EU AI Act vs South Korea AI Basic Act: High-Risk vs High-Impact AI Compared

How the EU AI Act classifies high-risk AI

The EU AI Act is Regulation (EU) 2024/1689 of 13 June 2024. It follows a risk-based approach with four categories: unacceptable risk, high risk, transparency risk, and minimal or no risk. High-risk is the tier that carries the heaviest operational duties for most enterprises.

The Act states that systems identified as high-risk should be limited to those with a significant harmful impact on the health, safety and fundamental rights of persons in the Union, while minimising restrictions on international trade. Classification is therefore tied to the harm a use case can cause, not to the underlying technology.

Scope is not limited to systems hosted in the EU. Recital 46 says high-risk systems should only be placed on the Union market, put into service or used if they meet mandatory requirements, and it refers to systems available in the Union or whose output is otherwise used in the Union. For a multinational, the question is where outputs are used.

Terminology that must not be conflated

The two laws share vocabulary that looks interchangeable but is not. The EU Act also uses 'high-impact' in a third sense, which creates a real risk of misclassification when teams build a shared inventory.

• EU 'high-risk' AI system: A use-case classification tied to significant harmful impact on health, safety and fundamental rights. Triggers mandatory requirements, including a risk management system and human oversight by design.
• EU 'high-impact capabilities': A defined term for general-purpose AI models: capabilities that match or exceed those recorded in the most advanced models. It describes a model, not a use case.
• Korean 'high-impact AI': A use-case classification under the AI Basic Act. It is closer in function to the EU high-risk tier than to the EU's high-impact capabilities term, but equivalence should not be assumed without legal review.

Mapping a single system against both frameworks

Keep one AI system inventory with separate classification fields: the EU tier (unacceptable, high, transparency, minimal) and the Korean high-impact determination. Do not derive one from the other. Each field should record the legal basis, the decision owner and the date of the decision, because the tests differ and the texts will be interpreted by different authorities.

For each system, record where outputs are used. A system hosted outside the EU can still fall within EU scope if its output is used in the Union, so hosting location is not a reliable classification input. The same discipline applies to the Korean analysis, which should be performed against the Korean legal text and recorded independently.

Assign ownership for classification. Misclassification is the main failure mode when two regimes use similar language, and it is a governance decision rather than an engineering one. Legal, compliance and the system owner should sign off, and the decision should be revisited when the use case changes.

Which obligations depend on runtime behavior

Under the EU Act, several duties are fulfilled before or outside execution. A risk management system must be established, implemented, documented and maintained for high-risk systems. Providers and deployers must also take measures to support the AI literacy of staff and others operating or using AI systems on their behalf. These are organizational and documentation duties. No runtime control replaces them.

Human oversight is the duty most directly tied to runtime. High-risk systems must be designed and developed, including with appropriate human-machine interface tools, so that natural persons can effectively oversee them while in use. Oversight that exists only in a policy document does not show that a person could intervene during a specific interaction.

This split gives compliance teams a practical test for any obligation under either regime: can it be shown by a document or approval completed before deployment, or does it require evidence of what the system was allowed to do and did in use? Obligations in the second group need controls in the execution path and durable records. Obligations in the first group need ownership, review cycles and retained documentation.

Timelines and regulatory change

EU application dates for high-risk rules may shift. The Commission proposed the Digital Omnibus on AI on 19 November 2025 to address delays in standards, in the designation of national competent authorities and in conformity assessment bodies. The proposal sets fixed dates for delayed application of high-risk rules: 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in products. As of November 2026, a consolidated version of the Act dated 27 July 2026 exists.

Build compliance plans to be date-flexible, and maintain a regulatory-change watch covering both the EU amendments and Korean implementing measures. Tie milestones to the classification fields in the inventory so that a date change updates one field rather than a program plan.

Where runtime enforcement and evidence fit

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Actions include allow, redact, block, rate limit and escalate for human approval, applied to individual interactions and tool calls. Enforcement generates continuous audit-ready evidence, mapped to the EU AI Act among other frameworks.

For a high-risk use case, this can support the runtime-related parts of human oversight, record-keeping and demonstrable control: an escalation for human approval is both a control and a record of it. It does not cover risk management system documentation, AI literacy, classification decisions or model and dataset provenance, which remain organizational and pre-deployment work. Evidence mapping is to the EU AI Act. Korean-side obligations should be assessed separately.