and the level of risk to be considered together. MSIT has said that a system is generally outside the high-impact category when a human makes the final decision. That is a major difference from the EU, where a human in the loop does not take an Annex III system out of the high-risk tier unless the narrow Article 6(3) exception applies.

Under Article 33, operators must check for themselves whether their AI is high-impact before offering it. If they are unsure, they can ask MSIT to confirm. MSIT published high-impact determination guidelines on 22 January 2026 and revised them on 29 January 2026. The guidelines include sector-by-sector criteria and worked examples.

Once an AI system qualifies, Article 34 requires the operator to put in place:

• A risk management plan
• An explanation plan covering, as far as technically feasible, the main criteria behind outputs and an overview of the training data
• User protection measures
• Human management and supervision of the system
• Documents showing the measures taken to ensure safety and trustworthiness

The Enforcement Decree requires operators to publish the main content of these measures, such as on their website, leaving out trade secrets. Article 35 adds a fundamental rights impact assessment. It is framed as something operators should endeavour to carry out, and public bodies are encouraged to favour products that have been assessed.

If you are working through the Korean high-impact guidelines and the EU high-risk rules at the same time, I post practical breakdowns of global AI laws regularly on LinkedIn. Feel free to connect with me there and tell me which classification questions are giving your team trouble.

High-risk vs high-impact: side-by-side comparison

Generative AI and deepfake labelling

Both laws require transparency for generative AI, and in Korea this applies whether or not the system is high-impact.

Korea (Article 31). Operators offering products or services that use high-impact or generative AI must tell users in advance that AI is involved. Generative AI outputs must be labelled. For deepfakes, the decree requires clear labels that users can easily recognise, taking into account factors such as age. For other AI-generated content, such as animations and webtoons, the decree allows invisible digital identifiers such as watermarks in place of visible labels. MSIT's transparency guidelines add that content which is downloaded or shared needs either a human-recognisable mark or machine-readable metadata after a text or voice notice.

EU (Article 50). These obligations apply from 2 August 2026. Providers must tell people when they are interacting with an AI system, and must mark synthetic audio, image, video and text in a machine-readable format. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) marking duty.

Frontier models: Korea's 10²⁶ threshold vs the EU's 10²⁵

Article 32 of the Korean Act sets safety duties for very capable AI systems. According to MSIT, a system falls in scope only when it meets all three criteria: cumulative training compute of at least 10²⁶ floating-point operations, cutting-edge technology, and a risk of broad and significant impact on fundamental rights. In-scope operators must identify, assess and mitigate risks across the lifecycle, build a risk management system that monitors and responds to incidents, and report the results to MSIT.

A common error in online guides is the claim that Korea's threshold "mirrors" the EU's. It does not. Under the EU AI Act, a general-purpose AI model is presumed to have systemic risk at 10²⁵ FLOPs, ten times lower than Korea's line. EU GPAI obligations have applied since 2 August 2025, and the Commission's enforcement powers have applied since 2 August 2026. Systemic-risk providers must evaluate models, run adversarial testing, report serious incidents and maintain adequate cybersecurity.

In practice, a model above 10²⁵ but below 10²⁶ FLOPs can be a systemic-risk model in the EU while falling outside Korea's Article 32 safety duties.

Foreign companies and the domestic representative

Both laws reach companies based abroad. The EU AI Act requires non-EU providers of high-risk systems and GPAI models to appoint an authorised representative in the Union.

Korea's Article 36 works differently. Its trigger is company size rather than the risk tier. A foreign AI operator with no address or office in Korea must appoint a domestic representative if it meets any one of these thresholds:

• Total revenue of KRW 1 trillion or more in the previous year (about US$662–681 million, depending on the exchange rate used)
• Revenue from AI services of KRW 10 billion or more in the previous year (about US$6.6 million)
• An average of 1 million or more daily users in Korea over the three months before the end of the previous year

The representative must have a Korean address. It handles compliance submissions, requests for high-impact confirmation, and support for safety measures. The AI-service revenue line is the one most likely to catch mid-sized foreign vendors.

Enforcement: fines, grace periods and real risk

The difference in penalties is large. Under Article 43 of the Korean Act, the maximum administrative fine is KRW 30 million per violation. Fines cover failure to notify users, failure to appoint a required domestic representative, and failure to follow corrective orders or refusal of inspections. Under Article 40, MSIT can investigate and order corrective measures, including suspending a service that poses a safety threat.

MSIT has promised a grace period of at least one year from 22 January 2026. During that time it will generally not run fact-finding investigations or impose fines, except in serious cases such as loss of life. It also runs an AI Basic Act Support Desk to give operators advice. An expert task force of more than 40 members began reviewing implementation in March 2026. The earliest date fines could apply is therefore 22 January 2027, and MSIT has not publicly confirmed the exact end date.

The EU regime is far stricter. Non-compliance with high-risk obligations can cost up to €15 million or 3% of worldwide turnover, and prohibited practices up to €35 million or 7%. In the EU, the bigger risk is often not the fine but a market withdrawal order or the loss of a CE mark.

Key dates

• 1 Aug 2024

  EU AI Act enters into force.

• 26 Dec 2024

  Korea's National Assembly passes the AI Basic Act.

• 21 Jan 2025

  Korea promulgates the AI Basic Act.

• 2 Feb 2025

  EU prohibited practices and AI literacy duties apply.

• 2 Aug 2025

  EU GPAI model obligations apply.

• 22 Jan 2026

  Korea's AI Basic Act and Enforcement Decree take effect; MSIT issues guidelines and the fine grace period begins.

• 27 Jul 2026

  EU Digital Omnibus on AI enters into force and delays the high-risk deadlines.

• 2 Aug 2026

  EU Article 50 transparency duties and Commission GPAI enforcement powers apply.

• 2 Dec 2026

  EU deadline for Article 50(2) marking for generative systems already on the market.

• 22 Jan 2027

  Earliest end of Korea's fine grace period.

• 2 Dec 2027

  EU Annex III high-risk obligations apply.

• 2 Aug 2028

  EU Annex I high-risk obligations apply.

A 6-step plan for companies serving both markets

1. Build one AI inventory with two classification columns

   For every system, record its EU status (prohibited, high-risk, Article 50, GPAI, minimal) and its Korean status (high-impact, generative, Article 32, out of scope). Keep the rationale for each decision, because the two tests can give different answers for the same system.

2. Test the human-final-decision question carefully

   If a person makes the final call in a Korean use case, document how real that oversight is. A human who rubber-stamps outputs is weak evidence. Where classification is unclear, use MSIT's confirmation route.

3. Reuse your EU risk management work for Article 34

   An EU Article 9 risk management system, Article 13 instructions and an Article 14 oversight design can be adapted into Korea's risk management, explanation and supervision plans. Then prepare a public summary in Korean.

4. Ship one labelling and notice layer

   Add up-front AI notices for Korean users, visible labels for deepfakes, and machine-readable marking for all generated content. Check that this layer also meets EU Article 50 before 2 December 2026.

5. Check the thresholds that trigger extra duties

   Compare your revenue and Korean user numbers against the domestic representative thresholds. Model developers should record cumulative training compute against both 10²⁵ (EU) and 10²⁶ (Korea).

6. Use the grace period, then stay alert

   Close gaps before January 2027, appoint a representative if one is needed, and keep track of MSIT guideline revisions and the EU's harmonised standards for high-risk systems.

Common mistakes to avoid

• Treating "high-impact" as a translation of "high-risk". The tests, duties and exits differ.
• Assuming Korea's duties start when fines do. They have applied since 22 January 2026.
• Saying Korea's 10²⁶ threshold matches the EU's. The EU systemic-risk presumption is 10²⁵.
• Assuming a human reviewer removes EU high-risk status. It does not, outside Article 6(3).
• Ignoring the AI-service revenue trigger for a Korean domestic representative.
• Writing Korean high-impact measures but never publishing a summary as the Decree requires.

Prompt: run a dual classification

You are an AI compliance analyst. For the AI system described below:
1. Classify it under the EU AI Act: prohibited, high-risk (Annex I or
   Annex III, and whether Art. 6(3) could apply), Article 50 transparency,
   GPAI, or minimal risk. Cite the article or annex.
2. Classify it under Korea's AI Basic Act: high-impact (name the area and
   explain the risk level), generative AI under Art. 31, Art. 32
   high-performance, or out of scope. Note whether a human makes the
   final decision.
3. List the duties under each law and the date each one applies.
4. Flag any point where the two classifications diverge and explain why.
5. List the evidence we should keep for each conclusion.

System description: [purpose, users, sector, decision role, human
oversight, training compute, markets served]

Europe asks you to prove an AI system is safe before it reaches the market. Korea asks you to show, publicly, how you are keeping it safe once it is there. A good governance program can do both from the same evidence.

— Kumail Mehdi

Frequently asked questions

Building a compliance program for both the EU and Korea? Let's connect on LinkedIn. I'm always glad to compare notes on how teams are handling Asia-Pacific AI laws alongside the EU AI Act.

Sources

• MSIT – The AI Basic Act Comes into Force (January 2026)
• US International Trade Administration – South Korea AI Basic Act
• Cooley – South Korea's AI Basic Act: Overview and Key Takeaways
• White & Case AI Watch – Global Regulatory Tracker: South Korea
• Baker Botts – MSIT Issues Package of Regulations to Supplement AI Framework Act
• Stimson Center – South Korea's AI Basic Act: Seeking Balance
• EUR-Lex – Regulation (EU) 2024/1689 (AI Act)
• AI Act Explorer – Article 6: Classification rules for high-risk AI systems
• AI Act Explorer – Article 51: GPAI models with systemic risk