xsoft complyKorea's AI Basic Act · Self-assessment and operational records
Organise AI operating records for review
Identify the provisions that may be relevant through a structured self-assessment, then record execution, decision and human-review events through the SDK. Conversation content is not transmitted under the default configuration.
The product interface is currently available in Korean only. English documentation is being prepared.
For organisations assessing AI-related obligations in Korea
The Republic of Korea's Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (the "AI Basic Act") entered into force on 22 January 2026. Article 4 provides that the Act applies to conduct outside Korea where that conduct affects the Korean market or users in Korea.
Global AI governance platforms
Add Korea-related capabilities through a local provider offering statute mapping and an operational record layer for Articles 31 to 36.
Law firms and advisory practices
Provide clients with a practical way to retain records relating to the measures on which you advise, without transmitting conversation content under the default configuration.
AI business operators serving users in Korea
Retain records of applicable user notices, output labelling and human oversight as part of normal operations.
Provisions covered by the self-assessment
Whether a provision applies depends on the AI system, the relevant circumstances and the information entered in the self-assessment.
- Article 31Obligation to ensure AI transparency
- Article 32Obligation to ensure AI safety
- Article 33Confirmation of high-impact AI status
- Article 34Responsibilities of business operators in relation to high-impact AI
- Article 35High-impact AI impact assessment
- Article 36Appointment of a domestic representative
Assess, record and compile
Register AI systems and complete the self-assessment
Register each AI system and answer the self-assessment questions. The product identifies provisions that may require review and presents follow-up steps for each system.
Collect operating records through the SDK
Once the Python SDK is connected, execution, decision and human-review events are recorded by provision. Collection coverage and record integrity status are shown for each system.
Export selected records
Records received through the SDK and documents uploaded by the organisation are kept separate. Selected items are exported as a ZIP archive organised by source, with a hash list.
How organisational data is handled
The product is designed to collect the information needed to create operating records and to retain those records in a form that supports subsequent integrity checks.
No conversation content by default
Conversation, prompt and response content is not transmitted under the default configuration. Metadata and hashes needed for the record are retained.
Organisation-level access restrictions
Database access policies restrict access by organisation.
Role-based access
Access rights differ by role within the organisation.
Hash retention
A hash is computed for each operating record received through the SDK, and related records are linked within an execution flow.
Fail-open design
The SDK operates on a fail-open basis. A collection failure does not interrupt the main flow of the customer's service.
Published assessment rules
The self-assessment rules are published on the methodology page (Korean).
Partnership
We are interested in working with AI governance platforms, law firms and advisory practices that need Korea-related capabilities. Potential arrangements may include a statute mapping for Articles 31 to 36, integration of the SDK record layer and referrals involving organisations that need to retain operating records in Korea.
xsoft comply does not act as a domestic representative under Article 36 and does not provide legal advice.
Partnership enquiries
Email contact@xsoftcomply.comPlease include your name, organisation and organisation type.
Important notice
xsoft comply organises an organisation's self-assessment status and operating records by reference to the Act and predefined rules. Results are presented with the relevant provisions. The results provide status information for internal review and follow-up and do not constitute legal conclusions, legal advice, certification or a guarantee of compliance.