Makes health care decisions, in South Korea

Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024) · Read the law's page

• Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.
• A person who operates an information and communications network, a provider of information and communications services included, must analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay (Article 48-4(1)).
• Preserve data when the Minister of Science and ICT orders it, and submit on the Minister's demand the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable, and failing to preserve data after an order to do so is a criminal offense (Article 73, item 6).
• The reporting and data duties below bind a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating these duties; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here. The cause-analysis duty in Article 48-4(1) reaches any person who operates an information and communications network, a provider included.

Act No. 10465 (as amended by Act No. 19234, 2023), Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Arts. 44-2 to 44-4 · Read the law's page

• An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.

Act No. 20676, Article 34 · Read the law's page

• Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
• If you provide high-impact AI, or a product or service that uses it, establish and operate a risk-management plan for it.
• Establish and carry out a plan to explain, so far as technically feasible, your AI's final output, the main criteria it used to reach that output, and an overview of the training data you used to develop or use it.
• Establish and operate a plan to protect the users of your high-impact AI.
• Provide human management and supervision of your high-impact AI.
• Prepare and keep documents that confirm the content of the measures you took to secure your AI's safety and reliability.
• Post the main content of your risk-management plan, your explanation plan, and your user-protection plan, and the name and contact details of the person managing and supervising your high-impact AI, at your place of business or on your website.
• Keep that documentation, and the basis for it, for five years, including in electronic form.

Act No. 20676, Article 35 · Read the law's page

• Endeavor to assess in advance, before you provide a product or service that uses high-impact AI, its effect on people's fundamental rights, and have the assessment reflect the characteristics of vulnerable groups of AI users.
• Where you carry out the assessment, cover the matters the Enforcement Decree lists: the individuals and groups likely to be affected, the types of fundamental rights engaged, the social and economic impact, how the AI is used, the metrics and method of producing results, measures to prevent, mitigate and recover from harm, and any improvement plan.
• If you are a state organ or similar body that intends to use a product or service built on high-impact AI, give priority consideration to one that has undergone an impact assessment.

Act No. 20676, Article 36 · Read the law's page

• If you have no address or business office in Korea and meet one of the Enforcement Decree's thresholds (prior-year revenue of KRW 1 trillion or more, prior-year AI-service revenue of KRW 10 billion or more, an average of 1,000,000 or more daily Korean users over the last three months of the prior year, or a past fine for ignoring a stop or correction order under the Act), designate a domestic representative in writing and report the designation to the Minister of Science and ICT.
• Choose a representative that has an address or business office in Korea.
• Authorize the representative to submit your Article 32(2) results, to request the Minister's confirmation that your AI is high-impact, and to support your Article 34(1) safety and reliability measures, including checking that the documents are current and accurate.