AI Regulation Tracker / Binding law
Korea's AI decree is in force; machine-readable labels must include a human-facing notice
The amended Enforcement Decree of Korea's AI Framework Act was promulgated as Presidential Decree No. 36506 on 20 July 2026 and took effect the next day. Article 23(2) is the line product teams need to read.
What actually took effect on 21 July?
The header line on the Enforcement Decree reads: 인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 시행령 [시행 2026. 7. 21.] [대통령령 제36506호, 2026. 7. 20., 일부개정]. The decree was promulgated on 20 July 2026 as a partial amendment and commenced on 21 July 2026, in step with the amended Act it implements.
A presidential decree is the layer where a Korean framework statute turns into something an engineer can implement. The Act sets the duty. The decree says what discharging it looks like. This piece stays on the transparency article and the commencement; the rest of the July amendment is a separate question I have not verified against the promulgated text.
What does Article 23(2) actually say?
Article 23 is headed 인공지능 투명성 확보 의무, the duty to secure AI transparency. Paragraph 2 reads:
제23조(인공지능 투명성 확보 의무) ② 인공지능사업자가 법 제31조제2항에 따른 표시를 할 때에는 다음 각 호의 어느 하나에 해당하는 방법으로 할 수 있다. 1. 사람이 인식할 수 있는 방법 2. 기계가 판독할 수 있는 방법. 이 경우 그 결과물이 생성형 인공지능에 의하여 생성되었다는 사실을 1회 이상 안내 문구ㆍ음성 등으로 제공해야 한다.
Enforcement Decree, Article 23(2)
In English: Article 23 (Duty to Secure AI Transparency), paragraph 2. Where an AI business operator makes the indication under Article 31(2) of the Act, it may do so by either of the following methods: 1. a method perceivable by humans; 2. a machine-readable method. In that case, the fact that the output was generated by generative AI must be provided at least once by way of a notice text, audio or the like.
Read the structure rather than the list. Two methods are offered, which looks like a free choice, and the final sentence then attaches a condition to the second one. Take the human-perceivable route and you are done. Take the machine-readable route and you owe a human-facing signal too, at least once, in text or audio.
The phrase doing the work is 1회 이상, at least once. Once is the floor, and the decree does not say where in the experience it has to land, which makes placement a product decision rather than a legal one.
| Marking route | Decree wording | Condition attached by the same paragraph |
|---|---|---|
| Route 1, human-perceivable | 사람이 인식할 수 있는 방법, a method perceivable by humans | None stated in Article 23(2). The paragraph attaches no further sentence to this limb. |
| Route 2, machine-readable | 기계가 판독할 수 있는 방법, a machine-readable method | The fact that the output was generated by generative AI must be provided at least once (1회 이상) by way of a notice text, audio or the like. |
Both rows are read straight off the paragraph quoted above. The table is a reading of the Korean text, not a comparison with other regimes.
Who is on the hook?
The obligation runs to the 인공지능사업자 (AI business operator). The Framework Act uses that term for entities engaged in developing or providing AI, but whether a specific company meets the definition in a given fact pattern, especially where multiple parties touch the same system or asset, requires separate legal analysis. This piece does not resolve that allocation question for particular business models or foreign providers.
What the paragraph does settle is the shape of the duty once it attaches. It is a duty about how the indication is made, not about who saw it, and the condition on the machine-readable limb sits in the same sentence as the permission. Any team reading Article 23(2) should read both halves of that sentence together.
Why a C2PA-style implementation fails this test
Most serious provenance work over the past two years went into embedded, cryptographically signed metadata. Good engineering, and exactly the kind of marking the second limb of Article 23(2) contemplates. On its own it is still not compliant in Korea. The invisible route carries an attached condition, and a metadata-only pipeline meets the first half of the sentence while ignoring the second. A team reporting full coverage on provenance signing may be reporting on the wrong half.
The fix is usually small. A one-time notice on first generation in a session, a short line under the output, or a spoken cue at the head of synthesised audio. The decree's reference to 안내 문구 and 음성, notice text and audio, points at exactly those. The work is proving it fires and keeping it firing, because re-encoding, cropping and most upload pipelines destroy embedded provenance while a rendered notice survives more of that chain.
Does machine-readable metadata alone satisfy other regimes?
That is a separate question for each jurisdiction. The decree text itself addresses only the Korean rule; whether machine-readable metadata alone satisfies synthetic-content disclosure duties under the EU AI Act, Chinese measures, US state rules or other frameworks is a separate analysis this piece does not cover and should be confirmed with counsel.
The practical consequence for a global product is narrower than it sounds. It is not that Korea is stricter or looser than anywhere else. It is that a single labelling switch, set once and shipped to every market, is an assumption rather than a finding. The Korean text quoted above is the only one this article opened, and it is the only one it speaks to.
What a product team should do about it
If you ship generative output to Korean users, the sequence is short.
- Find out what your current label actually is. In many stacks the honest answer is embedded metadata plus a line in the terms of service, which is not a notice under Article 23(2).
- If the answer was metadata-only, add a human-facing cue on the Korean surface: text under the output, a first-run notice in the session, or a spoken cue for synthesised audio.
- Test that it survives your own pipeline. Generate, export, re-import, share. If the cue drops at any hop, the once has not happened where the user is.
- Record where the cue fires and keep a screenshot. That evidence is the artefact you will be asked for.
- Handle the foreign-provider question separately; any domestic-representative or market-access requirements sit outside Article 23(2) and need their own analysis.
None of this is a rebuild. A disclosure surface, a test, a record. Do it now rather than at the next compliance review, because the decree is in force and there is no runway to point at.
What this decree does not settle
The commencement date, the decree number and the Article 23 text are firm. The rest of the July amendment is not something I can characterise from the primary source, because the promulgated amendment text for Decree No. 36506 was not in the national portal's amendment view at the time of writing. Secondary Korean reporting describes further changes; that is not authority for an obligation, so this piece does not repeat it.
The quoted text leaves two things open. It does not say where in a multi-step flow the notice has to appear, and it does not resolve who bears the duty when a model vendor, a platform and a brand all touch the same asset. Settle those in contracts first.
Frequently asked questions
When did Presidential Decree No. 36506 take effect?
It was promulgated on 20 July 2026 as a partial amendment and took effect on 21 July 2026, per the header line on Korea's national law portal: 시행 2026. 7. 21., 대통령령 제36506호, 2026. 7. 20., 일부개정.
Is embedded C2PA-style metadata enough to comply with Korea's generative AI labelling rule?
No. Article 23(2) of the Enforcement Decree lets an AI business operator use either a human-perceivable method or a machine-readable one, but where the machine-readable route is used, the fact that the output was generated by generative AI must still be provided at least once by a notice text, audio or the like. A metadata-only pipeline misses that second half.
Does this apply to a US company with no office in Korea?
The Enforcement Decree implements the Framework Act, which applies to AI business operators within its statutory scope. A US product shipping generative features to Korean users should treat the Article 23(2) duty as potentially in scope and confirm both applicability and any separate representative or market-entry questions with Korean counsel.
Last verified: July 28, 2026