South KoreaAI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)
In force since .
An AI governance rule binding public and private bodies.
- Enforcement body
- Minister of Science and ICT
- How the hook was established
- express
- What makes it apply
- Market targeting, User location
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.NIST AI RMFMAP 5.1NIST AI RMFMANAGE 1.3
- Build a risk-management system that monitors and responds to AI-related safety accidents involving your system.NIST AI RMFMANAGE 4.3
- Submit the results of implementing those two measures to the Ministry of Science and ICT, in the form and manner the Ministry sets by public notice.NIST AI RMFGOVERN 4.2
- The Act states no duty to report a particular safety accident to the Ministry, and no period running from the moment you become aware of one.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
- NIST AI 600-1
- GAI-RISK-09Information Security
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Article 32 never uses the words logs, records, event recording or audit trail; it requires the operator to identify, assess and mitigate risk across the AI system's life cycle, build a risk-management system that monitors and responds to safety accidents, and submit the results of implementing those two measures to the Ministry of Science and ICT. None of that can be shown without keeping some documentation of what was done, which is the implicit category's own test. Neither Article 32 nor its Enforcement Decree Article 24 names the record's contents, states how long it must be kept, or grants anyone a right to demand it beyond the one-time submission itself; Article 40's fact-investigation power, triggered by a suspected violation, sits in a different article.
- Kind
- Implicit
- As of
- Provision
- Article 32(1)-(2)
- Trigger
- high_risk_systems
What this law does
Article 32 binds an AI business operator whose AI system was trained using cumulative compute at or above the threshold the Presidential Decree sets, and requires it to identify, assess and mitigate risk across the system's full life cycle and to build a risk-management system that monitors and responds to AI-related safety accidents. The operator must submit the results of implementing those measures to the Ministry of Science and ICT.
The Ministry sets the specific implementation method, and the manner of submitting those results, by public notice, matters the Act itself does not state. The Decree's threshold is met only where cumulative training compute reaches 10^26 floating-point operations or more, the system applies the most advanced AI technology currently in use, and its risk could broadly and seriously affect people's life, physical safety and fundamental rights.
Article 32 took effect on , one year after the Act's promulgation. The submission is a periodic report of having that internal system in place rather than a notice triggered by a particular accident, and neither the Article nor the Decree states a period running from the moment an operator becomes aware of one.
When LexLint raises it
When your app profile says your app trains models or generates content with AI.
Back to the example · Lint your app
Page updated .