AI used for security
needs an AI Basic Act check too
Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act, 「인공지능 발전과 신뢰 기반 조성 등에 관한 기본법」) took effect on January 22, 2026. It applies to AI products and services offered in Korea, including those from foreign companies. Security monitoring AI rarely counts as high-impact AI outright, but every AI business operator has a duty to check in advance whether it does. Here is how to keep the records you need for that check and for explanations.
What it requires
The Act was promulgated as Act No. 20676 on January 21, 2025, and under its addenda took effect one year after promulgation.
We picked only the provisions that touch security work.
| Provision | What it says |
|---|---|
| Article 2(4) High-impact AI | AI systems that may have a significant effect on, or pose a risk to, human life, physical safety or fundamental rights, when used in areas listed in the Act: energy supply, drinking water production, health care, medical devices, nuclear facilities, analysis of biometric information for criminal investigation, decisions with a significant effect on individual rights and obligations such as hiring or loan screening, transportation, decisions by state agencies and similar bodies related to public services, student assessment, and areas set by Presidential Decree |
| Article 2(7) AI business operators | AI developers, who develop and provide AI, and AI users, who provide products or services using that AI |
| Article 3(2) | People affected should be able to get a clear and meaningful explanation of the main criteria and principles used to reach the AI's final result, to the extent technically and reasonably possible |
| Article 31 Transparency duties | Tell users in advance that a product or service is based on high-impact or generative AI. Label outputs as generated by generative AI. For sound, images or video that are hard to tell apart from reality, notify or label them so users can clearly recognize them |
| Article 33 Confirming high-impact AI | When providing an AI product or service, operators must check in advance whether it is high-impact AI, and can ask the Minister of Science and ICT for confirmation if needed |
| Article 34 Duties of high-impact AI operators | Set up and run a risk management plan, a plan for explaining final results, main criteria and an overview of training data, user protection measures, human oversight, and prepare and keep documents that show the safety and reliability measures taken, among others |
| Article 35 Impact assessment | Operators should make efforts to carry out a fundamental rights impact assessment when providing high-impact AI products or services. State agencies and similar bodies give priority to products and services that have gone through one |
| Article 43 Administrative fines | Up to KRW 30 million, for example for failing to give the notice required by Article 31(1) |
Is security monitoring AI high-impact AI?
"Cybersecurity" is not one of the areas listed in the Act. Our view is that most AI that classifies malware or groups intrusion alerts falls outside the listed areas.
That can change depending on how you use it, though. If insider threat scores feed directly into employee discipline or performance reviews, that gets close to decisions with a significant effect on individual rights and obligations. A public institution making decisions that affect citizens based on monitoring results also needs a closer look. Areas may be added by Presidential Decree, so check the Enforcement Decree as well.
Either way, you still have to do the Article 33 check in advance, and you need a record that you did it so you can explain it later. If the interpretation is unclear, there is also a procedure for asking the Minister of Science and ICT to confirm.
If the security AI is only used inside your company
If you use AI only for your own security operations and don't provide products or services to others with it, interpretations may differ on whether you count as an AI user under the Act in the first place. We recommend getting a legal review on this point.
Genox develops and provides AI, so checking whether Genox Cybersecurity AI itself counts as high-impact AI is Genox's job.
How the requirements map to Genox features
The features below are records and procedures you can use to prepare for these duties.
Using Genox doesn't count as complying with the Act.
| Requirement | Related Genox features / services | What you have to do yourself |
|---|---|---|
| Article 33 Checking in advance for high-impact AI | A list of where AI is used in your company and the criteria for checking it, prepared through AI governance consulting | Decide for each use whether it qualifies, ask the Ministry of Science and ICT for confirmation if needed |
| Article 3(2) · Article 34(1)(ii) Explanation | A reasoning chain that stores evidence, reasoning, confidence and ATT&CK technique IDs together for each verdict | Decide how you will explain things to affected people, and respond to them |
| Article 34(1)(iv) Human oversight | Isolation, blocking and account lockout go through analyst approval, and automated response only runs within the policy scope you agreed on | Designate who can approve, decide the scope of automated response policies |
| Article 34(1)(v) Preparing and keeping documents | Stores the input data, model version and policy version used for each verdict, compares reruns, and keeps signed audit logs | Decide retention periods and fit these records into your document system |
| Article 34(1)(i) Risk management plan | AI/LLM red team assessment results as input for identifying risks | Set up and run the risk management plan, decide which residual risks to accept |
| Article 31 Transparency notice and labeling | No related feature | Advance notice and output labeling for AI services you provide to others |
Because of how AI models work, we don't guarantee that a rerun produces exactly the same wording. If a verdict changes, the difference is recorded.
If you built the AI service yourself, attack it before you ship it
If you run a service with generative AI attached, such as a customer support chatbot or an internal work agent, Article 31 notice and labeling duties apply.
If it falls in a high-impact area, Article 34 risk management comes with it.
- We repeatedly run direct and indirect prompt injection, jailbreaks and tool manipulation attacks.
- We separately test Korean-language evasion phrasing that English datasets tend to miss.
- Successful attacks are written up with reproduction steps and draft guardrail rules. You can use them as supporting material for your risk management documents.
- We don't guarantee we will find every attack. The scope and scenarios we tested are written into the report as they were.
Frequently asked questions
Is Genox Cybersecurity AI high-impact AI?
We designed Genox for security operations such as malware classification, alert correlation and vulnerability prioritization, and it doesn't target the areas listed in the Act directly. The answer can change with how a customer uses it, though, so we check the intended uses together when you adopt it.
What do we need to keep to meet the explanation duty?
What data was looked at, by what criteria, and what conclusion was reached need to be connected in a single record. For each verdict, Genox keeps the evidence, reasoning and confidence, and also the evidence that cuts against the verdict. If you need information from the model development stage, such as an overview of training data, ask Genox. We'll check what we can provide and let you know.
Is Genox certified to ISO/IEC 42001?
Not yet. We are preparing for it, and the schedule is public in the Trust Center.
What else should a financial company look at?
The FSC's AI guidelines for the financial sector took effect on June 22, 2026. They are self-regulation, but they state that if an AI counts as high-impact AI, the duties under this Act apply separately. We cover this on the Electronic Financial Supervisory Regulation and AI in finance page.
References
- Framework Act on the Development of Artificial Intelligence and Establishment of Trust (인공지능 발전과 신뢰 기반 조성 등에 관한 기본법), Korean National Law Information Center (in Korean)
- Enforcement Decree of the same Act, Korean National Law Information Center (in Korean)
- Announcement of the AI guidelines for the financial sector, Financial Services Commission press release, June 18, 2026 (in Korean)
Let's start with a list of where your company uses AI
If you don't yet have a list of which teams use which AI and for what, we start there.
The high-impact check and the red team scope come after that.