In the era of AI Basic Law, legal obligations and preemptive response strategies for high-impact AI

On the 22nd, the 'AI Basic Act', which will become the legal basis for the AI ​​(artificial intelligence) industry, came into effect. This bill contains at its core regulations on 'high-impact AI' that can have a significant impact on human life or basic rights. The safety and reliability of AI technology, which has so far remained in the realm of self-regulation, has now entered a phase where responsibility is required according to explicit regulations. These changes require AI business operators to have systematic compliance and risk management capabilities beyond technological competitiveness, and are expected to fundamentally reorganize the operating paradigm of the entire industry.
 

First of all, 'transparency' must be secured so that users can clearly recognize whether AI is involved. This is basic work to build user trust by preventing situations where AI-generated information is mixed with human results and making the source transparent. Accordingly, high-impact AI or generative AI operators must notify the use of AI through terms and conditions before providing services, and attach identifiable marks such as watermarks to the results to indicate that they are AI products.

In addition, companies with very large AI models must have a preemptive safety verification system. The bill stipulates that AI with a cumulative amount of calculations used for learning greater than 10 to the power of 26 FLOPs is subject to core management. This is a step higher than the EU AI Act's standard of 10 to the 25th FLOPs, and can be interpreted as an intention to build a preemptive risk management system that goes beyond existing models and encompasses the next generation of super AI that will emerge in the future. Currently, the LLMs of major domestic companies do not meet this standard, so it is unlikely that they will be immediately classified as 'high-impact AI', but establishing governance in preparation for the future technological environment has become an unavoidable task.

Additionally, a 'people-centered management system' must be established to complement the 'black box' problem, which is AI's opaque decision-making structure. In order to clarify who is responsible for the results, business operators must have a system to explain the algorithm's judgment criteria and data overview, and establish specific procedures so that humans can immediately intervene and control in the event of a system error.

Ultimately, in order to efficiently fulfill increasingly complex legal requirements, an integrated response strategy that penetrates the entire company's value chain is essential. Although the law has already been implemented, the 'one-year fine guidance period' set by the government to establish the system is a very valuable golden time for companies. This period should not simply be a grace period to avoid punishment, but should be used as an optimal preparation period to secure actual legal stability and overhaul the internal system.

Fortunately, the AI ​​Framework Act is substantially alleviating the burden of overlapping regulations on operators through the 'deemed implementation' system. If the AI ​​development business has already completed certain measures, the service provider utilizing it is also deemed to have fulfilled the corresponding obligation, or if it has faithfully complied with the obligations under individual laws such as the Digital Medical Products Act or the Credit Information Act, it is recognized as having fulfilled its obligations under this Act.

Therefore, companies should use the given guidance period as a diagnostic tool to closely review whether their services fall into the high-impact AI category. At the same time, it will be necessary to establish a 'customized implementation strategy for each industry' to reduce the waste of duplicate responses by considering consistency with other laws and regulations. The driving force to spread the sails of innovation despite the strong waves of regulation ultimately depends on how precisely a company manages legal risks.
 

Small Business Team

[View full article]
AI Basic Law Era, High Impact AI's Legal Obligations and Preemptive Response Strategies (Shortcut)