Executive Summary

Key numbers

Four cells. The first two cover the line this amendment draws, the count of grounds for holding data back and the date that line starts to apply. The second two cover how much AI Hub holds today and how many platforms the Data Industry Act amendment that passed the same day sets out to connect.

Sources: Techworld (13 Oct 2026), Financial News, AI Times. All in Korean.

Korea's Cabinet approved amendments to two acts on 13 October 2026. One is the Framework Act on the Development of Artificial Intelligence and the Establishment of Trust, known as the AI Framework Act. The other is the Framework Act on Promotion of Data Industry and Facilitation of Data Utilization, known as the Data Industry Act. Both fall to the Ministry of Science and ICT, and both take effect six months after promulgation, in April 2027.

In the AI Framework Act the change comes down to one sentence. AI training data built or produced in the course of a government project has to be linked and delivered to AI Hub. AI Hub is the open platform for AI training data that the ministry has run since 2018, and 945 datasets from government projects sat on it at the end of 2025. Every one of those 945 arrived because a project chose to send it. From April 2027, sending becomes the rule.

Imposing the duty is not the whole of it. The amendment also has the minister of science and ICT and the heads of the relevant central agencies provide administrative, financial and technical support, and take the measures needed for stable quality control of the training data that arrives. The structure asks for the data, helps with the sending, and manages what comes in.

The government's own account points the same way. Eom Yeol, who heads the AI policy office at the Ministry of Science and ICT, said that "to raise competitiveness in artificial intelligence, what matters is securing high-quality AI training data and at the same time building a base where the public can easily find and use the data they need." Securing and reaching, two things at once, and the Data Industry Act amendment that passed the same day takes care of the second.

An exemption clause is attached right next to the duty. Where the party carrying out the project judges that one of the grounds set by presidential decree applies, namely protection of trade secrets, infringement of personal data, infringement of copyright or national security, it does not have to link and deliver. None of the four is a pretext bolted on. Each one is a wall that opening public data has always run into. Video with people's faces in it, measurements a company pulled off its own production line, a text corpus bought from outside, records that touch defense or security. If all of that had to be published, the project itself would stop working.

The trouble is not that an exemption exists but who judges it first. The clause reads "where the party carrying out the project and the like judges that it falls under." No outside review or prior approval shows up. Once the organization that has to deliver decides on its own that something is a trade secret, the duty to deliver stops at that step.

The diagram below lays that structure out in a line. A government project makes the data on the left, a gate in the middle sorts by whether one of the four grounds applies, and only what gets through reaches AI Hub on the right. Whoever keeps the gate is the same party that has to hand the data over.

Self-judgment does not have to be read as bad faith. The organization that built a dataset does know best where personal data is mixed in and which stretch touches a trade secret. Moving the judgment outside puts the time and cost of review straight onto the project schedule. Still, when the one that knows best and the one least inclined to deliver are the same, a separate question remains: who goes back afterward and checks whether the judgment was right.

Looked at again, the four turn out not to be a closed list. The clause says "protection of trade secrets, infringement of personal data, infringement of copyright, national security and other grounds set by presidential decree." The act carries four names. What falls inside each name, and whether the list grows longer, belongs to the decree.

From here on this is the article's own reading. The same four words land in two different places depending on how wide their scope is drawn. If "trade secret" covers whatever a company designates as secret, nearly all data from projects with private partners can fall away. If it is narrowed to cases where concrete competitive harm from disclosure can be shown, companies grow reluctant to bring their data into a government project at all. The clause as it stands settles neither direction, and the day it does settle is the day the subordinate rules come out.

The phrase "and other" is not only in the exemption clause. The duty names its target as training data built or produced "in the course of government projects and the like." Whether that means national R&D projects alone, or reaches local-government work and the projects of state-funded institutes, does not separate out from the clause as written. A team already running a project and asking whether their work is covered will find the answer in those same subordinate rules.

One more cell is empty. The amendment calls for the measures needed for quality control, and yet nothing in the published material says on what standard, or against what, those measures get carried out. The duty switches on first, while the receiving side has no settled test for what it lets through.

This gap is not a light one, because AI Hub's record has already shown it once. Korea Data Economy News reported in an analysis on 15 October that all six datasets built by Gyeonggi Province and the Korea Expressway Corporation and sampled by the Board of Audit and Inspection fell short of the ministry's quality standard, and that 213 of the 908 datasets published on AI Hub came from suppliers that had gone out of business. Those figures were checked in that one outlet, and not against the audit report itself. They also count on a different date and over a different scope from the 945 noted earlier, so the two should not be set side by side and subtracted.

Whatever the exact digits, the plain fact that data whose supplier has disappeared still sits on the platform is worth a thought. Nobody is left to fix that data when something goes wrong with it, and learning that this is the state of things takes somebody looking in regularly. Once mandatory delivery starts, the volume arriving rises. If the standard on the receiving side does not firm up alongside it, what grows is the length of the listing rather than the stock of usable data.

The Data Industry Act amendment that passed the same day touches a different part of the problem. It lets the minister of science and ICT ask public institutions and private corporations to cooperate in connecting information about where data sits, and it has public institutions comply unless they have a particular reason not to. The request covers location information, the record of what is held where, rather than the data itself.

The two parties on the receiving end of such a request do not carry the same weight. Public institutions have to comply absent a particular reason, while no sentence places the same duty on private corporations. Even in gathering a map of where data sits, the public side opens first and the private side is invited to cooperate.

The place that would take it in is already up and running. One-Window is an integrated search service for public and private data, operating since 2025, and as of August 2026 it connects 88 platforms, 73 public and 15 private. Sites that had to be entered separately until now, the Public Data Portal or the financial big-data platform among them, come up in one place. This amendment turns that connection from a favor into a request with a footing under it.

Those 88 are not every data platform in the country. In the analysis cited above, Korea Data Economy News noted that the Korea AI Action Plan, published by the National AI Strategy Committee in February, put the number of domestic data platforms at around 200 while finding no standard for connecting them. The two counts come from different bodies on different bases, so subtracting one from the other and calling the remainder 112 unconnected platforms does not hold. It does suggest, at least, that platforms remain to be joined up.

A wider path for finding data is a real gain. The gain lands on the path for finding where data sits. Data held back from AI Hub on one of the four grounds never enters any catalog to begin with, so 88 platforms could become 880 and that spot would still not show up in the results. The two amendments passed on the same day, and they opened different doors.

A principle, that training data built with public money gets shared, and an exemption, that four grounds mean it does not, went into the same clause. Writing a principle together with its exemption is ordinary enough in legislation. It changes when the project itself judges first whether the exemption applies and the clause shows no procedure for checking that judgment afterward. The real width of the opening then gets decided in each project's judgment rather than in the act.

The question left with the reader is this one. If data built with my taxes reaches AI Hub, how would I know, and if it never arrives, who checks which of the four grounds took it out. The clause as written and the material published so far make that checking procedure hard to find. Data that was held back is not on the listing, and counting what is not on a listing means knowing separately what was made in the first place.

Pebblous has run that comparison once already. When the training data from the five teams building sovereign AI foundation models was opened on AI Hub in August, matching the attachment to the press release against the AI Hub listing item by item showed different record counts and volumes for the same dataset in the two records (Korea Opened Its Sovereign AI Training Data. Two Official Records Count It Differently., 29 August 2026). That time the counting came apart. This time data never reaches one of the listings at all. The nature differs and the method of checking stays the same: set the announced listing beside the published one and match the items.

The work Pebblous has done lies in judging whether collected data is in a state fit for learning and filtering out what is not. From that seat, the duty in this amendment is a welcome line, and the place where a quality standard belongs is a cell nobody has put a value in yet. Either way the next place to look is clear: how wide the draft decree draws the four grounds, and how the published listing on AI Hub actually grows after April 2027.

Thank you for reading this far. The original coverage of the amendment's passage is here, in Korean. If you have built data on a government project, we would like to hear which of the four grounds you think bites first in practice.

R.1Government Announcement Coverage

• 1.Kim Seung-ki. (13 Oct 2026). "AI Framework Act and Data Industry Act Amendments Clear Cabinet Review." Techworld. (in Korean)
• 2.Kim Hae-won. (13 Oct 2026). "AI Data Built With Taxpayer Money Becomes Mandatory to Disclose, as AI Framework Act Amendment Passes." AI Times. (in Korean)
• 3.Yeon Ji-an. (13 Oct 2026). "AI Framework Act and Data Industry Act Amendments, Expanding Access to AI Data, Clear Cabinet Review." Financial News. (in Korean)

R.2Independent Analysis

• 4.Park Jin-chul. (15 Oct 2026). "[Exclusive Analysis] The Era of Mandatory AI Training Data Delivery — A Breakdown of the AI Framework Act Amendment." Korea Data Economy News. (in Korean)

R.3Background Context

• 5.Lee Seong-yeop (Professor, Korea University; Chair, Korea Information and Communication Law Association). (4 Feb 2026). "Issues and Challenges Under the AI Framework Act's Enforcement." Lawtimes. (in Korean; context only — on the act's self-judged "high-impact AI" exemption pattern, not quoted directly)