"Will Even AI Used Only Internally Be Regulated?" Business Community Urges AI Basic Act Revisions

FKI Proposes 19 Improvements to the AI Basic Act
Calls for Separate Rules for Internal AI and Clearer Accountability
Urges Exemptions for Drug Development Tools and Prompt Safety Guidelines

The Korea Economic Association (KEA) said on October 29 that it had submitted 19 proposed improvements related to the AI Basic Act, which took effect early this year, to the Ministry of Science and ICT. The association said confusion is growing at companies because it is unclear which entities are subject to regulation and where responsibility lies.

The proposals cover five areas: clarifying which entities are subject to regulation; rationalizing requirements to disclose and label AI use; specifying regulations on high-performance and high-impact AI; refining standards for the use of training data; and ensuring predictability regarding regulatory expansion. KEA said detailed guidelines should be refined so companies can develop and adopt the technology with confidence.

First, KEA called for AI used for internal company operations to be excluded from regulation. Companies have recently been developing their own AI to improve work efficiency and sharing it with employees or affiliates. However, under current law, it is unclear whether internal-use AI is subject to the same obligations as AI providers of external commercial services. It is especially difficult to determine whether the law applies when a holding company and its affiliates use AI together. KEA therefore argued that general-purpose AI for internal company use should be distinguished from external commercial services. It also proposed recognizing shared use among affiliates that meet security requirements as internal use.

KEA also called for a clearer division of responsibilities between AI developers and companies that use AI. Current law imposes uniform risk-management obligations on both companies that develop AI and those that use it to provide services. KEA said responsibilities should be allocated according to the roles and scope that each company can actually control. Its position is that if a company adopts general-purpose AI and changes its intended use to high-impact AI that affects human safety, that company should bear responsibility for risk management. The European Union's AI Act also assigns relevant responsibilities to the party that changes the intended use.

KEA also requested clearer criteria for evaluating research-support AI in the pharmaceutical and biotech sectors. AI is widely used as a research tool to identify drug candidates and predict toxicity in the preclinical stage. Current government guidelines exclude AI used in research and development (R&D) from regulation, but the criteria are ambiguous. KEA proposed explicitly listing as representative examples of AI excluded from the high-impact category: predicting the toxicity of compounds during animal testing, coding support for medical devices, and data analysis tools. It also proposed establishing a one-stop channel where companies can quickly obtain input from relevant government agencies, including the Ministry of Health and Welfare and the Ministry of Food and Drug Safety.

High-impact AI refers to AI technology used in legally designated areas that has, or may pose, a significant impact or risk to people's lives, physical safety, or fundamental rights. High-performance AI refers to AI that is subject to safety obligations because the cumulative computing power used to train its model and its technical capabilities meet legally prescribed standards.

KEA also stressed that the government should expedite finalizing detailed notices on AI safety-management obligations. Under current law, high-impact AI is subject to obligations concerning risk management, explanation, and user protection. However, the government has yet to finalize notices specifying what risks must be managed and how they must be managed and explained. As a result, companies are having difficulty preparing in advance.

"The success of the AI Basic Act depends on how much the number of cases in which companies trust and use AI in the workplace increases," said Kwon Hyukmin, head of KEA's Growth Strategy Office. "Obligations should be specified to reflect the actual risks of AI and the roles of companies, so that companies can focus on safe AI use and innovation."

This content was produced with the assistance of AI translation services.