Operators of high-impact AI must establish and operate a risk management plan

Practical action

Classify systems against the high-impact areas and write a risk management plan for each one before launch.

Who does it apply to?

AI business operators providing high-impact AI or products and services based on it; operators may ask the ministry to confirm whether a system is high-impact under Article 33.

Actors

Provider / developerDeployer / user organisationPublic authority / government body

Sectors

Cross-sector / all sectorsEmployment and HRFinancial services and creditHealthcare and life sciencesEducation and trainingPublic services and governmentCritical infrastructure and utilities

Use cases

AI in hiring and employmentBiometrics and facial recognitionAI in healthcareAI in finance, credit and insuranceAI in educationAI in public servicesSafety-critical and infrastructure

Applies from: 22 January 2026

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessAI system owner · once per ai system
  AI risk assessment and lifecycle risk register

  Serves 12 recorded duties · evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance

  Per-system risk plan with identified risks and treatments.

• supportsProcessAI governance lead · continuous
  AI system inventory and classification

  Serves 11 recorded duties · evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure

  Classification of systems against the high-impact list.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Risk Register (MIT AI Risk Repository taxonomy)

  Register · XLSX · v4

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v5

All 7 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every South Korea duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Operators of high-impact AI must establish and operate a risk management plan (AI Basic Act)” [AIPT-OBL-0063, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0063 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0063: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676), Korea Ministry of Government Legislation, National Law Information Center, https://www.law.go.kr/lsInfoP.do?lsiSeq=268543.

@misc{aipolicytracker2026_operatorsofhighimpactaim,
  author       = {{AIPolicyTracker}},
  title        = {{Operators of high-impact AI must establish and operate a risk management plan (AI Basic Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan}},
  url          = {https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Deployers must implement a risk management policy and programme — Colorado AI Act, Colorado (United States)
• Deployers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Apply minimum risk-management practices to high-impact AI — OMB M-25-21, United States
• Establish a risk management system for high-risk AI — EU AI Act, European Union
• Developers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Ensure AI systems are safe, secure and robust throughout their lifecycle — UK AI regulation framework, United Kingdom (voluntary)
• Prioritise, respond to and monitor AI risks (Manage) — NIST AI RMF, United States (voluntary)