What Korean law hasn’t codified yet.

The asymmetry is unsustainable: foreign platforms label AI content, domestic platforms don't. This creates (1) a consumer protection gap — Koreans can't distinguish AI content on Naver/Kakao; (2) an election integrity risk — unlabeled AI deepfakes in Korean elections (already seen in 2024 legislative elections); (3) a trade friction risk — EU AI Act will require Korean exporters to label AI content. The de facto channel is the strongest of all patterns: every Korean ChatGPT user already experiences AI labeling. Domestic codification is a matter of when, not if.

The CARF deadline (2027) creates a hard commitment: Korea is one of 48 jurisdictions that committed to CARF implementation. The de facto channel is already operational — foreign exchanges will report Korean users' data starting 2027 regardless of domestic law. If Korea does not implement CARF domestically, it will (1) receive data from foreign exchanges but have no legal basis to use it; (2) be unable to reciprocate, violating its commitment; (3) create a regulatory arbitrage where domestic exchanges have lower reporting burdens than foreign ones. The crypto tax delay is political, but CARF implementation is a separate technical commitment that is harder to walk back.

The de facto channel is the strongest of all patterns: Korea's largest companies (Samsung, Hyundai, LG, SK, POSCO) are ALREADY implementing CSDDD-compliant supply chain due diligence because their EU customers demand it. This creates an irreversible compliance infrastructure. Three drivers: (1) market access — without domestic mHREDD legislation, Korean SMEs in the supply chain lack legal cover; (2) competitive parity — large Korean companies already bear the cost, and domestic legislation levels the playing field; (3) international alignment — Korea's OECD membership and EU FTA create normative pressure. The question is not whether Korea will adopt mHREDD, but when and in what form.

Korea's AI Basic Act explicitly references 'safety' and 'reliability' as core principles. The EU AI Act's red-teaming requirements will apply to Korean companies exporting AI systems to the EU market, creating immediate compliance pressure. Korean enterprises already conduct red-teaming voluntarily for global customers.

FSC has publicly committed to STO legalization. The Korea Exchange's tokenized securities platform is under development. Multiple securities firms have completed STO pilots. The global competitive pressure (Japan, Switzerland, EU already live) is intense. Legislative bills are already in the National Assembly.

Korea is a global leader in AI medical imaging (Lunit, Vuno). MFDS has been actively participating in IMDRF and has issued draft AI medical device guidelines. The FDA's final guidance on change control plans (2024) provides a template. Korean AI medical device exports to the US/EU require compliance with FDA/IMDRF standards, creating domestic regulatory pressure.

EU CSRD directly applies to Korean companies with significant EU operations. FSC has announced plans for mandatory ESG disclosure starting 2026. The Korea Exchange's ESG disclosure framework is being upgraded. Greenwashing enforcement cases in the US and EU create precedent and pressure. Multiple ESG-related bills are pending in the National Assembly.

EU AI Act Article 53 creates a direct compliance obligation for Korean AI companies exporting to the EU. Korean content creator protests are generating political pressure. The Copyright Act TDM exception is controversial and may be revised. The AI Basic Act's enforcement decree is the natural vehicle for training data transparency rules.

Three converging forces: (1) FATF mutual evaluation pressure — Korea's next MER will flag the biometric gap vs. FATF Rec 16 expectations; (2) EU eIDAS 2.0 interoperability — Korean financial institutions doing business in EU will need biometric-compatible KYC; (3) competitive pressure — domestic exchanges losing users to foreign platforms with stronger security. The de facto channel (2-3M Korean users already doing biometric KYC on foreign exchanges) is the strongest predictor — once a critical mass of citizens are already enrolled in a foreign biometric system, domestic codification becomes a consumer-protection and sovereignty issue.

Three drivers: (1) FATF pressure — Korea's next MER will flag the stablecoin regulatory gap; (2) financial stability concern — $2-3B in unregulated stablecoin holdings by Korean residents is a systemic risk; (3) competitive pressure — Japan and Singapore already have frameworks, and Korean won stablecoins issued abroad (e.g., KRW-pegged tokens on foreign chains) will force regulatory response. The de facto channel is massive: Korean stablecoin usage is already at institutional scale, just invisible to domestic regulators.

EU eIDAS 2.0 creates a hard deadline: by 2026, EU member states must accept EU Digital Identity Wallets for cross-border services. Korean citizens and businesses operating in the EU will need interoperable digital identity. The de facto channel (Korean travelers/businesspeople encountering EU digital ID requirements) creates demand pull. Additionally, ISO 18013-5 adoption by Korea's peers (Japan, Australia, US) creates normative pressure. The domestic gap is not technical — Korea has strong digital infrastructure — but legal and standards-based.

The asymmetry is stark: global platforms already provide algorithmic transparency to Korean users (because of EU DSA global application), while domestic platforms (Naver, Kakao) do not. This creates (1) a competitive disparity — domestic platforms appear less transparent; (2) a consumer protection gap — Korean users can't understand domestic platform algorithms; (3) regulatory arbitrage risk — platforms may route content through Korea to avoid EU transparency rules. The de facto channel (Koreans already experiencing algorithmic transparency on foreign platforms) normalizes the expectation.

Korea has one of the world's largest webtoon/web-novel industries, and creators are already organizing against unauthorized AI training. The de facto channel (creators using foreign opt-out mechanisms) demonstrates demand. Three drivers: (1) EU AI Act compliance — Korean AI companies exporting to EU must implement opt-out anyway; (2) creator industry pressure — webtoon artists are a politically influential constituency; (3) PIPC/Copyright Act alignment — Korea's data protection framework already recognizes data subject rights, and extending this to creative works is a natural progression.

The de facto channel is strong: Korea's largest export industries (batteries, electronics, textiles) are already building DPP systems for EU compliance. Three drivers: (1) market access — EU DPP is mandatory for Korean exports; (2) domestic consumer benefit — once DPP infrastructure exists for exports, extending it to domestic products is low marginal cost; (3) circular economy policy — Korea's Circular Economy Act (2024) creates a policy framework that DPP would complement. The EU deadline (batteries 2027) creates a hard timeline.

FSC has signaled interest in expanding MyData to payment accounts. The global trend toward API-based open banking (PSD3, UK, Australia) creates competitive pressure. Korean fintechs are already building the technical infrastructure. However, bank resistance and data security concerns may slow adoption.

BOK has completed CBDC pilots and is actively exploring cross-border use cases. The global momentum (mBridge, IMF XC) is strong. Korea's export-dependent economy would benefit significantly from CBDC-based trade settlement. However, legal changes to the Bank of Korea Act require National Assembly action, which may face political hurdles.

PIPA already has a foundation (Article 37-2 on automated decisions). The EU adequacy decision for Korea requires ongoing alignment with GDPR standards. Consumer advocacy groups are increasingly vocal about AI-driven decisions in credit, hiring, and insurance. The AI Basic Act's trustworthiness provisions create additional pressure.

NIST PQC standards are now final, creating a clear technical path. Korea's heavy reliance on digital infrastructure (e-government, fintech, 5G) makes PQC migration a national security priority. NIS has been actively researching PQC. However, the migration timeline is long (10+ years) and initial mandates may be limited to government systems.

FATF mutual evaluation of Korea (2025-2026) will examine DeFi regulatory coverage. The FIU (금융정보분석원) has signaled interest in DeFi regulation. EU MiCA and FATF guidance provide a regulatory template. However, the technical complexity of DeFi regulation and industry resistance may slow implementation.

Three converging forces make domestic codification near-inevitable: (1) Trade dependence — the EU is Korea's third-largest export market and CBAM directly repriced its carbon-intensive flagship exports in 2026, creating industry demand for a recognised domestic verification regime to claim Article 9 deductions; (2) Regulatory diffusion — UK CBAM (2027) plus proposed EU downstream expansion (2028) multiply the number of borders demanding Korean embedded-emissions data, making ad hoc firm-by-firm reporting unsustainable; (3) Structural mismatch — the EU is signalling that only demonstrable, comparable carbon pricing at home earns relief, pressuring Korea to tighten K-ETS free allocation and stand up an official export-side certification body rather than leave compliance to KECO consulting.

Three converging forces point to codification within the window. (1) Norm gravity: the EU's 2 December 2026 transposition deadline turns the presumption-of-employment model into the reference standard that Korean policymakers, unions, and courts will cite, mirroring how Korea has historically emulated OECD/EU labor benchmarks. (2) Domestic momentum: platform-worker protection is already on the legislative table — successive 플랫폼 종사자 보호 bills, the 2025 Yellow Envelope Act opening union rights to gig workers, and the administration's '일하는 사람 기본법' — so a statutory vehicle exists and is moving. (3) Litigation pressure: the Tada / Seoul High Court line of rulings recognizing platform-worker status makes ad hoc judicial reclassification unpredictable for platforms, creating incentives for a codified rule. The countervailing factor keeping this at 'high' rather than 'very high' is that Korea's chosen instrument is a separate protective statute, not a Labor Standards Act presumption — so the echo is likely to land as functional protection short of a full EU-style rebuttable-presumption mechanism.

Three converging forces make a domestic legal echo likely. (1) Binding IHR obligations already in force since September 2025 — the National IHR Authority requirement and the 'pandemic emergency' tier need a statutory hook that the current Act lacks. (2) Korea's strong compliance posture — repeated JEE participation and GHSA leadership create political pressure to be seen aligning national law with the norms it helped set. (3) The Pandemic Agreement's momentum — once the PABS annex is finalised and the treaty opens for signature, ratification will force conforming amendments to 감염병예방법 and 검역법. The main uncertainty is timing, which is gated on the still-open PABS negotiation, not on whether alignment happens.

Three converging forces point to Korea codifying nature disclosure this decade. (1) Treaty obligation: as a CBD party, Korea is bound by GBF Target 15 to put in place legal or policy measures requiring large companies to disclose biodiversity risks and impacts by 2030. (2) Standards gravity: the KSSB has already anchored its regime to the ISSB baseline, and once the ISSB issues its TNFD-based nature standard (Exposure Draft targeted October 2026), the same interoperability logic that produced KSDS 1/2 makes a Korean nature standard the path of least resistance. (3) Market coercion: EU CSRD/ESRS E4 and global investors already extract TNFD-aligned nature data from Korean exporters and financial institutions, so a domestic mandate mainly formalises reporting Korean multinationals are increasingly producing anyway. The main brake is timing — Omnibus-driven softening of EU ESG rules and Korea's cautious, climate-first phasing could delay a nature standard until after the climate rollout matures.

Three converging forces point to codification. (1) Market compulsion: Korea's export-heavy electronics and IoT sector must already engineer to CRA (and PSTI) to keep EU and UK access, so a domestic mandate would ratify practice industry has adopted rather than impose new cost — the classic 'de facto first, de jure later' echo. (2) Regulatory alignment pressure: with the EU, UK and US all moving to product-security baselines and Korea already signing cross-border cybersecurity-labelling mutual-recognition arrangements (e.g. with Singapore and Germany), MSIT/KISA have strong incentive to convert the voluntary IoT certification into a recognised, interoperable conformity regime. (3) A ready legislative vehicle: the stalled Framework Act on Cybersecurity and existing KISA certification machinery give lawmakers an obvious hook to bolt on horizontal product-security requirements once the CRA's 2026–2027 obligations concentrate attention.

The de facto channel is weaker than other patterns — global age verification is less visible to Korean users than AI labeling or algorithmic transparency. However, three drivers push toward codification: (1) child safety concerns — Korea has high youth smartphone penetration (95%+) and growing concern about social media harm; (2) international alignment — Korea's digital regulation increasingly tracks EU/UK standards; (3) platform compliance — global platforms will apply age verification to Korean users anyway, creating the same asymmetry dynamic. Likelihood is medium because Korea's domestic political focus on age verification has been on games, not broader platforms.

DeFi regulation is technically complex and globally still nascent. The de facto channel (Korean DeFi usage) is significant but harder to measure than centralized exchange usage. Three drivers: (1) FATF pressure — Korea's next MER will need to address DeFi; (2) consumer protection — DeFi hacks and rug pulls affecting Korean users will trigger regulatory response; (3) tax enforcement — DeFi transactions are invisible to Korean tax authorities. Likelihood is medium because the global regulatory framework is still evolving, and Korea typically waits for international consensus before acting on complex financial regulation.

AI liability is a second-wave regulatory issue — countries typically establish AI governance frameworks first (AI Basic Act) and liability rules second. The de facto channel (AI exposure) is universal but diffuse — it creates background pressure rather than a specific trigger. Three drivers: (1) EU alignment — Korea's AI regulation tracks EU standards, and the AI Liability Directive will create a model; (2) litigation pressure — the first major AI harm case in Korea will expose the legal gap; (3) industry demand — Korean AI companies need liability clarity to manage risk. Likelihood is medium because liability reform is politically complex and typically follows, not leads, regulatory development.

Digital inheritance is a growing social issue as Korea's digital-native population ages. Court cases are accumulating. However, legislative action has been slow — no specific bill has gained traction. The issue cuts across multiple ministries (MOJ, MSIT, PIPC), creating coordination challenges.

Platform worker protection is a hot political issue in Korea, with multiple bills pending. The EU AI Act's workplace provisions create a model. However, labor law reform is politically contentious and algorithmic management regulation is a new frontier with no domestic precedent. The platform worker classification issue must be resolved first.

BOK is actively researching CBDC but has not committed to retail issuance. The Digital Euro and e-CNY will create de facto interoperability pressure for Korean travelers and businesses. However, retail CBDC issuance is a sovereign decision requiring National Assembly approval, and BOK has been cautious about timeline.

Converging forces point to eventual Korean codification, but the timeline is longer and the vector softer than for finance-driven mandates: (1) UNESCO's 2025 Recommendation, though non-binding, creates reporting expectations on its 194 members, Korea included, and follows the OECD 2019 instrument Korea already sits inside; (2) a clear reference model now exists — Chile's constitutional route plus the lighter-touch 'add neural data to the sensitive-data list' approach of Colorado and California — making a PIPA amendment low-cost to draft; (3) Korea's PIPC is already consulting on elevating biometric data into the Act itself, an obvious hook onto which neural data can be attached. Offsetting these: no domestic incident forcing the issue, no consumer-neurotech constituency, and PIPA's catch-all lets regulators claim existing coverage — so movement is likely guidance-first rather than a fast statutory mandate.