On January 22, 2026, South Korea became the world’s first country to fully implement its AI Basic Act[1]. Although the EU enacted its AI Act earlier, its high-risk AI regulations begin phased application in August 2026. South Korea is therefore the first to put a comprehensive AI law fully into practice.
[1] Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust, commonly called the AI Basic Act — promulgated in January 2025 and effective January 22, 2026.
Given the attention this issue has attracted, many others have already introduced the law’s overall provisions or criticized excessive regulation for obstructing innovation. I will take a different direction, identify two important gaps as I see them, and examine the broader paradigm of AI regulation.
🧩 Gap in the AI Basic Act (1) — identifying the actors
The first is confusion over who falls into which category. Article 2 defines artificial intelligence and several other concepts. The following are particularly noteworthy.
Article 2 (Definitions). The terms used in this Act mean the following. <Amended January 20, 2026.> 1. “Artificial intelligence” means the electronic implementation of human intellectual abilities, including learning, reasoning, perception, judgment, and language comprehension. ... 4. “High-impact artificial intelligence” means an AI system that may significantly affect or pose risks to human life, physical safety, and fundamental rights and is used in any of the following areas. (a. Supply of energy as defined in Article 2(1) of the Energy Act, etc.) ... 7. “AI business operator” means a corporation, organization, individual, state institution, etc., conducting business related to the AI industry and falling into one of the following categories: a. AI development business operator: a person developing and providing AI; b. AI utilization business operator: a person providing AI products or services using AI supplied by an operator under item a. 8. “User” means a person receiving AI products or services.
The precise distinction between artificial intelligence and high-impact artificial intelligence has already been widely questioned. I believe the distinction between business operators and users is even more important and difficult.
The law distinguishes AI operators from users, then subdivides operators into developers and utilization operators. It imposes substantial duties on operators, especially high-impact and generative AI operators, while excluding users who simply use AI from its regulatory scope.
The problem is that the AI industry blurs the boundary between operators and users. If a company develops generative AI itself and provides a loan-screening service, it is simultaneously a developer and utilization operator, and a generative AI and high-impact AI operator. With many businesses now building services by fine-tuning existing large language models (LLMs), this is no minor issue.
🧩 Gap in the AI Basic Act (2) — labeling requirements
The second is the limitation of labeling requirements. The Act broadly requires advance notification when providing products or services (paragraph 1), indication that output was generated by generative AI (paragraph 2), and notification or labeling for deepfake output difficult to distinguish from reality (paragraph 3). Specifically:
Article 31 (Duty to Ensure AI Transparency). (1) An AI business operator intending to provide a product or service using high-impact or generative AI shall inform users in advance that the product or service operates on such AI. (2) An AI business operator providing generative AI, or products or services using it, shall indicate that the resulting output was generated by generative AI. (3) When providing virtual audio, images, videos, or similar output difficult to distinguish from reality using an AI system, an AI business operator shall notify or label it in a manner enabling users clearly to recognize that it was generated by an AI system. Where the output is, or forms part of, artistic or creative expression, notification or labeling may be provided in a manner that does not impede its exhibition or enjoyment. (4) Matters necessary for the methods of advance notice under paragraph 1, labeling under paragraph 2, notification or labeling under paragraph 3, and their exceptions shall be prescribed by Presidential Decree.
The specific labeling methods appear not in the statute itself, but in Article 22 of the draft enforcement decree announced by the Ministry of Science and ICT in November 2025 and the subsequently released Guidelines for Ensuring AI Transparency.
Under these provisions, ordinary output, such as text and images, may use either visible indications that people can see or invisible machine-readable markings such as watermarks and metadata. If an invisible method is chosen, users must also be informed at least once, through text or voice, that the output was generated by AI. When output remains within the service, a UI notice or logo suffices, but markings must accompany output exported outside it. Deepfakes difficult to distinguish from reality, however, must be disclosed or labeled in a clearly recognizable way; hiding information in metadata alone is insufficient.
The problem is that this duty applies only to business operators providing services. The government’s rationale is to prevent public confusion caused by deceptive AI content, yet users who misuse AI and spread such content bear no responsibility. As discussed earlier, the Act excludes users. Even if operators label output, distributors can simply remove the labels. Can this law really protect the public? For example, I question how requiring ChatGPT to label an image “This image was generated by AI” meaningfully protects people’s rights and interests.
In my view, part of the problem may come from bundling generative AI labeling rules, aimed at identifying provenance, with high-impact AI rules, aimed at preventing accidents.
💡 Closing thoughts — from branding falsehood to authenticating truth
This is not simply a matter of the AI Basic Act being poorly drafted. It undoubtedly underwent considerable deliberation and review. The government has decided on a guidance period of at least one year, during which further improvements will surely be made.
Nevertheless, I believe the very approach of mandating labels stating that content was AI-generated or edited has fundamental limits.
Setting aside whether regulating the flood of all AI output is possible, my greatest concern is a counterproductive effect. The more mandatory and commonplace AI labels become, the more people may believe that anything without a label is genuine. They could become even more defenseless when malicious users remove labels and spread sophisticated fakes.
That is why I believe the direction must change. We should move beyond the exhausting task of branding fakes as false and shift toward attaching authenticity tags to unaltered originals. Rather than fixating on visible watermarks, encouraging metadata-based provenance standards such as C2PA and rewarding those who follow them seems a more practical way to build digital trust amid a flood of fakes.
As noted earlier, the AI Basic Act is in force but currently in its guidance period. Breaching labeling duties can lead to corrective orders and, for continued noncompliance, administrative fines of up to KRW 30 million, but actual imposition is deferred for a time. Compared with the EU AI Act’s maximum penalties of 7% of global revenue, South Korea’s sanctions are close to the earliest yet lightest in the world. This makes it all the more important that the guidance period be used to revisit structural questions, rather than simply postpone punishment. Being first in the world is valuable, but does not itself guarantee a good system. I will watch that year to see whether the earliest starter can also show the best path.
#BetweenRulesAndTech #AIBasicAct #GenerativeAI #LabelingRequirements #C2PA #DigitalTrust