IROUMISM
The AI Basic Act (Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trust) took effect on January 22, 2026, and the question SMB owners ask us most is always some version of this:
"We use ChatGPT and Claude internally — does the AI Basic Act apply to us?"
It is the top question IROUMISM receives when consulting on AI content and automation adoption. The news is full of heavy phrases like "world's second AI regulation" and "fines up to 30 million KRW," yet no one clearly explains whether your specific company is even covered, or what you are actually required to do. This article presents the decision criteria we use in real consultations.
The short answer: most SMBs have exactly one obligation to manage, and even that obligation is currently inside the grace period, so there is no immediate risk of a fine. That said, before concluding "this doesn't apply to us," you should confirm which category your company falls into. It takes about five minutes.
Enforcement Date and Grace Period — When Does It Start, and When Could Fines Apply?
The formal name is the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trust, commonly called the AI Basic Act. It was promulgated in January 2025 and took effect on January 22, 2026, making Korea the world's second country after the European Union to enact comprehensive AI legislation.
Here is what SMBs can take comfort in: from the enforcement date, there is a grace period of at least one year during which fines and fact-finding investigations are, as a rule, suspended even if a violation exists. The government has stated its priority during this period is consulting and capacity-building support rather than enforcement.
Penalties also do not arrive in a single step. The process is: fact-finding investigation → corrective order → fine only if the corrective order is not followed. The maximum fine is up to 30 million KRW, but in practice the earliest realistic enforcement is 2027 or later.
In summary: obligations are already in effect, but the risk of immediate punishment is suspended. The difference between a company that scrambles to comply when the grace period ends and one that spent five minutes preparing now will be obvious at that point. This is not the time to panic — it is the time to understand where your company stands and handle the things that cost nearly nothing.
Who Is Covered — "User" vs. "Business User" (Which One Is Your Company?)
This is the most important distinction. Using a third-party AI tool does not automatically create obligations. The critical question is how you use AI. In consultations, most business owners are confused about which category they fall into. The table below resolves it in seconds.
| What your company does | Legal classification | Disclosure/notice obligation |
|---|---|---|
| Uses AI to create content or materials for your own use or distribution (blog posts, videos, internal documents) | Simple user | None |
| Deploys an AI chatbot on your website or app for customers to interact with directly | Business user | Yes |
| Integrates an external AI capability to offer as a service to customers (AI summarization, generation features, etc.) | Business user | Yes |
In other words, merely using AI to produce content you use yourself creates no obligation. A production company that uses AI to make promotional videos for YouTube is classified as a simple user. By contrast, if you embed ChatGPT or Claude to offer an AI-powered feature your customers use directly, you become a business user and the disclosure and notice obligations apply.
One additional point: even if you are a business user, if you are using an external AI largely as-is without significant modification, obligations already fulfilled by the AI developer (OpenAI, Anthropic, etc.) are not duplicated — you are not required to cover what they have already addressed.
Generative AI Disclosure and Prior Notice — The Single Obligation Most SMBs Need
If your company qualifies as a "business user," the one practical obligation you will encounter is the transparency obligation — simply informing users that AI is being used or is responding on your behalf.
- Prior notice: Inform customers in advance that "this service uses generative AI." This can appear anywhere — terms of service, a service screen, or an about/introduction page.
- Output labeling: Label AI-generated outputs so users know they were made by AI. Machine-readable watermarks that are invisible to the human eye are technically permitted, but for most SMBs, a single visible AI-generated label is sufficient.
- Deepfakes are held to a stricter standard: Synthetic content that is difficult to distinguish from real video or audio must carry a clearly visible label as the default rule.
No need to overthink it. A single line like the following, added to your terms of service or service screen, is a perfectly valid starting point:
This service uses generative AI to produce responses, and outputs may contain AI-generated content.
There are also cases where labeling is not required: when AI is used exclusively for internal operations, or when it is already self-evident from the service name or interface that AI is the underlying technology. When in doubt, it is safer to label explicitly — and since it costs virtually nothing, there is little reason not to.
High-Impact AI and Domestic Representatives — Why These Don't Apply to Most SMBs
The "high-impact AI" and "domestic representative" provisions that receive heavy news coverage are largely irrelevant to most SMBs.
High-impact AI applies only when AI is used in sensitive domains — hiring, loans, healthcare, transportation, or public-sector decision-making — and the AI makes the final decision autonomously, without human review. If your company uses AI in hiring but a person makes the final call, you are not covered. In practice, any structure where a human reviews and decides will almost always be excluded. (If you do fall into this category, significantly more obligations apply — risk management, record-keeping, and more — so professional guidance is essential in that case.)
Domestic representative designation is a requirement for large foreign AI providers at the scale of OpenAI or Google. It is completely unrelated to domestic SMBs.
AI Basic Act SMB Compliance Checklist (5 Things to Do Now)
The grace period means you have time, but the items below cost nearly nothing, so there is no reason to delay.
- Confirm your classification — Does your company only use AI outputs internally (simple user), or does it provide AI-powered features as a service to customers (business user)? Most SMBs are the former.
- (If you are a business user) Add a prior notice statement — Insert the example notice above into your terms of service or service interface.
- Label AI-generated outputs — Mark AI-generated content delivered to customers with an AI-generated label. If the output involves photorealistic synthesis (deepfake-type content), a clearly visible label is mandatory.
- Create a one-page "AI usage map" for your company — List which AI tools are used for which tasks. Check whether any high-impact domains are being served by AI without human involvement.
- Ask when uncertain — The Ministry of Science and ICT's AI Basic Act support desk provides free guidance.
Frequently Asked Questions
When did the AI Basic Act take effect? It took effect on January 22, 2026. A grace period of at least one year applies from that date.
If I do nothing right now, will I be fined? Not immediately, due to the grace period. Any violation must go through a fact-finding investigation and corrective order before a fine can be issued; realistic enforcement is not expected before 2027 at the earliest. That said, prior notice and labeling cost almost nothing, so setting them up now is advisable.
I only use ChatGPT to write blog posts or produce videos. Do I need to label them? Labeling is not a legal obligation in that case (simple user). However, if the content involves photorealistic synthesis, labeling is prudent to avoid misleading your audience.
Are we subject to the high-impact AI provisions? Almost certainly not, unless AI is making final decisions autonomously — without human review — in areas such as hiring, lending, healthcare, transportation, or public-sector decision-making. If your situation is ambiguous, check with a professional or the support desk.
This article is for informational purposes only and does not constitute legal advice. Please consult a legal professional or the Ministry of Science and ICT's AI Basic Act support desk for guidance on your specific situation. The text of the law is available at the National Law Information Center.
The real first step in AI Basic Act compliance is not the regulation itself — it is mapping out, on a single page, which AI tools your company uses and for what tasks. But when you try to build that map on your own, you will almost always hit ambiguous entries: "Is this function making us a business user?" or "Is this task high-impact?" IROUMISM's 30-minute free diagnostic works through those ambiguous entries together with you — identifying exactly where disclosure and notice are needed, and then showing you which parts of that map offer the highest return when automated first. No materials to prepare in advance; just tell us which AI tools you currently use. The goal is diagnosis, not a sales pitch.