What Is the EU AI Act?
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force in August 2024 and is the world's first comprehensive regulatory framework dedicated specifically to artificial intelligence.
The Act applies broadly to organizations that develop, deploy, or use AI systems within the European Union, and imposes different compliance obligations depending on the level of risk associated with the system.
Korean companies are not exempt.
The EU AI Act follows a principle of extra-territorial application, meaning that a Korean company may fall within its scope where it provides AI-based services to users in the EU or enters into business relationships with EU companies.
A company cannot avoid application of the regulation simply because it is established in Korea.
Four-Tier Risk Classification
A central feature of the EU AI Act is its classification of AI systems into four levels based on risk.
The applicable compliance obligations vary significantly depending on the category.
| Level | Classification | Key Features |
| Level 1 | Prohibited | Certain manipulative AI practices, social scoring, and certain real-time biometric identification in public spaces — restrictions already in effect from February 2025 |
| Level 2 | High Risk | AI systems affecting areas such as recruitment, lending, education, or biometric identification — extensive obligations including conformity assessment and technical documentation |
| Level 3 | Limited Risk | Chatbots, deepfakes, and similar systems — mainly subject to transparency obligations, including disclosure that AI is being used |
| Level 4 | Minimal Risk | Spam filters, game AI, and similar low-risk systems — generally no additional legal obligations |
The classification is determined not merely by the technology itself, but by its intended purpose and context of use.
As a result, the same AI system may fall into different risk categories depending on how it is deployed.
Implementation Timeline and Current Developments
| Effective Date | Applicable Requirement |
| February 2, 2025 | Prohibited AI practices — in force |
| August 2, 2025 | Obligations relating to General-Purpose AI (GPAI) — in force |
| August 2, 2026 | High-risk AI obligations under Annex III — current statutory effective date |
| December 2, 2027 | Proposed delayed date for certain high-risk obligations under the Digital Omnibus initiative, subject to final legislative adoption |
In May 2026, the European Parliament and Council reached a provisional political agreement under the Digital Omnibus initiative to postpone certain high-risk AI obligations until December 2027.
However, unless the legislative process is formally completed before August 2026, the original statutory date of August 2, 2026 remains legally relevant.
Companies should therefore not delay compliance efforts solely on the assumption that the extension will take effect.
The more prudent approach is to prepare based on the original deadline while continuing to monitor the final legislative outcome.
Penalties for Non-Compliance
Administrative fines under the EU AI Act vary depending on the type of violation.
For the most serious violations, including breaches of prohibited AI practice rules, penalties may reach up to 7% of total worldwide annual turnover or EUR 35 million, whichever amount is higher.
This exceeds the maximum percentage-based fine under the GDPR, which is generally capped at 4% of worldwide annual turnover.
Additional consequences may include:
- restrictions on the sale or use of the AI system in the EU;
- contractual invalidity or termination risk;
- exclusion from procurement opportunities; and
- other regulatory enforcement measures.
Separate rules under Article 99 provide modified fine thresholds for SMEs and startups, generally applying the lower of the fixed monetary amount or the turnover-based amount.
However, the overall regulatory framework and compliance obligations still apply.
Prepare with DECENT Law Firm
Compliance with the EU AI Act is not only about avoiding regulatory risk.
For Korean companies entering the European market, a well-designed AI compliance framework can also serve as an important trust signal for EU customers, business partners, and enterprise procurement teams.
Some European companies have already begun requiring AI regulatory self-assessment documentation as part of supplier onboarding and procurement processes.
DECENT Law Firm's Global Business Practice Team provides practical legal support across the AI regulatory compliance process, including:
- classification of AI systems by risk level;
- review of applicability under the EU AI Act;
- support with technical and compliance documentation;
- review and negotiation of AI-related regulatory clauses in commercial agreements; and
- broader EU market-entry compliance planning.
If your company provides AI products or services to the European market, we recommend reviewing the applicable risk classification and compliance requirements before launch or contract execution.