Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures

Practical action

Write a user-protection plan for each high-impact system and keep a dated file of the safety and trust measures applied to it.

Who does it apply to?

AI business operators providing high-impact AI or products and services based on it.

Actors

Provider / developerDeployer / user organisationPublic authority / government body

Sectors

Cross-sector / all sectorsEmployment and HRFinancial services and creditHealthcare and life sciencesEducation and trainingPublic services and government

Use cases

AI in hiring and employmentAI in healthcareAI in finance, credit and insuranceAI in educationAI in public services

Applies from: 22 January 2026

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessProduct or model owner · at launch and on material change
  Technical documentation, model cards and instructions for use

  Serves 14 recorded duties · evidence: Technical documentation file, Model card or deployer information pack, Instructions for use

  Documentation of safety and reliability measures.

• supportsPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  User-protection plan and ownership.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• AI Acceptable Use Policy

  Policy · DOCX · v1

• AI Governance Policy and RACI

  Policy · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

All 10 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every South Korea duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures (AI Basic Act)” [AIPT-OBL-0066, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0066 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0066: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676), Korea Ministry of Government Legislation, National Law Information Center, https://www.law.go.kr/lsInfoP.do?lsiSeq=268543.

@misc{aipolicytracker2026_operatorsofhighimpactaim,
  author       = {{AIPolicyTracker}},
  title        = {{Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures (AI Basic Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation}},
  url          = {https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Use high-risk AI as instructed, monitor it and inform affected people — EU AI Act, European Union
• Providers must meet the full set of provider duties for high-risk AI — EU AI Act, European Union
• Providers must supply conformity evidence and log access to authorities on request — EU AI Act, European Union
• Non-EU providers must appoint an EU authorised representative for high-risk AI — EU AI Act, European Union
• Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI — EU AI Act, European Union
• Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually — EU AI Act, European Union
• Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold — EU AI Act, European Union
• Non-EU providers of GPAI models must appoint an EU authorised representative — EU AI Act, European Union