Korea AI Basic Act AI Audit Evidence: What MSIT Asks a High-Impact Operator to Produce

South Korea's AI Basic Act and its Enforcement Decree took effect on 22 January 2026, and the Ministry of Science and ICT attached a one-year grace period on administrative fines to that date. The window closes on 22 January 2027. Fines cap at KRW 30 million, roughly USD 21,000, which reads as trivial until you look at what triggers them: failing to notify users that AI is in use, failing to appoint a domestic representative, and obstructing or refusing an MSIT inspection. The third trigger is the expensive one, because an inspection you are unable to answer becomes a finding regardless of what the underlying system did.

The statute's obligations sit at the operator level rather than the model level, which changes what an inspection asks for. I want to walk the specific artifacts a high-impact AI operator hands over, because five of them are generated by the request path and stop existing the moment nobody instruments it.

The classification record

The Act requires an operator to determine whether a system qualifies as high-impact before deployment, covering systems that materially affect human life, safety, or fundamental rights across healthcare, energy, transportation, hiring, and biometric analysis. MSIT reads the determination first and everything else through it.

The artifact is a written classification decision naming the system, the sector, the reasoning, and the date. What makes this harder than it looks is scope drift: a hiring assistant classified as low-impact in March starts calling a different model in June, and the classification never gets revisited. A per-request record of which model endpoint served which internal system is what turns that determination from an assertion into something checkable.

The meaningful explanation record

High-impact operators owe affected users a meaningful explanation covering the outcome, the key criteria behind it, and a summary of the training data. The first two are the ones that reach into the request path.

Producing an explanation of a specific outcome months after the fact requires knowing what was sent, what came back, and which configuration handled it. A record holding the prompt, the model and version, the applied policy, and the response is the substrate an explanation is written from. Without it, an explanation describes the system as it is configured today and says nothing testable about the decision under question. What to log for AI compliance covers the field set this needs.

The prior-notification record

The Act requires operators to notify users in advance that a product or service uses AI. This is one of the three triggers that carries a fine directly, and it is the one most likely to fail quietly, because notification is implemented once in a product surface and then a new AI feature ships behind a flag six months later without anyone updating the notice.

The evidence MSIT reads is a notification artifact paired with an inventory of AI features actually in production. Reconciling those two is where the gap shows. A destination log naming every model endpoint called during the period is the reconciliation source, and it regularly surfaces features that never made it into the notice. The same reconciliation problem drives shadow AI discovery.

The generative AI labelling record

For generative outputs, the Act requires labels indicating the content was produced by AI, with a heightened notice duty for sound, image, or video difficult to distinguish from human-created work. Labelling is applied on the response side.

That makes the response path an enforcement point rather than a passthrough. The artifact is a record showing, per response, that the labelling rule was evaluated and what it produced. An operator who applies labels in a rendering template can describe the rule to an inspector. An operator who evaluates the rule in the response path can show it firing on a specific date against a specific output.

The human supervision record

High-impact operators have to implement human intervention and supervision mechanisms, and document the actions taken to secure trust and safety. Documentation of a mechanism is a policy statement. Evidence of a mechanism is a record of it operating.

The testable version is a decision record showing which requests were held, escalated, or blocked, under which rule, and who resolved them. A fail-closed default on ambiguity produces exactly that trail as a side effect of running, which is why the supervision obligation and the audit obligation collapse into the same infrastructure.

The domestic representative and the inspection itself

Foreign operators without a Korean office must designate a domestic representative once they cross any of three thresholds: annual revenue above KRW 1 trillion, AI service revenue above KRW 10 billion, or an average of more than one million daily Korean users over the preceding three months. That representative answers MSIT's inquiries.

My candid view: the KRW 30 million cap is the least interesting number in this statute. The representative provision is what changes behaviour, because it puts a named person in Seoul on the hook for producing answers on MSIT's timeline, and that person's ability to answer is set months earlier by whether anyone instrumented the request path. Handing a representative a policy binder and a promise that logging exists somewhere is how a routine inquiry turns into an obstruction finding.

Where the artifacts converge

Five of the six rows are produced by traffic. The Enforcement Decree does not prescribe an architecture, and the artifacts it asks for describe one anyway.

DeepInspect

This is the evidence layer a Korean high-impact operator reaches for under inspection. DeepInspect sits inline between your users or agents and the LLM APIs they call. For every request it evaluates identity, prompt classification, and destination, enforces per-role and per-route policy with a fail-closed default, inspects the response, and writes a signed, tamper-evident record before the response returns to the application.

That record holds the caller, the classification in the prompt, the model endpoint and version, the policy revision that governed the decision, and the outcome. When MSIT asks a domestic representative which system produced a specific outcome on a specific date and under which criteria, the answer is a query against records the application never had custody of. The controls mapping view lines each obligation up against the enforcement point that satisfies it. Book a technical deep dive at deepinspect.ai.