South Korea AI rules mapped to NIST AI RMF
Each row is one legal duty recorded for South Korea and the function of NIST AI Risk Management Framework 1.0 it corresponds to. Use it to find which duties your existing evidence already reaches.
Coverage of this crosswalk
9 of 9 recorded South Korea duties carry a mapping
The denominator is the number of duties this platform has broken out for South Korea, not the number of duties the law contains. Unmapped duties are ones no reviewer has crosswalked yet, not ones the standard fails to address.
The mapping
| Legal duty | Binding? | NIST AI RMF function | Why they correspond | Confidence |
|---|---|---|---|---|
| AI business operators must notify users in advance that a product or service runs on high-impact or generative AI AI Basic Act, Article 31(1) | Legal requirement | GOVERN 5.1, MANAGE 4.1 | Transparency to end users. | medium |
| AI business operators must label generative AI output and clearly flag realistic synthetic media AI Basic Act, Article 31(2) and 31(3) | Legal requirement | MEASURE 2.7, MANAGE 4.1 | Content provenance as described in NIST AI 600-1. | medium |
| Operators of AI above the compute threshold must run lifecycle risk management and report safety results AI Basic Act, Article 32 | Legal requirement | MAP 5.1, MEASURE 2.6, MANAGE 1.3, MANAGE 4.3 | Safety evaluation, risk treatment and incident response. | medium |
| Operators of high-impact AI must establish and operate a risk management plan AI Basic Act, Article 34(1) | Legal requirement | MAP 1.5, MANAGE 1.3 | Risk tolerance and treatment. | medium |
| Operators of high-impact AI must be able to explain outputs and the main criteria behind them AI Basic Act, Article 34(1) | Legal requirement | MEASURE 2.9, GOVERN 5.1 | Explainability and communication to affected parties. | medium |
| Operators of high-impact AI must ensure human management and supervision AI Basic Act, Article 34(1) | Legal requirement | GOVERN 3.2, MANAGE 2.4 | Human-AI configuration and override mechanisms. | medium |
| Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures AI Basic Act, Article 34(1) | Legal requirement | GOVERN 1.4, MANAGE 4.1 | Documentation and post-deployment user protection. | medium |
| Operators of high-impact AI should assess its impact on fundamental rights before use AI Basic Act, Article 35 | Voluntary | MAP 5.1, MAP 5.2 | Impact characterisation and engagement. | medium |
| Foreign AI business operators above the threshold must designate a domestic representative in Korea AI Basic Act, Article 36 | Legal requirement | GOVERN 2.1 | Roles and responsibilities. | low |
What a mapping means
The duty and the function ask for overlapping work, so evidence produced for one is likely to be reusable for the other. Confidence records how direct that overlap is.
What it does not mean
NIST AI RMF adoption does not discharge a legal duty and carries no force in South Korea. A mapped row still has to be complied with on the statute's own terms.
Instruments in this crosswalk
- AI Basic Act — South Korea
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Does NIST AI RMF adoption satisfy South Korea AI rules?
No. NIST AI RMF is a voluntary framework and carries no legal force in South Korea. This crosswalk records that 9 of the 9 duties tracked here have a corresponding clause, which means the evidence may be reusable, not that the duty is discharged.
How many South Korea AI duties map to NIST AI RMF?
9 of 9 duties recorded for South Korea carry a mapping to NIST AI Risk Management Framework 1.0.