The discourse over AI in South Korea (“Korea”) mainly revolves around two areas:

• the legality of processing publicly available personal information for artificial intelligence learning in light of data privacy concerns; and
• the potential copyright infringement when using such data.

Discussions on AI in other areas remain relatively undeveloped.

AI and machine learning are leading innovation in various industries including the medical, financial and manufacturing sectors, and their influence continues to expand. For example, financial institutions are applying AI in the areas of customer service, asset management and investment advice.

AI technology has demonstrated its prowess across various everyday situations, including providing personalised services by analysing consumer data through machine learning, improving business response times through business process automation, and operating chatbots based on generative AI. In addition, financial institutions are using AI to improve the efficiency of their employees’ work evaluating customer credit. Platform companies are also providing optimised user interfaces by providing customised advertising based on users’ search records and improving internet search engine accuracy through AI.

Under the Act on Restriction on Special Cases Concerning Taxation, AI-related technologies have been designated as new growth source technologies, and tax credits have been granted for investment in research and development activities concentrating on AI.

Recently, discussions have begun to expand tax exceptions for AI services, including granting tax benefits to investment in facilities for the provision of AI services.

In Korea, there is ongoing discussion over whether it is necessary to enact any general regulatory legislation on AI, similar to the EU’s AI Act for example. There are proponents calling for legislation to address AI risks, while others argue that AI is still in the early stages of its development and that it is therefore too early for effective regulation to be passed.

No regulatory legislation specific to AI has been enacted.

In the absence of an AI-specific piece of legislation in Korea, the following non-binding guidelines have been promoted by regulators/government bodies:

• The Korea Communications Commission (KCC), which is a regulatory body in the broadcasting and telecommunications fields, focusing on user protection, published guidelines in 2019 to encourage AI development that ensured the protection of users based on the principles of accountability, non-discrimination and transparency.
• The Ministry of Science and ICT (MSIT), which is in charge of encouraging policies for the development of new technology in the ICT industry, announced a set of ethical standards for AI in 2021, whereby it identified ten principles for managing AI, such as protection of human rights, protection of privacy and respect for diversity.
• The Financial Services Commission (FSC) issued, in 2022, its detailed policy guidelines on development and utilisation of AI in the financial sector, setting forth various factors to be considered when developing and using AI.
• The Personal Information Protection Commission (PIPC) announced, in 2023, its policy direction for safe use of personal information in the era of AI, which includes the principles for processing of person information at each stage of AI development and service. The PIPC is expected to announce more detailed guidelines for 2024.

This is not applicable in Korea.

The Personal Information Protection Act has been amended to introduce the data subject’s right not to be subject to an entirely automated decision, similar to the automated decision-making right in the European GDPR, which will become effective from 15 March 2024.

Furthermore, the amended Personal Information Protection Act includes provisions for individuals to request explanations or human review of automated decisions, as well as the ability to reject such decisions if they materially affect their rights and obligations as data subjects.

Furthermore, the amended Personal Information Protection Act has been designed to secure transparency and enhance credibility in the processing of personal information by mandating disclosure of the criteria and procedures for automated decisions in advance.

The MSIT and the KCC are currently preparing a basic law on AI and a user protection law. In parallel, the 22nd National Assembly, which will commence its session in June 2024, is expected to hold a comprehensive discussion on the regulatory issues of AI.

No significant precedents in this area have been found.

The Seoul Administrative Court’s 2022GuHap89524 judgment, dated June 20 2023, states that “artificial intelligence (AI) is defined as a technology that realises the human brain functions, such as human perception, judgment, inference, problem-solving, and the language, behavioural instruction, and learning functions resulting therefrom, through a computer”.

The AI definition in the above judgment is broad and abstract, and both generative AI and predictive AI are within the scope of “realising human brain activities through a computer”. It is unclear at this stage whether the definition will separately affect or restrict generative AI and/or predictive AI.

The MSIT is trying to lead the way in regulating AI technologies. However, there is an opinion that the Ministry is not suited to supervising business enterprises by regulating AI technologies. This is because the nature of the MSIT’s general work tends to be friendly and supportive of new businesses. Despite the controversy, as other agencies are not actively pursuing the enactment of general legislation on artificial intelligence, the MSIT is likely to continue to take the initiative for the time being.

Setting aside the government agencies that are responsible for drafting AI regulatory policies, the PIPC is the most active government agency in regulating AI-related issues.

There are no widely referenced definitions of AI used by regulators, as Korean regulators are still in the early stages of discussing AI regulations. The AI discussion in the 22nd National Assembly (mentioned in 3.7 Proposed AI-Specific Legislation and Regulations) is likely to include the definition of AI. The previous bill by a lawmaker Cheol-Soo Ahn, which was disposed of at the end of the 21st National Assembly session, describes AI as "software for the electronic realization of human intellectual abilities such as learning, perception, judgment, and understanding of natural language" and defines the scope of AI broadly to ensure that generative AI is included.

All government agencies prioritise the protection of human dignity, consumer rights and privacy as their main regulatory objectives. However, each regulatory agency’s priorities may be different depending on its objectives. The Korea Communications Commission, the Financial Services Commission, and the PIPC focus on protecting the privacy of telecommunications users, financial consumers, and the general public, respectively.

In 2024, the PIPC listed precautions to be taken when using publicly available personal information. This was released after the Commission conducted an inspection on AI service providers in 2023. These results will be included in the guidelines for the use of AI for personal information, which is scheduled to be published in 2024.

The Korea Fair Trade Commission has investigated the business practices of mobility and advertising business operators from the perspective of the fairness of algorithms.

The Telecommunication Technologies Association (TTA), an affiliated agency of the Korea Communications Commission, issued an artificial intelligence development guide in 2023.

The Financial Security Institute, an affiliated agency of the Financial Services Commission, has published AI security guidelines.

Generally, the Korean Standards Association plays an important role in adopting international standards.

The Presidential Committee of Digital Platform Government has presented a draft policy that suggests the use of AI in various sectors of society. This draft policy is based on the government’s plan for realising digital platform government, which is one of the government’s policy objectives. This includes:

• digitalisation of records in AI-readable form;
• establishment of a mega AI infrastructure as the top-level integration platform for the digital platform government;
• establishment of an AI and big data-based forecast model for emergencies (fires, explosions, etc);
• use of public government documents for AI learning and support for the preparation of documents using AI; and
• introduction of AI-based digital textbooks for primary and secondary schoolers.

Facial recognition technology has been in use in the immigration process and has simplified the process significantly.

Since June 2023, the Gyeonggi municipal government has been implementing an “AI chat service”, which is an active welfare service in which an AI counsellor makes a phone call once a week to elderly persons (65 and older) who are in need of care in the area. The purpose of the call is to check in on the elderly by engaging in conversation and monitoring their health and life. The person in charge directly makes a phone call or visits their residence if there is no answer to the phone call three times or more.

There have been no judicial decisions related to government use of AI.

The Republic of Korea Armed Forces have been developing an AI model to predict the demand for repair parts for each of the approximately 30,000 types of equipment in operation in the military, by establishing a team to analyse the demand for repair parts within the Korean Institute for Defence Analysis, since January 2012.

In addition, the Republic of Korea Armed Forces plan to introduce AI technology prioritising defence logistics, such as AI-based smart maintenance, smart factories, and smart warehouses.

In addition, on 1 April 2024, the Ministry of National Defence established an AI centre for national defence to carry out President Yoon’s government project of “cultivating AI science and technology forces”.

Since the emergence of generative AI, there has been controversy over the protection of IP addresses and personal information.

If the training data used for AI learning consists of works produced by others, such works are subject to copyright protection. Unless the copyright holder approves the use of the work in the model learning process, there is a risk of copyright infringement. If a prompt is entered for the creation of an AI product, that prompt may be recognised as a creative expression per se. Accordingly, it may be subject to the copyright protection as a type of literary work. On this point, the courts will look into the specific prompts of each case.

Under the current legal frame, the end result of an AI’s work is unlikely to be recognised as a work product, which makes it difficult to be protected under the copyright law. However, if any AI-created product is substantially similar to any work of another person, a copyright infringement may be recognised.

An AI model can be protected through patents for its novelty and advancement. In such a case, the source code for realising the AI model can be protected as the computer program works. If an AI tool provider restricts the input method for using the generative AI tools in question, and also restricts the method of using the product through the service terms and conditions, to prevent infringement of intellectual property rights in the course of using the AI services, any user who fails to comply with such restrictions may be held liable for a breach of the terms and conditions.

The PIPC is expected to issue guidelines on the use of publicly available personal information for the development of AI. The Commission believes that the data subject’s right to deletion and to rectification must be protected with regard to AI. Moreover, the Personal Information Protection Act has been amended to introduce the data subject’s right to object to an automated decision.

The use of AI in private enterprises has been quite limited so far. Only a few companies or law firms have commenced or plan to commence using AI to providing legal services (except translation).

However, a medium-sized law firm in Korea introduced, on 20 March 2024, an AI-based legal counselling chatbot service in collaboration with Naver Cloud and Nexus AI (a legal tech venture company). Also, a legal tech company is preparing to launch an AI-based software-as-a-service (SaaS) called “SuperLawyer”, and LBOX is also developing a legal AI service, “LBOX AI”.

The Prosecutor’s Office and the Supreme Prosecutor’s Office are planning to develop a service that recommends court records of similar cases. It is currently being developed as part of the next generation Korea Information System of Criminal Justice Services (KICS) project, as of the second half of 2024.

Using this service the Prosecutor’s Office anticipates reducing its workload by using the AI to search for similar cases, summarise the investigation information, get sentencing recommendations in document drafting, extract key information from evidence, generate relevant questions for the investigation, identify missing information, and transcribe conversations.

The courts plan to apply an automatic judgment recommendation AI model within the next-generation electronic litigation system, which is scheduled to be launched in September 2024. The AI model has the function of recommending the ten most similar cases by analysing the complaints, briefs and memoranda filed in the cases assigned to the court.

There is no debate yet on the liability for damages resulting from AI-enabled technologies. If an AI service provider pinpoints that the consumer is ultimately responsible for their decisions to use the AI and the following consequences in the terms and conditions of the service, the fairness of such terms and conditions may be assessed by the relevant government authorities, such as the Korea Fair Trade Commission.

The pending bill proposed by the lawmaker Cheol-Soo Ahn (see 3.7 Proposed AI-Specific Legislation and Regulations) specifies that if damages occur due to AI-enabled technologies that are categorised as high risk, and the company fails to perform its obligations in its use of the technology, in principle, the liability for damages shall be imposed on the company. However, the company may not be liable if such damage would have occurred even if the company had performed all its obligations.

The various guidelines outlined in 3.3 Jurisdictional Directives provide guidance that fairness should be maintained in the development and use of AI. In addition, the Financial Services Commission’s guide stipulates that a fairness indicator must be imposed on the process of developing and using an AI technology to assess and maintain fairness.

Financial institutions are preparing a fairness indicators to assess the fairness of their AI-enabled services in accordance with the guidelines. Audits on those services will include a fairness test accordingly. Institutions in other sectors are not known to be taking any particular actions to ensure the fairness of their AI-enabled services.

The amended Personal Information Protection Act ensures the data subject’s right to object to an automated decision. In addition, the PIPC will publish guidelines on the elements that should be considered for the protection of personal information in the use of AI.

The Ministry of Justice has streamlined the immigration process using facial recognition technology However, no other department has yet announced any plan to adopt facial or biometric information for its services.

Meanwhile, the National Human Rights Commission of Korea has recommended using biometric information for employees attendance management, which is increasingly adopted by private enterprises.

The amended Personal Information Protection Act ensures the data subject’s right to object to an automated decision.

The guidelines of each agency highlight transparency as a principle in developing and using AI. The most detailed content on this subject can be found in the PIPC’s guideline on automated decision-making under the amended Personal Information Protection Act.

Although the Commission finds it unnecessary to explain the specific operation method of the algorithm to the data subject, it requires the individual variables in artificial intelligence to be disclosed.

Although there have been theoretical discussions about the possibility of price discrimination or price fixing using AI technology, there has not been any specific investigation or regulation by the relevant authority, the Korea Fair Trade Commission. The Commission has initiated the work to publish a report on the AI market by the end of 2024, through which the Commission will examine whether there is any issue, such as algorithmic collusion or disadvantage for content providers.

As explained in 7.3 National Security, AI systems for demand forecasting are being introduced in the procurement sector (specifically, military procurement).

The introduction of AI is not being discussed in earnest with respect to the management of labour relations. Some early discussions are in progress around using AI for job interviews, but such interviews will be used only as an additional tool for hiring, in conjunction with more traditional methods.

Many companies have adopted an attendance management system using biometric authentication information, but there has been no discussion on the introduction of AI in employee performance evaluation.

Platform companies are making significant use of recommendation algorithms that use AI. They are most commonly used to provide personalised services based on the user’s behavioural information.

Financial companies are actively utilising or trying to utilise AI in providing customer consulting and support services, calculating credit ratings, designing insurance products, managing assets and risks, and detecting abnormal transactions and money laundering.

In particular, as chatbot services become more sophisticated with the advances made by generative AI, many financial companies are providing customer consulting and support services using chatbots, and AI is increasingly being used for asset management and personalised marketing purposes.

As the use of AI increases, the risks for financial institutions are also increasing. For instance, as the number of investment product transactions using AI increases, there is a possibility that a large number of unintended orders are placed all at once due to algorithm errors, which will increase market volatility. In addition, there is a possibility that financial companies may sell products that are not suitable for customers or fail to properly perform their obligations to explain while utilising AI for product recommendation.

Currently, there is no separate regulation relating to the use of AI by financial companies. However, the Korean financial supervisory authorities have announced AI guidelines (and AI security guidelines) in the financial sector to ensure that financial companies using AI technology protect financial consumers’ rights and take responsibility for their services.

In particular, the AI guidelines in the financial sector require financial companies to prevent unreasonable discrimination against consumers. Accordingly, financial companies should establish fairness standards based on the characteristics of services and conduct evaluations based on certain standards to prevent the possibility of unexpected discrimination that may occur due to AI-enabled services.

Big data analytics platforms based on video information are gaining traction as an important trend in healthcare. Non-medical institutions are required to receive data from medical institutions, but there are many challenges in obtaining such data. For example, medical institutions tend to be cautious about providing medical data and there are many legal regulations in this area. To resolve this issue, the government is proceeding with special legislation for healthcare data.

There is no general regulation governing the use of AI in autonomous vehicles. Provided, however, that certain laws prescribe matters relating to autonomous vehicles. First of all, with respect to liability in the event of an accident, the Compulsory Motor Vehicle Liability Security Act provides measures to seek reimbursement against the manufacturer in the case of any defect in the vehicle while maintaining the existing drivers’ liability, and to establish an accident investigation committee to investigate the autonomous driving data recording device affixed to the autonomous vehicle. Meanwhile, the Rules on Safety and Performance of Motor Vehicles and Motor Vehicle Components (Motor Vehicle Safety Standards), sub-regulations of the Motor Vehicle Management Act, have safety standards for Level 3 autonomous driving systems.

Autonomous vehicles precent a number of data privacy issues, including the use of video information taken by autonomous AI driving devices while driving. Although it has been necessary to use mosaiced (pseudonymised) video data to ensure that no individual can be identified even when developing autonomous driving technology, the PIPC has prepared a measure to permit the use of non-mosaiced original video through a regulatory sandbox, and accordingly, several companies have applied for the sandbox for the development of autonomous driving AI.

To date, there is no law regulating the use of AI in the manufacturing sector. Provided, however, that the Ministry of Trade, Industry and Energy has commenced the establishment of a master plan for AI autonomous manufacturing to drive innovation in the manufacturing process and enhance productivity. The Ministry has also stated that it will

• conduct a manufacturing process analysis and promote pilot projects for AI autonomous manufacturing;
• develop core technology for AI autonomous manufacturing; and
• proceed with the renovation of systems and infrastructure to expand the introduction of AI autonomous manufacturing.

Meanwhile, MSIT has announced a plan to prepare a basic law on artificial intelligence in 2024 and a bill on fostering the artificial intelligence industry and creating a foundation of trust has been proposed and is currently pending in the National Assembly.

It is also worth noting that the above bill permits the launch of artificial intelligence technology, artificial intelligence products (products using artificial intelligence technology), or artificial intelligence services, in principle, but it also prescribes the principles of priority permission and ex-post regulation that can limit them if they cause any harm to the lives, safety, rights and interests of the citizens, or significantly disrupt public safety, the maintenance of general order, and welfare promotion.

In the accounting, tax, and legal markets, individual companies are conducting a review on the use of AI for the analysis of contracts or financial statements.

However, in such professional services, companies cannot provide relevant data for a large-scale large language models due to confidentiality issues with clients, and for this reason, as they are basing the work on small language models, progress is sluggish.

On 30 June 2023, in a lawsuit filed by Stephen Thaler, an AI developer in the United States, as part of the so-called DABUS project to seek recognition of AI as an inventor, the Seoul Administrative Court ruled that “invention” under Article 2(1) of the Patent Act refers to the highly advanced creation of a technical idea using the laws of nature and that such a technical idea presupposes human reasoning, and therefore, under the current laws, AI cannot be recognised to have the legal capacity to “invent”. The appeal process in this case is currently ongoing (Seoul High Court 2023Nu52088).

In addition, the Copyright Act defines “work” as a creative production that expresses human thoughts and emotions (Article 2(1) of the Copyright Act) and “author” as “a person who creates a work” (Article 2(1) of the Copyright Act). The Ministry of Culture, Sports and Tourism stated in the Generative AI Copyright Guide issued on 27 December 2023 that, under the current laws, an AI cannot be recognised as an author.

Under Korean laws, a trade secret refers to information, including a production method, sales method, or useful technical or business information for business activities, which is not known publicly, is managed as a secret, and has independent economic value (Article 2(2) of the Unfair Competition Prevention and Trade Secret Protection Act). An act of acquiring trade secrets or using or disclosing trade secrets improperly acquired, with knowledge of the fact that an act of improper acquisition of the trade secrets has occurred, or without such knowledge due to gross negligence, constitutes infringement of trade secrets (Article 2(3)(b) of the above Act). Therefore, if any data considered as trade secrets of another person is collected without permission and used for AI learning, trade secret infringement issues may arise.

Meanwhile, if any technical data, such as the source code of any AI model created for AI services, is kept confidential and not disclosed to others, such data can be protected as trade secrets.

Under the current law, any product created by generative AI itself is not recognised as a work of authorship.

Any product created by Open AI’s generative AI is not protected by copyrights or patents. However, if any product created by Open AI’s generative AI is substantially similar to any existing work, such product may infringe on the copyrights of others.

As no artificial intelligence regulation bill has been introduced in Korea so far, the direction that future legislation is likely to take is very important. It is therefore vital to take a good look at the legislative trends and respond thereto.

There is much interest in the European AI law in Korea. This means that the European AI law could be the most important model. Furthermore, as the Financial Services Commission provides the most specific guidelines, the content thereof may also serve as a model for other government agencies.

It is necessary to consider the introduction of the European AI Law, documentation work to secure accountability as proposed by the Commission, an artificial intelligence governance system, and ex-post verification procedures for AI services.

In addition, since ISO 42001 can be an important standard, it is recommended to consider obtaining ISO 42001 certification or building an internal system at a level similar thereto.