EU enforces strict AI regulations while South Korea grapples with incomplete laws
By Kim Su-jeong
The European Union (EU) is set to fully implement the comprehensive ban on ‘high-risk AI systems’ as defined in the artificial intelligence (AI) fundamental law announced last year. Consequently, AI corporations within the EU will need to exercise caution when providing services in the future. In South Korea, the AI fundamental law was passed at the end of last year, making it the second in the world after the EU. However, there are concerns that the law is only half-finished since urgent follow-up measures such as the preparation of enforcement decrees are necessary for the law to take effect.
◇ EU implements full ban on ‘unacceptable AI’ starting this month
According to foreign media including IT outlet TechCrunch on the 3rd, the EU banned the use of AI systems that pose ‘unacceptable risks’ starting on the 2nd (local time). The AI law, known as the ‘AI Act,’ was finally approved by the European Parliament in March last year and officially came into effect in August of the same year. The most dangerous category of ‘unacceptable AI’ defined by this law will be fully banned starting from this day after a 6-month compliance deadline.
The AI Act classifies AI into four levels based on risk: ▲ unacceptable AI ▲ high-risk AI ▲ limited-risk AI ▲ minimal-risk AI. AI spam filters and similar ‘minimal-risk AI’ are not subject to regulation, while chatbots classified as ‘limited-risk AI’ are subject to light oversight. High-risk AI, such as AI medical recommendation functions, face strict regulations, and the most dangerous ‘unacceptable AI’ is legally banned.
This regulation prohibits the use of AI technologies that ▲ evaluate social scores ▲ deceptively manipulate human decisions ▲ exploit vulnerable groups ▲ predict the potential for crimes based on appearance. Additionally, the use of AI that infers personal characteristics such as sexual orientation using biometric data, performs real-time biometric recognition in public spaces, analyzes emotions in workplaces and schools, and builds facial recognition databases using online and security cameras is also banned.
AI corporations operating regulated services within the EU will face severe sanctions regardless of where their headquarters are located. Violators may be fined up to 35 million euros (about 52.5 billion won) or 7 per cent of their annual revenue, whichever is higher. However, full enforcement of fines will begin in August. There are some exceptions to the regulations. Law enforcement agencies may use biometric recognition systems in public spaces on a limited basis to prevent specific threats or locate missing persons. Additionally, emotion analysis AI used in workplaces and schools may be allowed if medical necessity is demonstrated, although all exceptions require strict government approval processes.
Furthermore, the EU will begin implementing regulations on general-purpose AI (GPAI) inclusive of generative AI starting August 2. This imposes obligations on GPAI providers to provide technical documents and user manuals, comply with copyright guidelines, and disclose summaries of data used for training. Since the AI Act defines GPAI as AI services using large language models (LLMs) such as OpenAI’s ChatGPT and Meta’s LLaMA, global AI corporations are expected to fall under the regulations.
◇ South Korea passes AI fundamental law, following the EU… Follow-up actions needed
In South Korea, the AI fundamental law, known as the ‘AI Basic Law,’ was passed on December 26 last year, making it the second in the world after the EU. The AI Basic Law defines AI technologies that significantly impact the lives, safety, and fundamental rights of users as ‘high-impact AI’ and outlines the obligations of the relevant AI business operators. It mandates measures to ensure the reliability of AI developed by companies, such as adding watermarks to content created by AI, and allows the Ministry of Science and ICT to conduct fact-finding investigations and issue corrective orders for violations.
However, there are concerns that urgent follow-up actions such as the preparation of enforcement decrees are needed for the law to take effect. Industry representatives have pointed out the need to specify what constitutes high-impact AI. For instance, under the basic law, some AI systems used in medical devices are classified as high-impact AI, but the lack of concrete specifications on which technologies fall into this category has led to confusion among corporations regarding their development directions.
Moreover, the AI Basic Law excludes generative AI, which is most frequently used in everyday life. This contrasts with the EU’s AI Act, which encompasses regulations for GPAI. While the AI Basic Law does have some regulations regarding transparency, such as requiring products and services that use generative AI to inform users in advance that they are operated based on AI, generative AI is effectively outside the main regulatory framework.
In this regard, the Ministry of Science and ICT plans to quickly draft enforcement decrees by operating a sub-legislation management team established last month. This team consists of experts from the Ministry of Science and ICT, the industry, academia, and the legal field, who will consider overseas legislative trends and the policy goal of enhancing AI competitiveness regarding high-impact AI and generative AI included in the law, aiming to clarify criteria and application cases. The goal is to alleviate corporate uncertainties and foster large-scale public-private investments.
A professor at Korea University’s Artificial Intelligence Research Institute, Choi Byeong-ho noted that ‘it is important to catch both rabbits of fostering and regulating the AI industry with the AI Basic Law.’ He added, ‘Especially today, the speed of technological advancement in AI differs significantly from past technologies, and we must understand this characteristic to ensure that the AI legislation is effective.’
- This article has been translated using the OpenAI translation tool.
