What Korean law hasn’t codified yet.

The asymmetry is unsustainable: foreign platforms label AI content, domestic platforms don't. This creates (1) a consumer protection gap — Koreans can't distinguish AI content on Naver/Kakao; (2) an election integrity risk — unlabeled AI deepfakes in Korean elections (already seen in 2024 legislative elections); (3) a trade friction risk — EU AI Act will require Korean exporters to label AI content. The de facto channel is the strongest of all patterns: every Korean ChatGPT user already experiences AI labeling. Domestic codification is a matter of when, not if.

The CARF deadline (2027) creates a hard commitment: Korea is one of 48 jurisdictions that committed to CARF implementation. The de facto channel is already operational — foreign exchanges will report Korean users' data starting 2027 regardless of domestic law. If Korea does not implement CARF domestically, it will (1) receive data from foreign exchanges but have no legal basis to use it; (2) be unable to reciprocate, violating its commitment; (3) create a regulatory arbitrage where domestic exchanges have lower reporting burdens than foreign ones. The crypto tax delay is political, but CARF implementation is a separate technical commitment that is harder to walk back.

The de facto channel is the strongest of all patterns: Korea's largest companies (Samsung, Hyundai, LG, SK, POSCO) are ALREADY implementing CSDDD-compliant supply chain due diligence because their EU customers demand it. This creates an irreversible compliance infrastructure. Three drivers: (1) market access — without domestic mHREDD legislation, Korean SMEs in the supply chain lack legal cover; (2) competitive parity — large Korean companies already bear the cost, and domestic legislation levels the playing field; (3) international alignment — Korea's OECD membership and EU FTA create normative pressure. The question is not whether Korea will adopt mHREDD, but when and in what form.

Korea's AI Basic Act explicitly references 'safety' and 'reliability' as core principles. The EU AI Act's red-teaming requirements will apply to Korean companies exporting AI systems to the EU market, creating immediate compliance pressure. Korean enterprises already conduct red-teaming voluntarily for global customers.

FSC has publicly committed to STO legalization. The Korea Exchange's tokenized securities platform is under development. Multiple securities firms have completed STO pilots. The global competitive pressure (Japan, Switzerland, EU already live) is intense. Legislative bills are already in the National Assembly.

Korea is a global leader in AI medical imaging (Lunit, Vuno). MFDS has been actively participating in IMDRF and has issued draft AI medical device guidelines. The FDA's final guidance on change control plans (2024) provides a template. Korean AI medical device exports to the US/EU require compliance with FDA/IMDRF standards, creating domestic regulatory pressure.

EU CSRD directly applies to Korean companies with significant EU operations. FSC has announced plans for mandatory ESG disclosure starting 2026. The Korea Exchange's ESG disclosure framework is being upgraded. Greenwashing enforcement cases in the US and EU create precedent and pressure. Multiple ESG-related bills are pending in the National Assembly.

EU AI Act Article 53 creates a direct compliance obligation for Korean AI companies exporting to the EU. Korean content creator protests are generating political pressure. The Copyright Act TDM exception is controversial and may be revised. The AI Basic Act's enforcement decree is the natural vehicle for training data transparency rules.

Three converging forces: (1) FATF mutual evaluation pressure — Korea's next MER will flag the biometric gap vs. FATF Rec 16 expectations; (2) EU eIDAS 2.0 interoperability — Korean financial institutions doing business in EU will need biometric-compatible KYC; (3) competitive pressure — domestic exchanges losing users to foreign platforms with stronger security. The de facto channel (2-3M Korean users already doing biometric KYC on foreign exchanges) is the strongest predictor — once a critical mass of citizens are already enrolled in a foreign biometric system, domestic codification becomes a consumer-protection and sovereignty issue.

Three drivers: (1) FATF pressure — Korea's next MER will flag the stablecoin regulatory gap; (2) financial stability concern — $2-3B in unregulated stablecoin holdings by Korean residents is a systemic risk; (3) competitive pressure — Japan and Singapore already have frameworks, and Korean won stablecoins issued abroad (e.g., KRW-pegged tokens on foreign chains) will force regulatory response. The de facto channel is massive: Korean stablecoin usage is already at institutional scale, just invisible to domestic regulators.

EU eIDAS 2.0 creates a hard deadline: by 2026, EU member states must accept EU Digital Identity Wallets for cross-border services. Korean citizens and businesses operating in the EU will need interoperable digital identity. The de facto channel (Korean travelers/businesspeople encountering EU digital ID requirements) creates demand pull. Additionally, ISO 18013-5 adoption by Korea's peers (Japan, Australia, US) creates normative pressure. The domestic gap is not technical — Korea has strong digital infrastructure — but legal and standards-based.

The asymmetry is stark: global platforms already provide algorithmic transparency to Korean users (because of EU DSA global application), while domestic platforms (Naver, Kakao) do not. This creates (1) a competitive disparity — domestic platforms appear less transparent; (2) a consumer protection gap — Korean users can't understand domestic platform algorithms; (3) regulatory arbitrage risk — platforms may route content through Korea to avoid EU transparency rules. The de facto channel (Koreans already experiencing algorithmic transparency on foreign platforms) normalizes the expectation.

Korea has one of the world's largest webtoon/web-novel industries, and creators are already organizing against unauthorized AI training. The de facto channel (creators using foreign opt-out mechanisms) demonstrates demand. Three drivers: (1) EU AI Act compliance — Korean AI companies exporting to EU must implement opt-out anyway; (2) creator industry pressure — webtoon artists are a politically influential constituency; (3) PIPC/Copyright Act alignment — Korea's data protection framework already recognizes data subject rights, and extending this to creative works is a natural progression.

The de facto channel is strong: Korea's largest export industries (batteries, electronics, textiles) are already building DPP systems for EU compliance. Three drivers: (1) market access — EU DPP is mandatory for Korean exports; (2) domestic consumer benefit — once DPP infrastructure exists for exports, extending it to domestic products is low marginal cost; (3) circular economy policy — Korea's Circular Economy Act (2024) creates a policy framework that DPP would complement. The EU deadline (batteries 2027) creates a hard timeline.

FSC has signaled interest in expanding MyData to payment accounts. The global trend toward API-based open banking (PSD3, UK, Australia) creates competitive pressure. Korean fintechs are already building the technical infrastructure. However, bank resistance and data security concerns may slow adoption.

BOK has completed CBDC pilots and is actively exploring cross-border use cases. The global momentum (mBridge, IMF XC) is strong. Korea's export-dependent economy would benefit significantly from CBDC-based trade settlement. However, legal changes to the Bank of Korea Act require National Assembly action, which may face political hurdles.

PIPA already has a foundation (Article 37-2 on automated decisions). The EU adequacy decision for Korea requires ongoing alignment with GDPR standards. Consumer advocacy groups are increasingly vocal about AI-driven decisions in credit, hiring, and insurance. The AI Basic Act's trustworthiness provisions create additional pressure.

NIST PQC standards are now final, creating a clear technical path. Korea's heavy reliance on digital infrastructure (e-government, fintech, 5G) makes PQC migration a national security priority. NIS has been actively researching PQC. However, the migration timeline is long (10+ years) and initial mandates may be limited to government systems.

FATF mutual evaluation of Korea (2025-2026) will examine DeFi regulatory coverage. The FIU (금융정보분석원) has signaled interest in DeFi regulation. EU MiCA and FATF guidance provide a regulatory template. However, the technical complexity of DeFi regulation and industry resistance may slow implementation.

The de facto channel is weaker than other patterns — global age verification is less visible to Korean users than AI labeling or algorithmic transparency. However, three drivers push toward codification: (1) child safety concerns — Korea has high youth smartphone penetration (95%+) and growing concern about social media harm; (2) international alignment — Korea's digital regulation increasingly tracks EU/UK standards; (3) platform compliance — global platforms will apply age verification to Korean users anyway, creating the same asymmetry dynamic. Likelihood is medium because Korea's domestic political focus on age verification has been on games, not broader platforms.

DeFi regulation is technically complex and globally still nascent. The de facto channel (Korean DeFi usage) is significant but harder to measure than centralized exchange usage. Three drivers: (1) FATF pressure — Korea's next MER will need to address DeFi; (2) consumer protection — DeFi hacks and rug pulls affecting Korean users will trigger regulatory response; (3) tax enforcement — DeFi transactions are invisible to Korean tax authorities. Likelihood is medium because the global regulatory framework is still evolving, and Korea typically waits for international consensus before acting on complex financial regulation.

AI liability is a second-wave regulatory issue — countries typically establish AI governance frameworks first (AI Basic Act) and liability rules second. The de facto channel (AI exposure) is universal but diffuse — it creates background pressure rather than a specific trigger. Three drivers: (1) EU alignment — Korea's AI regulation tracks EU standards, and the AI Liability Directive will create a model; (2) litigation pressure — the first major AI harm case in Korea will expose the legal gap; (3) industry demand — Korean AI companies need liability clarity to manage risk. Likelihood is medium because liability reform is politically complex and typically follows, not leads, regulatory development.

Digital inheritance is a growing social issue as Korea's digital-native population ages. Court cases are accumulating. However, legislative action has been slow — no specific bill has gained traction. The issue cuts across multiple ministries (MOJ, MSIT, PIPC), creating coordination challenges.

Platform worker protection is a hot political issue in Korea, with multiple bills pending. The EU AI Act's workplace provisions create a model. However, labor law reform is politically contentious and algorithmic management regulation is a new frontier with no domestic precedent. The platform worker classification issue must be resolved first.

BOK is actively researching CBDC but has not committed to retail issuance. The Digital Euro and e-CNY will create de facto interoperability pressure for Korean travelers and businesses. However, retail CBDC issuance is a sovereign decision requiring National Assembly approval, and BOK has been cautious about timeline.