AI Framework Act, Article 34 (business-operator duties for high-impact AI)

Act No. 20676, Article 34

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 8 months, effective 22 January 2026.

An AI risk obligations rule binding public and private bodies.

As of 20 September 2026.

What it requires

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
If you provide high-impact AI, or a product or service that uses it, establish and operate a risk-management plan for it.
Establish and carry out a plan to explain, so far as technically feasible, your AI's final output, the main criteria it used to reach that output, and an overview of the training data you used to develop or use it.
Establish and operate a plan to protect the users of your high-impact AI.
Provide human management and supervision of your high-impact AI.
Prepare and keep documents that confirm the content of the measures you took to secure your AI's safety and reliability.
Post the main content of your risk-management plan, your explanation plan, and your user-protection plan, and the name and contact details of the person managing and supervising your high-impact AI, at your place of business or on your website.
Keep that documentation, and the basis for it, for five years, including in electronic form.

Who enforces it

Enforcement body

Minister of Science and ICT

What it reaches

Obligation class

Governance, Disclosure, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 34 binds an AI business operator providing high-impact AI, or a product or service that uses it, and requires it to establish and operate a risk-management plan, to establish and carry out a plan explaining the AI's final output and the main criteria and training-data overview behind it so far as technically feasible, to establish and operate a user-protection plan, to provide human management and supervision of the AI, and to prepare and keep documents confirming those measures.

The Ministry of Science and ICT sets the specific content of those measures by public notice and may recommend that operators comply, and an operator that has already taken equivalent measures under another statute is treated as having complied.

The Enforcement Decree requires the operator to post the main content of the risk-management, explanation and user-protection plans, and the name and contact details of the person supervising the high-impact AI, at its place of business or on its website, and to keep the supporting documentation, including in electronic form, for five years.

High-impact AI is defined by what the AI is used for rather than by what the operator is, covering energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education.

Article 33 separately requires an operator to review in advance whether its AI is high-impact, and lets it ask the Ministry to confirm that answer. Article 34 took effect on January 22, 2026, with the rest of the Act.

When LexLint raises it

high_risk_decisions
processes_biometrics

Read the law

official statute portal, National Law Information Center (law.go.kr)
full article text obtained at the browser-render tier after the compliant tier served only a navigation shell, cross-checked against the Enforcement Decree's own Article 27 posting and retention rules

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app