South KoreaAI Framework Act, Article 34 (business-operator duties for high-impact AI)
In force since .
An AI risk obligations rule binding public and private bodies.
- Enforcement body
- Minister of Science and ICT
- How the hook was established
- express
- What makes it apply
- Market targeting, User location
- Obligation class
- Governance, Disclosure, Retention
- Audit expectation
- none
What it requires
- Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.NIST AI RMFMAP 3.3
- If you provide high-impact AI, or a product or service that uses it, establish and operate a risk-management plan for it.NIST AI RMFGOVERN 1.4
- Establish and carry out a plan to explain, so far as technically feasible, your AI's final output, the main criteria it used to reach that output, and an overview of the training data you used to develop or use it.NIST AI RMFMEASURE 2.9
- Establish and operate a plan to protect the users of your high-impact AI.NIST AI RMFMANAGE 1.3
- Provide human management and supervision of your high-impact AI.NIST AI RMFMAP 3.5
- Prepare and keep documents that confirm the content of the measures you took to secure your AI's safety and reliability.NIST AI RMFMEASURE 2.6
- Post the main content of your risk-management plan, your explanation plan, and your user-protection plan, and the name and contact details of the person managing and supervising your high-impact AI, at your place of business or on your website.NIST AI RMFGOVERN 4.2
- Keep that documentation, and the basis for it, for five years, including in electronic form.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
1 more
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
1 more
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
What the log must hold
Output reference, Decision basis, Data lineage, Human involvement, Actor identity
Log retention
Enforcement Decree Article 27(2).
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Article 34(1)(5) requires the operator to prepare and keep 문서 (documents) confirming the content of the measures it took, and Enforcement Decree Article 27(2) sets a 5-year retention period for that documentary basis. Neither uses the words logs, records, event recording or audit trail; a required document that must be prepared, kept and be able to confirm compliance is the implicit category's own shape (compare the EU AI Act's Article 53(1)(a) technical documentation, which has the same shape). Decree Article 27(1) separately requires posting the main content of the Article 34(1) items 1 through 4 plans; that posting duty does not extend to the item-5 confirming documentation, which Article 27(2) requires only to be kept.
- Kind
- Implicit
- As of
- Provision
- Article 34(1)(5)
- Trigger
- high_risk_systems
What this law does
Article 34 binds an AI business operator providing high-impact AI, or a product or service that uses it, and requires it to establish and operate a risk-management plan, to establish and carry out a plan explaining the AI's final output and the main criteria and training-data overview behind it so far as technically feasible, to establish and operate a user-protection plan, to provide human management and supervision of the AI, and to prepare and keep documents confirming those measures.
The Ministry of Science and ICT sets the specific content of those measures by public notice and may recommend that operators comply, and an operator that has already taken equivalent measures under another statute is treated as having complied.
The Enforcement Decree requires the operator to post the main content of the risk-management, explanation and user-protection plans, and the name and contact details of the person supervising the high-impact AI, at its place of business or on its website, and to keep the supporting documentation, including in electronic form, for five years.
High-impact AI is defined by what the AI is used for rather than by what the operator is, covering energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education.
Article 33 separately requires an operator to review in advance whether its AI is high-impact, and lets it ask the Ministry to confirm that answer. Article 34 took effect on , with the rest of the Act.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .