I. Introduction: a landmark law with a contested balance
In the global race to govern artificial intelligence (AI), the European Union (EU) AI Act has established itself as a leading regulatory model that combines a risk-based approach with rights-protective objectives. As nations worldwide chart their own course, the Republic of Korea has emerged as a key player. In January 2025, it enacted the ‘Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust’ (the ‘Act’), becoming the first country in Asia to pass comprehensive national AI legislation.Footnote 1 The Act, which entered into force on 22 January 2026, seeks to simultaneously promote Korea’s AI industry and safeguard human dignity, user rights and public safety.
However, the Act’s text itself establishes a clear paradox. Its provisions for industrial promotion are backed by binding government commitments and financial support, while its human rights protections remain largely aspirational, relying heavily on principles and industry self-regulation.
The result is a regulatory structure in which direct state prohibition, supervision and remedy remain underdeveloped, while rights protection is largely channelled through corporate risk management and procedural compliance. The United Nations Guiding Principles on Business and Human Rights (UNGPs) are therefore an apt framework for analysis because they connect state protection, corporate responsibility and access to remedy. This piece argues that Korea’s resulting ‘light-touch rights’ model, while legislatively pioneering, risks offering a template for emerging economies that may constrain the development of human rights-based AI governance more broadly.Footnote 2
II. The Act’s dual mandate and key provisions
The tension between economic growth and ethical governance is at the heart of the Act. This dual mandate is evident in its key features, which blend concrete promotional policies with a regulatory philosophy that adopts the form of a risk-based approach but dilutes its substance with soft-law mechanisms.
First, the Act nominally adopts the EU’s risk-based classification system, but with significant modifications. It borrows the EU’s classification of actors (providers, deployers) and AI systems. For systems, it introduces ‘High-Impact AI’: this category echoes the EU’s ‘high-risk’ classification, applying to AI that could seriously risk human life, safety or fundamental rights, such as in critical sectors like healthcare, finance, employment, education and public administration.Footnote 3 The Act also defines an AI System ‘whose cumulative computational volume exceeds the standard set by Presidential Decree’, a category commonly referred to as ‘High-Performance AI’. This corresponds to the EU’s ‘General-Purpose AI Models with Systemic Risk’ (GPAI-SR), which are regulated above a floating-point operations (FLOPs) threshold. The Korean enforcement decree, however, sets this threshold at 1026 FLOPs—ten times higher than the EU’s—dramatically narrowing the number of models that fall under regulation.Footnote 4 More significantly, the Act entirely omits a ‘prohibited’ category for AI systems deemed to pose unacceptable risks, a foundational element for anchoring a risk-based regulatory framework in human rights protection.
Second, this borrowed framework is implemented through a philosophy of soft law and self-regulation. While providers of High-Impact AI are formally required to take measures such as ‘risk management plans’, ‘human management and supervision’ and the ‘preparation and retention’ of documentation, these obligations remain largely procedural: they focus on the creation of systems, plans and records rather than mandating specific rights-protective outcomes.Footnote 5 Similarly, the obligations for High-Performance AI are limited to procedural duties such as ‘identification, evaluation and mitigation of risks’ throughout the lifecycle and the establishment of a ‘risk management system’ for monitoring, rather than requiring systems to pass substantive safety verification.Footnote 6 Rather than making prior external vetting a condition for deployment, Article 30(3) provides: ‘Where an AI business operator provides High-Impact AI, it shall make efforts to obtain prior inspection or certification’.Footnote 7 Article 35(1) adopts the same best-effort formulation for fundamental-rights impact assessment: ‘Where an AI business operator provides products or services using High-Impact AI, it shall make efforts to assess in advance their impact on human fundamental rights’.Footnote 8
Third, the industrial promotion measures are far more concrete than the rights protections. The Act mandates the formulation of a national AI Master Plan and the establishment of AI innovation clusters and data centres, provides a legal basis for government investment in AI R&D and startups, and establishes the presidential National AI Strategy Committee.Footnote 9 This top-tier governance body is chaired by the President and composed of both high-level government officials and private-sector experts. This pro-industry focus has drawn criticism from civil society groups, who argue that the National AI Strategy Committee is weighted towards corporate and technical expertise, with limited representation from human rights experts, labour representatives and affected communities.Footnote 10 Furthermore, the committee’s severe gender imbalance, with a vast majority of private-sector members being men, contravenes the spirit of Korea’s Gender Equality Framework Act.Footnote 11
This asymmetry—binding commitments for innovation versus best-effort guidelines for rights—signals that industrial competitiveness is the law’s primary operational priority.Footnote 12
III. A human rights critique through the UNGPs framework
The UNGPs are structured around the ‘Protect, Respect and Remedy’ framework, which links the state’s duty to protect, corporate responsibility and victims’ access to remedy. Viewed through this framework, the Act does not simply disregard human rights; rather, it selectively adopts the language and institutional forms of each pillar while weakening their substantive protective function.
A. Pillar I: the state duty to protect
The UNGPs affirm the state’s primary duty to protect against human rights abuses by third parties, including business enterprises.Footnote 13 The Korean state nominally acknowledges this duty by creating a legal framework that references human dignity and safety, but its commitment remains largely symbolic.Footnote 14 As noted above, in a major departure from the EU model, the Act entirely omits a ‘prohibited’ category for AI systems deemed to pose unacceptable risks to fundamental rights. Under the EU AI Act, this category includes, for example, AI systems that exploit vulnerabilities, infer sensitive characteristics through biometric data or enable social scoring.Footnote 15 Such prohibitions are foundational to ensuring that a risk-based regulatory framework remains anchored in human rights protection. When such AI-driven violations occur, the lack of a clear legal basis for prohibition makes them exceptionally difficult to address under the current legal system. This omission is particularly stark given that Korea lacks a comprehensive national anti-discrimination law, leaving a significant gap in protecting vulnerable groups from AI-driven harms.
This does not mean that the Act wholly disregards Pillar I. It creates state-backed regulatory mechanisms, including the designation of High-Impact AI, transparency obligations, safety obligations for High-Performance AI, investigatory and corrective powers and administrative fines. Yet these mechanisms operate less as clear prohibitions or robust ex ante enforcement tools for unacceptable-risk AI than as limited oversight combined with corporate procedural and best-effort compliance. Fundamental-rights impact assessment and prior inspection or certification remain best-effort measures, and the maximum administrative fine is also limited to KRW 30 million, roughly US$20,000. The Ministry of Science and ICT’s further announcement of a guidance period of at least one year following the Act’s entry into force, during which fact-finding investigations and administrative fines will be suspended, makes the weak character of this enforcement architecture even clearer.Footnote 16 In this sense, the Act does not reject the state duty to protect, but institutionalises it in a light-touch form.
B. Pillar II: the corporate responsibility to respect
The Act’s voluntary, procedural and managerial character is also evident in its treatment of human rights due diligence (HRDD). Pillar II of the UNGPs frames corporate responsibility not as a duty to guarantee specific human rights outcomes, but as a conduct-based responsibility to avoid infringing rights and to identify, prevent, mitigate and account for adverse human rights impacts.Footnote 17 In this respect, the Korean AI Framework Act does not fall entirely outside Pillar II: by requiring or encouraging AI business operators to identify and manage AI-related risks, the procedural duties and best-effort provisions examined above partially reflect Pillar II’s conduct-based logic.
Yet this alignment is limited. The Act contains a number of elements resembling HRDD—impact assessment, risk management, human management and oversight, documentation and explanation. However, these elements are not framed as a clear obligation to conduct HRDD but are dispersed across procedural and best-effort provisions. This fragmentation is not merely a matter of legislative technique. By separating individual procedural duties from a comprehensive obligation to protect rights, the Act risks encouraging a checklist form of compliance in which operators meet discrete requirements without assessing whether the rights of affected persons are substantively protected. Most notably, even for High-Impact AI systems, the Act treats fundamental-rights impact assessment—a core component of HRDD—as a best-effort measure rather than a mandatory one. This is particularly troubling in light of the National Human Rights Commission of Korea’s recommendation that legally binding human rights impact assessments be introduced for high-risk AI systems.Footnote 18
The problem, then, is not simply that the Act is inconsistent with Pillar II. Rather, the Act reproduces a core limitation of Pillar II itself: reliance on corporate discretion, voluntarism and a form of managerial risk governance that reframes rights violations not as harms to be prevented or remedied but as operational risks to be internally managed. As critical scholarship has noted, the UNGPs institutionalise corporate human rights responsibility while leaving important elements of voluntarism in place.Footnote 19 The Korean AI Framework Act gives statutory form to this limitation: it adopts the language and procedures of HRDD, but leaves much of their substantive implementation to corporate discretion.
C. Pillar III: access to remedy
The third pillar of the UNGPs, access to effective remedy, is significantly underdeveloped in the Korean framework. The Act fails to establish clear and accessible pathways for individuals harmed by AI to seek redress. There is no statutory right to compensation for damages caused by a biased AI system, forcing victims to rely on traditional tort law, where proving causation and fault in an AI context is exceptionally challenging.Footnote 20 This procedural barrier can render rights meaningless in practice. The UNGPs specify that remedy can be judicial, administrative or legislative, and must be effective.Footnote 21 The Korean Act, however, offers no dedicated grievance mechanisms, rights to appeal automated decisionsFootnote 22 or pathways for collective redress. This renders its promise to protect the rights of individuals hollow, as rights without remedies are often illusory. Worse, the Act’s reliance on procedural formalities (Pillar II) combined with its lack of clear remedies (Pillar III) creates a risk that formal compliance could be invoked to deflect accountability for harms caused by AI systems. A state’s duty to protect includes ensuring that those who suffer business-related human rights abuses have access to effective remedy. By failing to provide such mechanisms, the Korean framework falls short of this critical component of the UNGPs.
This remedial deficit should not be understood as unique to Korea. Under the UNGPs framework, it raises a broader question for risk-based AI governance: whether rights-protective commitments are matched by effective remedial pathways for affected persons.
IV. Global implications and conclusion
As the first comprehensive AI law in Asia, Korea’s Act is positioned to influence AI policymaking across the region. It offers a legislative model that may appeal to nations seeking to foster AI innovation while signalling a commitment to ethical principles. However, the risk is that Korea may export a model of ‘light-touch rights’, normalising a governance framework where human rights protections are largely voluntary and subordinate to economic goals—a framework that risks not only failing to protect rights, but actively shielding procedural ‘box-tickers’ from liability for the harms they cause.
Since the Korean Act adopts key elements of the EU AI Act’s risk-based approach, its significance should be assessed not in isolation but in comparative perspective. Yet the comparison should not be reduced to a simple contrast between a rights-protective European model and a deficient Korean model. Although the two regimes differ in their levels of regulatory ambition, they share an important limitation under Pillar III of the UNGPs. This piece describes this problem as ‘rights without remedies’Footnote 23: a regulatory structure that articulates normative commitments to fundamental rights, safety and trust, while failing to provide sufficiently robust remedial pathways for individuals harmed by AI systems. The EU AI Act establishes a more developed ex ante compliance regime, whereas the Korean Act relies more heavily on voluntary and procedural obligations. Nevertheless, both regimes remain significantly underdeveloped in enabling affected persons to contest AI-related harms, obtain meaningful explanations, overcome evidentiary barriers or secure compensation.Footnote 24 In this respect, both regimes regulate AI risks more extensively than they remedy AI harms.
The Korean AI Framework Act is a pioneering legislative effort that duly recognises the need to build a trust-based AI ecosystem. Yet, in its current form, it prioritises industrial growth over enforceable rights. For the Act to fulfil its promise, it must be strengthened through future legislative amendments and a reinforced enforcement and oversight regime. This requires instituting clear prohibitions for unacceptable-risk AI and establishing meaningful enforcement powers (Pillar I); transforming the procedural compliance obligations applicable to High-Impact AI—such as risk management, documentation and human oversight—into a substantive, rights-protective human rights due diligence regime (Pillar II); and guaranteeing access to remedy for those harmed (Pillar III). Without such reforms, Korea’s AI Framework Act risks becoming an example of how the language of ‘human rights’ can be adopted without the legal force needed to truly protect them.
Declaration of AI use
The author used Claude (Anthropic), an AI language model, for assistance with language editing. The author takes full responsibility for the content of the manuscript.
Competing interest
Kyoungsic Min is Privacy Counsel and Asia Regional Lead at VeraSafe. He is also the Country Leader for Korea and a member of the Asia Advisory Board at IAPP. The views expressed are solely those of the author and do not necessarily reflect the views or positions of any affiliated organisations.
Open access
