|
Financial Review The Draft Subordinate Regulations for Korea's AI Basic Act: Implications for the Financial Sector and Policy Directions
With the AI Basic Act scheduled to take effect in January 2026, the government released the draft of subordinate regulations in September 2025, outlining the Enforcement Decree, public notices, and related guidelines. These regulations clarify procedures to ensure AI safety, criteria for “high-impact AI,” and the responsibilities of AI service providers. The AI Basic Act classifies AI use cases that may affect rights or obligations as “high-impact AI,” imposing a wide range of obligations. In finance, credit underwriting falls under this category. However, the newly published guidelines for determining whether credit underwriting constitutes a high-impact AI use case have prompted several concerns: (i) ambiguity in the criteria and difficulty in defining the scope of regulations; (ii) significant room for discretionary interpretation by the Ministry of Science and ICT; (iii) potential lack of coordination with financial authorities due to limitations in the composition of the Expert Committee; and (iv) procedural complexity. Meanwhile, AI service providers are classified as either developers or deployers. If the developer fulfills all or part of their obligations, the obligations of the deployer are reduced. However, deployers performing “substantial modifications”, implementing high-impact functions, are regarded as developers. Yet, practical challenges remain, such as determining whether activities like fine-tuning or adding functionalities (e.g., retrieval-augmented generation, RAG) constitute substantial modifications, as well as uncertainty around the allocation of responsibility among AI service providers. These grey areas in the current AI Basic Act could complicate AI adoption for financial institutions. Therefore, financial institutions should enhance internal governance and risk-management frameworks and proactively identify use cases that may be classified as high-impact AI to minimize potential regulatory risks. Download
|