South KoreaAI Framework Act, Article 35 (impact assessment for high-impact AI)
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, User location
- Obligation class
- DPIA
- Audit expectation
- none
What it requires
- Endeavor to assess in advance, before you provide a product or service that uses high-impact AI, its effect on people's fundamental rights, and have the assessment reflect the characteristics of vulnerable groups of AI users.
- Where you carry out the assessment, cover the matters the Enforcement Decree lists: the individuals and groups likely to be affected, the types of fundamental rights engaged, the social and economic impact, how the AI is used, the metrics and method of producing results, measures to prevent, mitigate and recover from harm, and any improvement plan.
- If you are a state organ or similar body that intends to use a product or service built on high-impact AI, give priority consideration to one that has undergone an impact assessment.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 35 asks for an advance impact assessment of high-impact AI, and Article 28 of the Enforcement Decree lists what the assessment covers and lets the operator run it itself or commission a third party. Neither states a duty to create, keep or later produce a log or record.
- Kind
- None
- As of
What this law does
An AI business operator that provides a product or service using high-impact AI must endeavor to assess in advance the effect on people's fundamental rights. The duty to endeavor to assess took effect on , with the rest of the Act. The assessment must also reflect the characteristics of vulnerable groups of AI users, according to the nature of the product or service.
That sentence comes from an amending Act promulgated on , and took effect six months after promulgation. A state organ or similar body that intends to use such a product or service must give priority consideration to one that has undergone an impact assessment.
The Enforcement Decree requires the assessment to cover seven matters, among them the individuals and groups likely to be affected, the types of fundamental rights engaged, the metrics used, and measures to prevent, mitigate and recover from harm. The operator may carry out the assessment itself or commission a third party.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .