Trains models, in South Korea

Copyright Act of the Republic of Korea, Arts. 4, 16, 18, 20, 22, 101-2, 101-4, 101-5, 123, 125 and 136 · Read the law's page

• Treat a computer program work as a work the Act protects (Article 4(1)(9)); the Act does not protect the programming language, protocol or algorithm used to prepare a program (Article 101-2).
• Obtain the author's permission to reproduce a work, transmit it in public, distribute its original or copy, or produce and use a derivative work based on it (Articles 16, 18, 20 and 22).
• If you use a program with legitimate authority and cannot easily obtain the information needed for compatibility, you may decompile its program codes without the rights holder's permission, limited to the part necessary for compatibility, and you may not use the information obtained for another purpose, provide it to a third party, or build substantially similar programs from it (Article 101-4).
• If you possess and use a copy of a program with legitimate authority, you may reproduce the copy to the extent necessary to provide against its destruction, damage or deterioration (Article 101-5(1)).
• Expect to be asked to stop an infringing act and, where the infringement was intentional or negligent, to answer for damages; the profit you gained is presumed to be the damages sustained (Articles 123(1) and 125(1)).
• Infringing author's economic rights by reproduction, performance, public transmission, exhibition, distribution, rental or production of derivative works is punishable by imprisonment with labor for up to five years or a fine not exceeding 50 million won, or both (Article 136(1)(1)).

Copyright Act of the Republic of Korea, Arts. 2(28) and 104-2 · Read the law's page

• Do not, without proper authority and intentionally or negligently, remove, alter or bypass a technological protection measure that the right holder, or a person with the right holder's consent, has applied to effectively prevent or deter access to a work protected by the Copyright Act, unless one of the exceptions in Article 104-2, paragraph 1 applies.
• Do not manufacture, import, distribute, transmit, sell, rent, offer to the public, advertise for sale or rental, or hold for distribution a device, product or part, or provide a service, that is promoted for neutralizing a technological protection measure, has only a limited commercial purpose or use other than neutralizing it, or is mainly designed, made or adapted to enable or facilitate neutralizing it.

Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024) · Read the law's page

• Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.
• A person who operates an information and communications network, a provider of information and communications services included, must analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay (Article 48-4(1)).
• Preserve data when the Minister of Science and ICT orders it, and submit on the Minister's demand the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable, and failing to preserve data after an order to do so is a criminal offense (Article 73, item 6).
• The reporting and data duties below bind a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating these duties; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here. The cause-analysis duty in Article 48-4(1) reaches any person who operates an information and communications network, a provider included.

Personal Information Protection Act (Act No. 10465, as amended by Act No. 19234), Art. 15(1)(6) · Read the law's page

• Collect and use personal information without consent on this ground only where it is necessary to attain your legitimate interests and those interests are manifestly superior to the data subject's rights.
• Keep that processing substantially related to your legitimate interests and within a reasonable scope.

Unfair Competition Prevention and Trade Secret Protection Act (Act No. 21065, as amended), Art. 2(1)(ka), (pa) · Read the law's page

• Do not acquire data by theft, fraud, unauthorized access, or other wrongful means, or use or disclose data acquired that way.
• Do not use, disclose, or provide to a third party, beyond a contractual access limit and for wrongful profit or to harm the data holder, data you accessed under that limit.
• Do not create, provide, or distribute a technology or device whose main purpose is to circumvent a technical measure protecting data.
• Separately, do not use the outcome of another person's substantial investment or effort for your own business, in a manner contrary to fair commercial practice, without authorization.

Act No. 20676, Article 32 · Read the law's page

• If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
• Build a risk-management system that monitors and responds to AI-related safety accidents involving your system.
• Submit the results of implementing those two measures to the Ministry of Science and ICT, in the form and manner the Ministry sets by public notice.
• The Act states no duty to report a particular safety accident to the Ministry, and no period running from the moment you become aware of one.

Act No. 20676, Article 36 · Read the law's page

• If you have no address or business office in Korea and meet one of the Enforcement Decree's thresholds (prior-year revenue of KRW 1 trillion or more, prior-year AI-service revenue of KRW 10 billion or more, an average of 1,000,000 or more daily Korean users over the last three months of the prior year, or a past fine for ignoring a stop or correction order under the Act), designate a domestic representative in writing and report the designation to the Minister of Science and ICT.
• Choose a representative that has an address or business office in Korea.
• Authorize the representative to submit your Article 32(2) results, to request the Minister's confirmation that your AI is high-impact, and to support your Article 34(1) safety and reliability measures, including checking that the documents are current and accurate.

Act No. 21910 (2026), Personal Information Protection Act, Arts. 28-12 to 28-15 · Read the law's page

• To use personal information you lawfully collected in Korea for AI development or performance improvement beyond the purpose you collected it for, obtain the Personal Information Protection Commission's deliberation and resolution first, showing that anonymous or pseudonymous processing would make the development difficult, that you have the safeguards the Enforcement Decree sets, and that the development serves the public interest or protects data subjects' or third parties' interests with a markedly low risk of unjustly harming them (Article 28-12(1) and (2)).
• Where the Commission requires it because of sensitive or unique identification information or the effect on data subjects, carry out a risk-factor assessment and submit the result before the Commission deliberates (Article 28-12(3)).
• State the purpose and type of this use in your privacy policy (Article 28-12(5)).
• Meet the conditions the Commission attaches, and provide the data it requests to supervise the use (Articles 28-12(2) and 28-13(2)).
• If the Commission restricts your processing, take the necessary measures without delay and report the result to the Commission (Article 28-14(2)).