Executive Summary

When comparing regulations, people usually look at the nominal effective date. But for rules that place real duties on operators — as high-impact AI does — "when the obligations actually bind" matters far more than "when the law passed." Lining up Korea, the EU, and the U.S. by that real activation date, as of 2026 only two jurisdictions are actually enforcing high-impact AI rules: Korea and New York City.

The timeline below overlays each jurisdiction's nominal schedule and its real activation point on a single axis. While Korea flips the switch in July 2026, the EU has pushed its most contested high-risk duties to the right, and Colorado repealed its original bill outright before it ever took effect.

Korea's Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation of Trust took effect in its base form on January 22, 2026, but the high-impact rules only became live obligations when the amended act and enforcement decree that fleshed out operator duties cleared the Cabinet on July 14 and came into force on July 21. The EU, by contrast, delayed the use-case-based high-risk obligations (Annex III) by 16 months, from August 2, 2026, to December 2, 2027, through the "Digital Omnibus" amendment approved by the European Parliament on June 16. Split each jurisdiction's schedule into the nominal date and the date the rules actually bind, and the gap between the two is stark.

The weight of the delay lies in more than its timing. Because the EU amendment does not apply retroactively, concern has been raised that high-risk systems placed on the market before December 2027 may permanently escape the new obligations. It isn't just that the rules switch on a year late — it's that a large share of systems deployed in the interim stay outside the regulatory net.

The U.S. tells yet another story. Colorado's original bill (SB24-205) was repealed in May 2026, just ahead of taking effect, and a redefined successor (SB26-189) was pushed to January 1, 2027. The only place actively enforcing use-stage regulation into its third year is New York City, with its bias audit for hiring AI (Local Law 144). "World's first" is always a claim to treat with care, but at least in switching on binding rules for AI that judges people's credit, health, and jobs, Korea's lead is no exaggeration.

Article 2(4) of the Act enumerates ten domains and classifies as high-impact any AI that, within them, may materially affect people's life, physical safety, or fundamental rights. The listed domains are energy, drinking water, healthcare and medical devices, nuclear power, biometrics, hiring, assessment of individual rights such as loan screening, transportation, public services, and student evaluation. Reread that list through a data team's eyes and one axis stands out: four of these domains ultimately come down to "judging people from data," and that is precisely where bias turns into an infringement of fundamental rights.

Break the ten domains down by representative use case, core data risk, the evidence a safety dossier requires, and where Korea and the EU diverge, and one thing stands out: Korea's designated scope is narrower than the EU's. In finance, Korea covers only "loan screening" while the EU covers creditworthiness assessment broadly; in employment, Korea covers only "hiring" while the EU extends to worker management such as performance and termination.

Footnote: the definition of "AI operator" is very broad, covering not only developers but also businesses that adopt AI to deliver a service (e.g., a bank using a loan-screening model). A single operator can overlap developer, user, and high-impact roles. High-impact status is determined first by the operator's own assessment and, where uncertain, through consultation with the Ministry of Science and ICT's "AI Basic Act Help Desk." Systems where a human can ultimately intervene and retain control may be excluded.

2.1Bias Comes from the Data, Not the Model

The reason the regulation aims its questions at data is a fact that academic research has confirmed again and again. The most widely cited case is in medical AI. A commercial U.S. algorithm learned to predict patients' health needs using "healthcare spending" as a proxy. But because Black patients have historically spent less on care at the same level of illness, the algorithm systematically under-classified them. When the proxy was redesigned to reflect health itself, the share of Black patients flagged for additional care jumped from 17.7% to 46.5% (Obermeyer et al., Science, 2019). The source of the bias was the label definition in the training data, not the model architecture.

Biometrics shows the same grain. A study that measured the error rates of commercial facial-analysis systems broken out by gender and skin tone found that accuracy — near-perfect for lighter-skinned men — collapsed for darker-skinned women (Buolamwini & Gebru, Gender Shades, 2018). A data problem — the underrepresentation of certain demographic groups in the training set — surfaced directly as a performance gap. In credit scoring, too, a "fairness paradox" is reported: even after removing sensitive attributes, discrimination reappears through proxies such as ZIP code and purchase history.

The duties imposed on high-impact AI operators fall into two broad tracks: impact assessment, and securing safety and reliability. The two are different in nature, and missing that difference throws off the priorities of preparation. Impact assessment is closer to a best-efforts duty than a hard mandate. In exchange, it is designed so that public bodies must give preference to products and services that have completed an impact assessment when procuring — which effectively makes it a qualification for entering the public market.

The real center of gravity is on the safety-and-reliability side. Under Article 8 of the draft duty notice, an operator must document the measures it has taken in a "safety-and-trust dossier," retain it for five years, and review and update it periodically — and that dossier explicitly includes securing the explainability of the AI and its training data. By legal nature, trigger, output, retention, and penalty alike, the real weight sits with the safety-and-trust dossier.

3.1The Dossier Asks for Evidence, Not a Signature

What the law asks for here is not a single signed policy statement. It is evidence — of what data a given decision was trained on, and of whether that data's provenance and quality can still be explained five years later. It also means that record must remain unbroken even as models are retrained and datasets are swapped out. Despite the name "document," its substance is the history of the data itself.

3.2The Premise of Overlap Recognition, and the Contrast with the EU's FRIA

If equivalent measures are already in place under another law, the AI Basic Act duty is treated as fulfilled. At first glance this looks like a clause that lightens the load, but the premise of that recognition is the crux. It asks whether risk management, explainability, and data governance were already in place. In the end, whichever law you route through, the destination — data governance — is the same.

Footnote (EU comparison): the EU's Fundamental Rights Impact Assessment (FRIA, Art. 27) targets deployers and is a rights-centered assessment asking "are people treated fairly, and is there a path to contest?" — distinct from the data-centered Data Protection Impact Assessment (DPIA). Failure to conduct it falls under Art. 99 Tier 2 (€15M or 3% of turnover). Korea's impact assessment sits, in character, somewhere between FRIA and DPIA. This comparison is for reference only and does not map cleanly onto the Korean context.

"Securing explainability," as the safety dossier requires, sounds like an abstract slogan — but rendered in a data team's language, it narrows to three concrete questions. Can you trace where the training data came from (lineage)? Can you verify that its quality meets a standard (quality)? Can you reproduce and audit that verification five years from now (auditability)? These three layers are the real substance of the question the regulation is asking.

Crucially, these three layers are already internationally standardized. The ISO/IEC 5259 series (five parts, 2024–2025) provides the language for measuring, managing, and governing data quality and its processes, and the data-documentation practices from academia and industry (Datasheets, Model Cards, Data Cards) form its backbone. How the three layers interlock, and which standard each one answers to, is set out in the concept diagram below.

The table below sets out which of the regulation's questions each of the three layers answers, and which ISO/IEC 5259 part and documentation practice it maps to. Data lineage answers "where did this data come from and what processing did it go through," with Datasheets for Datasets and Data Cards providing the format. Quality asks "can its quality be verified against a standard," and auditability asks "can it be reproduced and audited five years later," backed by Model Cards and algorithmic-impact-assessment methods.

Line up the penalty provisions and Korea's fine ceiling looks conspicuously low. Korea caps out at KRW 30M (≈ $23K, per case), while the EU reaches as high as €35M or 7% of global turnover. But gauge the regulatory burden from these numbers alone and you miss the real risk — because the structure of the penalty and the actual exposure differ qualitatively across jurisdictions.

Korea's KRW 30M looks small next to the EU, but the real risk lies outside the money. First, repeated failure to obey a corrective order can escalate to measures such as suspension of business. Second — and more important — the high-impact designation and a breach of duty themselves lead to exclusion from public procurement and damage to market trust. In a system that gives preference to operators who have completed an impact assessment, a firm without data governance is pushed out of the market before a fine ever lands.

New York City's structure is different again. At $500–$1,500 per violation the amounts are small, but there is no cap and it is a continuing-violation regime, so neglecting the audit lets the cumulative fine grow without limit. That is why it doesn't map onto Korea's per-case-capped model in a simple side-by-side. In the end, what separates the three jurisdictions' penalties is not the amount but "what you're punished for failing to evidence" — and that target converges, in all of them, on data governance. The clearest signal is the EU explicitly writing "data-governance breach" into Tier 2.

Full force does not mean a fine arrives today. Operator duties broadly come with a grace period of at least a year. That said, the labeling duty for deepfakes and other generated content applies immediately, with no reprieve — so if you run a generative service, that part cannot wait. The real use of the grace period is not to buy time to backfill paperwork later, but to use the reprieve to embed data governance into the pipeline.

Why start now is something international benchmarks quantify. What multiple surveys show in common is a wide gap between the claim "we have governance" and the execution "we've fully implemented it." The same gap turns up across three different indicators.

This gap dictates how the grace period should be used. Start recording the provenance of the data entering training now, and a year from now that record simply becomes the safety dossier. Put it off, and a year from now you'll be tracing back the provenance of data that has already flowed through. So, with a year on the clock, what do you tackle first? The quarter-by-quarter order of attack is laid out below.

Pebblous Data Communication Team
July 23, 2026

Official documents & legislation

• 1.Korea Law Information Center. (2026). "Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation of Trust." Ministry of Government Legislation.

Industry & press commentary

• 2.AI Citizen Lab. (2026). "The AI Basic Act takes effect July 21, 2026 — how will it change my life and business?."
• 3.Shin & Kim LLC. (2026). "Newsletter on the enforcement of the AI Basic Act." Shin & Kim Newsletter 3114.
• 4.Lawtimes. (2026). "Issues and challenges of enforcing the AI Basic Act."
• 5.Lexology. (2026). "Duties of high-impact AI operators — AI Basic Act guideline commentary series (4)."

EU AI Act comparison

• 6.Gibson Dunn. (2026). "EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes."
• 7.Morgan Lewis. (2026). "EU Approves Delays and Other Amendments to Certain EU AI Act Obligations."
• 8.Tech Policy Press. (2026). "EU's AI Act Delays Let High-Risk Systems Dodge Oversight."

U.S. state-law comparison

• 9.Colorado General Assembly. (2024–2026). "SB24-205: Consumer Protections for Artificial Intelligence" (repealed 2026-05; replaced by SB26-189, eff. 2027-01-01).
• 10.New York City Department of Consumer and Worker Protection. (2023–2025). "Automated Employment Decision Tools (Local Law 144)."

Data-quality standards & scholarship

• 11.ISO/IEC. (2024–2025). "ISO/IEC 5259 series (Parts 1–5): Data quality for analytics and machine learning."
• 12.Gebru, T., et al. (2021). "Datasheets for Datasets." Communications of the ACM, 64(12).
• 13.Mitchell, M., et al. (2019). "Model Cards for Model Reporting." FAT* '19.
• 14.Obermeyer, Z., Powers, B., Vogeli, C., & Mullainathan, S. (2019). "Dissecting racial bias in an algorithm used to manage the health of populations." Science, 366(6464), 447–453.
• 15.Buolamwini, J., & Gebru, T. (2018). "Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification." PMLR, 81.

All regulatory facts are as of 2026-07-21; the latest U.S. state-law developments (Colorado's replacement bill) are based on cross-checking across three law firms as of publication.