Does the Korea AI Basic Act require a specific architecture?

No. The Act and its Enforcement Decree state duties and leave implementation open, in the pattern the EU AI Act also follows. The architecture emerges from the artifacts, because explanation, notification reconciliation, labelling proof, and supervision records all require knowing what happened at a specific request on a specific date, and only the request path holds that.

Which duties fall on us versus the model provider?

The operator duties fall on the deploying company: classification, notification, labelling, explanation, supervision, and documentation. The high-performance safety obligations tied to the 10^26 FLOPs threshold fall on developers of systems trained above it. A model provider's assurance documentation covers the provider's controls and stops at the API boundary, which leaves every operator duty above unevidenced without a record on your side.

How does this mapping handle vendor SaaS tools that embed AI?

The operator duty follows the product you put in front of Korean users, regardless of whose model runs underneath. Where an embedded vendor feature calls a model you never see, the destination log on your own traffic will not show it, and the gap has to be closed contractually with vendor-side records available on request. This is the same exposure described in You Own the AI Liability, Not the Vendor.

Do these controls require changing the model?

They operate at the HTTP boundary between the application and the model endpoint, so they are model-agnostic and need no retraining or provider-specific integration. The application keeps supplying identity context, which is its role in any identity-aware design, while classification, routing, enforcement, response inspection, and recording happen in the request path.

What is the deadline we should be working to?

22 January 2027, when the grace period on administrative fines closes. Corrective orders are available to MSIT before then, and a corrective order that goes unaddressed becomes finable on its own terms. The practical planning date sits earlier than the deadline, because the retrieval path in the final row of the mapping takes longer to build than the enforcement controls above it.

Korea AI Basic Act AI Controls Mapping: Operator Duties Against One HTTPS Request

South Korea's AI Basic Act puts its duties on the operator, not on the model. That single drafting decision is what makes a controls mapping possible, because an obligation attached to a deploying company resolves to something that company runs, and in an enterprise calling hosted models over HTTP the thing it runs is a request path.

The Act and its Enforcement Decree took effect on 22 January 2026, with administrative fines deferred for roughly a year by the Ministry of Science and ICT. I want to set out, duty by duty, which technical control satisfies it, where in the flow that control fires, and what evidence falls out. Two of the duties land outside the AI request boundary, and I name those as organisational work rather than stretching a proxy to cover them.

The control point: one HTTPS request

Every mapping below resolves to the same moment. An HTTPS POST carries a context window to a model endpoint. At that instant the caller's identity is known, the prompt content is available to classify, the destination is selected, and a decision is either recorded or lost forever. The Act's operator framing means the company owning that request owns the duty, which puts the request boundary and the compliance boundary in the same place.

High-impact classification

Operators must determine, before deployment, whether a system significantly affects human life, safety, or fundamental rights across sectors including healthcare, energy, transportation, hiring, and biometric analysis. Destination-aware routing with an allowlist is the control, so each internal system reaches an approved set of model endpoints and a new one fails closed rather than appearing silently. What falls out is a destination log that reconciles the classification inventory against production traffic, and that reconciliation keeps a determination current after the system it describes changes.

Meaningful explanation of outcomes

High-impact operators owe affected users an explanation of the outcome and the key criteria behind it. Request and response lineage is the control here: capture what was sent, which model and version served it, which policy revision governed the decision, and what came back. That produces a joined request and response record. An explanation written from configuration describes today's system, while one written from lineage describes the decision actually under question.

Prior notification of AI use

Operators must notify users in advance that a product or service uses AI, and failing that carries an administrative fine of up to KRW 30 million. Enforcement reuses the destination allowlist and log from the classification row for a different purpose: producing the authoritative list of AI features in production against which the notice gets reconciled. That reconciliation is the evidence, and it is where features shipped behind flags surface.

Generative AI content labelling

Labels attach to generative output, with a heightened notice requirement where sound, image, or video is difficult to distinguish from human-created content. Response-side policy evaluation is the control, applied to model output before it returns to the caller. Each evaluation writes a per-response record showing the labelling rule fired and what it produced, a materially stronger artifact than a screenshot of a label in a product surface.

Human intervention and supervision

High-impact operators must implement intervention and supervision mechanisms. A policy decision point with a fail-closed default is the control, so ambiguous or high-risk requests are held, escalated, or blocked in the path rather than reviewed after the fact. Each of those actions writes a record naming the rule and the resolver. Running the mechanism produces the documentation as a side effect, which collapses the supervision duty and the record-keeping duty into one build.

Documentation of trust and safety actions

MSIT asks for documentation of the actions taken to secure trust and safety. Write-path independence is the control: the record gets produced by a system the application making the AI call has no ability to modify or suppress. What that yields is an externally written, signed log. The property matters more under this statute than under most, because a domestic representative in Seoul answers MSIT while the logging code sits with an engineering team elsewhere, and AI audit log immutability is what makes the representative's answer stand up.

Personal data in the prompt

The Personal Information Protection Act keeps running alongside the AI Basic Act, and a single high-impact interaction in healthcare or hiring raises questions under both. Prompt-level classification evaluated before transmission is the control, tied to per-role policy so a caller whose role lacks a basis for health data gets blocked. Each evaluation leaves a per-request classification decision joined to the policy decision recorded against it, which is what prompt-level DLP produces at the moment of transmission rather than at rest.

The mapping at a glance

The two duties that sit outside this boundary

Two obligations are organisational and no request-path control satisfies them. The domestic representative designation is a legal appointment, triggered by annual revenue above KRW 1 trillion, AI service revenue above KRW 10 billion, or an average of one million daily Korean users over three months. The high-performance safety duty attaches to systems trained above 10^26 cumulative FLOPs and lands on model developers rather than on enterprises consuming hosted models.

My frank opinion: the Act's most demanding requirement is the one it never states. Obstructing or refusing an inspection is finable, while a genuine control gap discovered during the grace period draws a corrective order, which means the statute penalises slow answers harder than imperfect systems. Teams optimise for the control and leave the retrieval path untested until an inquiry arrives with a deadline attached.

DeepInspect

Each row above resolves to an enforcement point, and DeepInspect is that point. It sits inline between your users or agents and the LLM APIs they call, evaluates identity, prompt classification, and destination on every request, enforces per-role and per-route policy with a fail-closed default, applies policy to the response before it returns, and writes a signed record of the decision the application never had custody of.

For a Korean high-impact operator, that turns the classification, explanation, notification, labelling, and supervision rows from descriptions into running controls with a per-decision record standing behind each one. The audit evidence view covers what those artifacts look like under an MSIT inspection, and the ten-item checklist sequences the work. Book a technical deep dive at deepinspect.ai.