Korea AI Basic Act AI vendor contract AI procurement generative AI contract checklist

Korea's AI Basic Act: 9 Contract Checks for AI Vendors and Buyers (2026)

A practical checklist for AI contracts connected to Korea: supplier roles, training data, user notices, high-impact AI, model changes, incident response, and exit terms.

AiDocX Team · AiDocX Editorial November 5, 2026 10 min read

Korea's AI Basic Act: 9 Contract Checks for AI Vendors and Buyers (2026)

Quick summary: Before signing an AI vendor agreement, identify who provides the AI feature, what happens to prompts and outputs, who handles user notices, how model changes are disclosed, and what support is available after an incident. This guide turns those questions into a nine-point contract checklist.

Scope note: This article summarizes South Korea's AI Basic Act. It is not a guide to Thai, US, EU, or other jurisdictions, and it does not determine whether the Act applies to a particular foreign company. Applicability depends on the service, the parties' roles, and the facts.

South Korea's Act on the Development of Artificial Intelligence and the Establishment of Trust, commonly called the AI Basic Act, took effect on January 22, 2026. That does not mean every company that uses an AI tool has the same duties. The legal analysis can differ between a company using an outside tool for internal work and a company offering an AI-powered feature to customers.

A contract cannot decide a company's legal status just by labeling it a “user” or “provider.” The product, the actual service, the data flows, and each party's role matter. The checklist below is a practical way to document those facts and allocate day-to-day work. It is not a list of clauses mandated by the Act.

Method and disclosure: This AI-assisted draft was checked against the Korean statute and official AI Basic Act guidance available on November 5, 2026. It is practical information, not legal advice or a legal review of a specific service.

First, distinguish internal use from providing an AI service

Using an external generative AI tool to draft an internal meeting summary is different from integrating an AI model into a product and offering that product to customers. Korea's official guidance distinguishes people and companies using an AI service from AI business operators that provide AI products or services. Other laws, privacy obligations, and the vendor's terms can still apply to internal use.

Work pattern	What to check first
Employees use an external AI tool for internal drafts	Vendor terms, company data rules, and whether confidential or personal information may be entered
A company builds and offers its own AI feature	The company's role, user notices, and whether high-impact AI rules may be relevant
A company embeds an outside model in a product for customers	The division of work between model supplier and product provider, customer notices, and operational responsibility
AI is used in a field that can affect safety or fundamental rights	Whether the system falls within the Act's high-impact AI definition and what supporting information is needed

The examples do not automatically determine legal status. If a service is near the boundary, review its actual function, intended users, decision-making role, and supply chain. Use the official AI Basic Act Support Desk and obtain Korean legal advice where the consequences matter.

Nine checks for an AI vendor contract

The Act does not provide a universal contract template with these nine clauses. Treat the list as a negotiation and procurement checklist. Put each answer in the agreement, a data-processing addendum, a service description, a security exhibit, or another document that both parties can access.

No.	Contract topic	Question for the supplier
1	Product and permitted use	Which AI model and features are included, and for what users and purposes?
2	Party roles	Who develops, operates, provides, and supports the AI feature?
3	Prompts, outputs, and training	Are inputs or outputs stored, used for model training, or used to improve services?
4	User notices and labels	Which features require notices or output labels, and who maintains them?
5	High-impact AI review	What assessment has been done, and what evidence can the supplier provide?
6	Human review and complaints	Can users review, correct, reject, or report an AI result?
7	Model and service changes	How are model, data, feature, and subprocessor changes announced?
8	Security, incidents, and records	What access controls, incident notices, logs, and investigation support are included?
9	Outputs, liability, and exit	Who may use outputs, how are claims handled, and how can data be exported or deleted?

1. Define the product and its boundaries

“Use of an AI service” is too broad if the parties are buying a specific feature. Identify the service name, included functions, intended users, permitted purposes, and excluded use cases. If the supplier can switch models, say whether it must notify the customer and whether the customer can test a material change.

Describe the workflow rather than using a vague phrase such as “business productivity.” Drafting an internal customer-support response is different from scoring a person for a loan. A precise use description helps the supplier explain its safeguards and helps the buyer control how employees use the service.

2. Document how prompts and outputs are handled

Ask whether prompts, uploaded documents, and generated outputs are retained in logs, how long they remain, and whether they are used to train a general model or improve a service for other customers. “We use industry-standard security” does not answer those questions.

If personal information or trade secrets may be entered, also confirm storage locations, subprocessors, access rights, deletion timing, and incident procedures. An AI clause does not replace a separate review of privacy laws or data-processing requirements.

3. Assign responsibility for user notices and output labels

Article 31 of the Korean AI Basic Act addresses transparency duties for relevant AI products and services. Those duties do not apply identically to every person who uses an AI tool. The parties should identify which functions may require a notice that AI is being used or a label on generated output, then decide who implements and updates the notice.

For example, a supplier may document which features use generative or high-impact AI and provide approved notice text. A customer may be responsible for placing the notice in its own product interface. The agreement should also say who updates that text when a feature or model changes.

4. Agree on information for a high-impact AI assessment

The Act defines high-impact AI by reference to potential effects on people's life, physical safety, or fundamental rights and to specified fields of use. Hiring and credit decisions are examples that warrant careful review. A feature's marketing name alone is not enough to classify it.

An AI business operator should first assess whether the system may be high-impact. If it requests confirmation from the Ministry of Science and ICT, the current procedure calls for information such as a product or service overview, an overview of training data, and materials showing how the system is used and what it produces. The customer can ask the supplier to provide the technical facts needed for that review. See the Ministry's high-impact AI confirmation process.

5. Keep a workable human review path

Decide who can review, edit, reject, or escalate an AI result. For decisions that can materially affect an individual, do not rely on a general statement that “a human is responsible.” Specify the review step, the person or team that performs it, and how a user can report an error.

The supplier can provide an error-reporting channel and records needed for an investigation. The customer can assign an owner and define when employees must pause an automated workflow for review. Ask to see the actual interface so reviewers can understand the output and its limits.

6. Set rules for material model or service changes

A vendor may change its model, prompts, data processing, features, or subprocessors. Define which changes count as material, how the supplier will announce them, and whether the customer receives time to test or reassess the change.

A notice period is a negotiated term, not a single number prescribed for every service by the Act. Consider keeping change history, offering a test environment, identifying a version retirement date, and allowing an exit if a change makes the service unsuitable.

7. Set measurable quality expectations

Avoid a promise that AI will always be correct. Instead, agree on test methods, known limitations, supported languages and file formats, service availability, and how errors are handled. Test the service with realistic examples before launch and keep the results.

If a supplier claims “99% accuracy,” ask what was measured, on which data, and under what conditions. For document review, an omission rate may matter more than a generic accuracy score. Where a quality guarantee is not practical, define support, reprocessing, service credits, or other remedies.

8. Define incident response and records

Confirm who receives a security or service incident notice, what details it must include, how quickly the parties will cooperate, and which logs may be shared for an investigation. If request-and-response logs contain customer text, set access, retention, and deletion controls.

The supplier may handle technical investigation while the customer identifies affected users and manages its own communications. The agreement should make those responsibilities clear and include a support contact, outage notice, and recovery expectations.

9. Cover output rights, liability, and exit

Clarify how the customer may use AI-generated text, images, or other outputs. Decide how the parties will respond to a third-party rights claim, what each party must disclose, and how responsibility is allocated when a problem results from customer-provided materials or instructions.

At termination, specify whether the customer can export prompts and outputs, when the supplier deletes them, and whether the supplier can confirm deletion. Include a transition period if the service is discontinued or a model is replaced. These terms make it easier to leave without losing business records.

Six questions to send before the vendor meeting

Send these questions before contract negotiations so the supplier can prepare concrete answers and documents:

Which AI functions are we buying, and which functions does the supplier operate?
Where are prompts and outputs stored, and are they used for training?
Which functions may require an AI notice or output label, and who maintains it?
Has the supplier assessed whether any function may be high-impact AI? What evidence supports the assessment?
How will the supplier notify us about material model, feature, or subprocessor changes?
If an incident occurs, who contacts whom, which logs are available, and when can data be deleted?

Not every open question means the vendor is unsuitable. Separate items that must be settled before launch from items that can be managed through a documented process. Internal drafting tools may make data use the first priority; customer-facing AI features may require more attention to notices, oversight, and user complaints.

Sample language for data use

This is a negotiation starting point, not a required statutory clause. Adapt it to the service's actual data flow and have counsel review it.

The supplier will describe in an exhibit the purposes for which customer data is processed, the retention period, any subprocessors, and whether the data is used for model training. The supplier may use customer data or service outputs for model training or disclosure to a third party only as separately agreed by the parties. Before changing the processing purpose or subprocessor list, the supplier will notify the customer and provide a process for changing settings or ending the service.

A clause alone does not prove that a product setting matches the agreement. Confirm that training can be disabled where promised, that subprocessors are listed, and that the administrative settings match the contract.

Frequently asked questions

Does using an external AI tool at work automatically create a notice duty?

Not necessarily. Using an AI service internally is different from providing an AI product or service to customers. Korea's official guidance distinguishes AI service users from businesses that provide AI products and services. Data security, privacy, intellectual property, and vendor terms still need review.

Does every AI-generated result need a visible label?

No single answer covers every service. Check who provides the product, whether the relevant AI is generative or high-impact, and how the result reaches users. The official transparency guidance explains the current approach.

Can the parties transfer every legal duty by contract?

A contract can allocate tasks, evidence, costs, and responses between the parties. It cannot make legal status depend only on a label in the agreement. Review the actual service and each party's conduct; each party remains responsible for duties that apply to it.

Wrap-up

Start with the real workflow: who supplies the AI feature, what data enters it, what users see, and what happens when the model or service changes. Record the answers in the contract and supporting documents. The nine checks above help procurement, product, security, and legal teams review the same facts.

If you need to prepare related business documents and send them for electronic signature, see the document tools at AiDocX. The Korean AI Basic Act may apply differently depending on the parties and service, so have Korean counsel review material deployments.