Framework Act on the Development of Artificial Intelligence and Establishment of Trust

At a glance

Read from the site’s regulatory clock, the record that is re-verified against primary law, as of 19 September 2026.

Instrument

Framework Act on the Development of AI and Establishment of Trust (AI Basic Act) — Binding law (for the actor it names)

Applies?

Applies since 22 January 2026 — in application as of 19 September 2026

Responsible actor

AI business operator placing a high-impact system on the Korean market.

What Provael measures toward it

Adversarial-robustness evidence for a high-impact AI system's risk-management and human-oversight documentation.

What that does not establish

No Korean conformity or registration position; not legal advice.

Source and review

Primary source · verified 19 September 2026

What a Provael report can be used for

Art. 34(1)1

Establishment and operation of a risk management plan — a plan needs a threat catalogue with rows in it, and a rate per row with a denominator rather than a qualitative likelihood.

Art. 34(1)4

Human management and supervision of high-impact AI — a supervisor has to be told what they are supervising for. A measured envelope-exit rate under adversarial instruction is evidence of what the policy does under an instruction it was not trained for.

Art. 34(1)5

Preparation and storage of documents that demonstrate measures taken to ensure AI safety and reliability — a run report bound to its execution manifest by digest is one such document, for one such measure.

The evidence

• The Embodied AI Security Top 10 as the named threat catalogue for a high-impact physical-AI system, so the Art. 34(1)1 risk-management plan starts from a set rather than a blank page.
• An envelope-exit rate per risk with its 95% Wilson interval and its benign-FPR control, stated under the run's predicate (calibrated, or the documented default - the report says which), as adversarial input to that plan and to the Art. 34(1)5 document set.
• Action-space integrity (EAI04) as the on-point evidence under Art. 34(1)4: what the commanded motion does when the instruction channel is attacked is what a human supervisor is there to catch.
• Floor results alongside: families that were tested and did not separate from the benign control are reported at their own counts, so the record does not contain only the risks that happened to fire.

It also maps to

Art. 32

The lifecycle safety duty binds only where cumulative training compute meets the threshold the Enforcement Decree sets, reported as 10²⁶ FLOPs. Above it the operator identifies, assesses and mitigates risk across the lifecycle and submits the results to the Minister of Science and ICT. Out of scope for essentially every open VLA policy, which sit many orders of magnitude below it.

Art. 35

Operators of high-impact systems “shall make efforts to assess in advance the impact on basic human rights”, and national institutions must prefer products that have had one. An effort duty, not a gate.

What it cannot be used for

A mapping identifies possible relevance. It does not establish that this framework applies to your product, that anything here is compliance, that an assessor or insurer will accept it, or a real-world risk probability. Whether it applies to your product depends on your role, market and product class: a question for your counsel, not a determination this page makes.

• Stop, interruption and rollback are NOT in Art. 34. We checked the Act’s own text and they do not appear there as operator duties; the Act’s only shutdown reference is Art. 13(2)2, a government R&D support provision pointing at a different statute. Even where a deployment does owe such a mechanism, it is a system-design duty over the deployed system: a red-team run produces evidence about the policy, not about the e-stop, and Provael exercises the policy, not the stop.
• The measured headline result behind all of this stands on one policy and one suite.
• Simulation evidence for the tested checkpoint and protocol. Physical safety and conformity require separate assessment.
• Provael measures adversarial robustness - susceptibility to manipulation - not general accuracy, reliability, or functional safety.
• The measured result uses templated, auditable attacks; the search-based families (optimized, universal_patch, gradient_patch) have no real-policy rate. Results are a floor on susceptibility - a behavioural lower bound, not a certified worst-case bound.
• Provael’s own Embodied AI Security Top 10 is an independent taxonomy maintained by Provael, not one of the instruments on this page; a mapping onto it is a categorisation, not a legal or standards requirement.

The framework

• The first enforceable comprehensive AI statute outside the EU, and a framework statute, not a product-certification regime. It sets duties on the AI business operator and leaves the numeric thresholds and procedural detail to its Enforcement Decree.
• Its reach is sectoral, not “any physical machine”. Art. 2(4) makes a system high-impact only where it is used in an enumerated area: energy supply, drinking-water production, health care, medical devices, nuclear facilities, biometrics for criminal investigation, employment and loan assessment, transport operation, public-body decisions, or school assessment. A VLA policy is inside this Act when it is deployed into one of those. A general warehouse or factory arm is not enumerated, and reading the Act as covering every robot overstates who has to care.
• It applies extraterritorially. Art. 4(1): “This Act shall apply to acts conducted abroad that affect the domestic market or users in the Republic of Korea.” An operator outside Korea over the Decree’s user and revenue thresholds must also appoint a domestic representative and report them to the Minister of Science and ICT (Art. 36).
• Art. 33 puts the first move on the operator: an operator providing AI-based products or services “must review in advance whether the AI in question qualifies as high-impact AI”, and may ask the Minister to confirm it. Nobody classifies the system for you.

Dates (clock entry last verified 19 September 2026; each line shows when it was checked)

Promulgated

21 January 2025Act No. 20676 (checked 19 September 2026)

In force

22 January 2026Addenda Art. 1, “one year after the date of its promulgation”; the digital-medical-device part of Art. 2(4)(d) from 24 January 2026 (checked 19 September 2026)

Administrative fines

Art. 43, up to 30 million wonThe Act defers nothing: we read the Addenda and there is no provision postponing the penalty articles. A one-year grace before fines are imposed is reported as an MSIT enforcement-policy announcement rather than a statutory deferral, which would put first exposure in early 2027. Reported, not confirmed against a primary source (checked 12 September 2026)

Check the live EUR-Lex or ISO text before relying on a date.

Primary references

• Act No. 20676 (Korean Law Information Center)
• Archived Korean source text (perma.cc)
• CSET English translation of the Act — the text quoted above