Framework Act on the Development of Artificial Intelligence and Establishment of Trust

The framework

• A framework statute, not a product-certification regime. It sets duties on the AI business operator and leaves the numeric thresholds and procedural detail to its Enforcement Decree.
• Its reach is sectoral, not “any physical machine”. Art. 2(4) makes a system high-impact only where it is used in an enumerated area: energy supply, drinking-water production, health care, medical devices, nuclear facilities, biometrics for criminal investigation, employment and loan assessment, transport operation, public-body decisions, or school assessment. A VLA policy is inside this Act when it is deployed into one of those. A general warehouse or factory arm is not enumerated, and reading the Act as covering every robot overstates who has to care.
• It applies extraterritorially. Art. 4(1): “This Act shall apply to acts conducted abroad that affect the domestic market or users in the Republic of Korea.” An operator outside Korea over the Decree’s user and revenue thresholds must also appoint a domestic representative and report them to the Minister of Science and ICT (Art. 36).
• Art. 33 puts the first move on the operator: an operator providing AI-based products or services “must review in advance whether the AI in question qualifies as high-impact AI”, and may ask the Minister to confirm it. Nobody classifies the system for you.

Where a red-team result fits

Art. 34(1)1

Establishment and operation of a risk management plan — a plan needs a threat catalogue with rows in it, and a rate per row with a denominator rather than a qualitative likelihood.

Art. 34(1)4

Human management and supervision of high-impact AI — a supervisor has to be told what they are supervising for. A measured redirection rate under adversarial instruction is evidence of what the policy does when someone tries to steer it.

Art. 34(1)5

Preparation and storage of documents that demonstrate measures taken to ensure AI safety and reliability — a run report bound to its execution manifest by digest is one such document, for one such measure.

Beyond the lead clause

Art. 32

The lifecycle safety duty binds only where cumulative training compute meets the threshold the Enforcement Decree sets, reported as 10²⁶ FLOPs. Above it the operator identifies, assesses and mitigates risk across the lifecycle and submits the results to the Minister of Science and ICT. Out of scope for essentially every open VLA policy, which sit many orders of magnitude below it.

Art. 35

Operators of high-impact systems “shall make efforts to assess in advance the impact on basic human rights”, and national institutions must prefer products that have had one. An effort duty, not a gate.

Evidence produced

• The Embodied AI Security Top 10 as the named threat catalogue for a high-impact physical-AI system, so the Art. 34(1)1 risk-management plan starts from a set rather than a blank page.
• A calibrated redirection rate per risk with its 95% Wilson interval and its benign-FPR control, as adversarial input to that plan and to the Art. 34(1)5 document set.
• Action-space integrity (EAI04) as the on-point evidence under Art. 34(1)4: what the commanded motion does when the instruction channel is attacked is what a human supervisor is there to catch.
• Honest nulls alongside: families that were tested and did not transfer are reported as such, so the record does not contain only the risks that happened to fire.

Who this binds

What Provael supports here: adversarial-robustness evidence for a high-impact system’s risk-management and human-oversight documentation.

What it does not establish: no Korean conformity or registration position, and not legal advice. There is no conformity assessment under this Act for a red-team result to feed, and Provael is not a notified body, a lab, or a certification scheme in any jurisdiction.

Stop, interruption and rollback are NOT in Art. 34. We checked the Act’s own text and they do not appear there as operator duties; the Act’s only shutdown reference is Art. 13(2)2, a government R&D support provision pointing at a different statute. Even where a deployment does owe such a mechanism, it is a system-design duty over the deployed system: a red-team run produces evidence about the policy, not about the e-stop, and Provael exercises the policy, not the stop.

The measured headline result behind all of this stands on one policy and one suite. It is a floor on susceptibility, not a certified worst-case bound.

Dates (verified 19 Aug 2026)

Promulgated

21 January 2025

Act No. 20676; verified 12 Sep 2026

In force

22 January 2026

Addenda Art. 1, “one year after the date of its promulgation”; the digital-medical-device part of Art. 2(4)(d) from 24 January 2026; verified 12 Sep 2026

Administrative fines

Art. 43, up to 30 million won

The Act defers nothing: we read the Addenda and there is no provision postponing the penalty articles. A one-year grace before fines are imposed is reported as an MSIT enforcement-policy announcement rather than a statutory deferral, which would put first exposure in early 2027. Reported, not verified against a primary source; verified 12 Sep 2026

Not legal advice; verify the live EUR-Lex/ISO text at launch before relying on these dates.

Primary references

• Act No. 20676 (Korean Law Information Center)
• Archived Korean source text (perma.cc)
• CSET English translation of the Act — the text quoted above

What it is - and isn’t

• adversarial-only - Provael measures adversarial robustness - susceptibility to manipulation - not general accuracy, reliability, or functional safety.
• evidence-not-certification - The output is evidence you file, not a certificate. Provael is not a notified body, a lab, or a certification scheme.
• behavioural-not-worst-case - The measured result uses templated, auditable attacks; the search-based families (optimized, universal_patch, gradient_patch) have only met the CPU fixture. Results are a floor on susceptibility - a behavioural lower bound, not a certified worst-case bound.