This step researches AI-related laws and regulations, registers them in the AI legal requirements register and reviews them every half year. Its purpose is to reflect changed laws in AI work in good time. You receive the legal requirements register, a table of changed legal requirements and a half-yearly review checksheet.
It researches on the web the Ministry of Government Legislation (National Law Information Center, Legislation Participation Center), the competent ministries and official overseas sources (EUR-Lex, etc.), and registers the AI-related legal requirements that apply to the organization (AI role, business regions, personal information, automated decisions) in the AI legal requirements register.
Amendments and compliance status are reviewed every half year (January and July) and as needed. The register is kept in this browser and becomes the baseline for the next review, and is applied to risk assessment, impact assessment, the SoA, use approval and management review.
Output
- AI legal requirements register (Excel)One row per clause or obligation; applicable role, applicability, whether it is high-impact AI, linked step, promulgation and effective dates, source, date confirmed
- Table of changed legal requirements, half-yearly monitoring checksheet and action planChecksheet judgements are conforming, nonconforming, not applicable or to be confirmed, with the evidence document number
- Key schedule (next half-yearly review, effective dates, end of grace periods), application to AI work, summary of management review input
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Compliance with development-related laws (personal information, copyright, data acquisition) and with development requirements in customer contracts | Compliance with customer notification, usage instructions, contracts and product regulations (including AI regulations of export countries) | Compliance with usage guidelines, personal information, supplier terms and the rules on information that must not be entered |
How to operate legal requirements identification and monitoring
ISO/IEC 42001 has no separate clause like the evaluation of compliance (9.1.2) in ISO 14001 and 45001. Therefore AI-related laws are registered in the AI legal requirements register and managed continuously through the 9.1 monitoring system (the date confirmed and the cumulative record of compliance status in the register are the evidence). Reviews are held every half year (January and July) and as needed when laws are amended, so that the latest legal requirements are applied to AI work (4.1, 4.2, 6.1.3, 9.1, 9.3).
Primary sources
- KoreaNational Law Information Center (law.go.kr) · Legislation Participation Center (opinion.lawmaking.go.kr) · Ministry of Government Legislation · notices and guidelines of the competent ministries (Ministry of Science and ICT, Personal Information Protection Commission, Ministry of Culture, Sports and Tourism / Korea Copyright Commission, Ministry of Food and Drug Safety, Korea Communications Commission, Financial Services Commission, Ministry of Employment and Labor)
- EUEUR-Lex · European Commission(AI Office)
- VietnamNational Assembly and Government gazette (legal database)
- United StatesFederal Register, White House, NIST, FTC
- Other countriesSearch without restriction, but give priority to official sources
Type of review
| Type | When | Output |
|---|---|---|
| Initial identification | When starting the AI management system | AI legal requirements register (per clause and obligation), action plan, key schedule |
| Half-yearly review | Every January and July (second week) | Revised register (changes and additions marked), table of changed legal requirements, half-yearly monitoring checksheet (judgement, evidence), action plan, summary of management review input |
| Ad hoc review | When there is a legal amendment, a notice of proposed legislation or news | Impact judgement, changed rows of the register, action plan |
| Review of new AI adoption | Before using a new AI | Applicable legal requirements, checksheet items, mandatory actions before adoption → 8 Verification and Use Approval |
AI legal requirements register: one row = one clause or obligation
Category (domestic acts, enforcement decrees, notices and guidelines / overseas / standards (other requirements) / contracts and terms of use / internal rules) · Name of the legal requirement · Key obligation · Applicable role (use, supply, development) · Applicability (Y, N, to be reviewed) · Whether it is high-impact AI · Related AI systems and work · Linked AIMS documents and steps · Promulgation and effective dates · Compliance status · Previous and next review dates · Source (law search address) · Date confirmed.
Half-yearly review procedure
- (1) Identify the registered legal requirements in the baseline register and the previous review date
- (2) Research amendments, new enforcement decrees, notices and guidelines, changes to effective dates and ends of grace periods since the previous review date (source address and date confirmed)
- (3) Search for new legal requirements: amendments to AI legislation, notices under the AI Basic Act, generative AI guidelines, deepfake labelling, automated decisions, AI copyright, subordinate rules of the EU AI Act, implementing decrees of Vietnam's AI law
- (4) Impact judgement: applicability, degree of impact (high, medium, low), related internal documents, required actions
- (5) Checksheet judgement: conforming, nonconforming, not applicable or to be confirmed, with the evidence document number
- (6) Outputs: revised register, checksheet results, summary of management review input (5 lines), action plan
- (7) Next review date, and the effective dates and ends of grace periods that fall in between
Obligations by role: according to the scope (development, supply, use)
Judge separately three cases: only using AI for internal work (use), providing AI outputs or services to customers (supply), and developing and supplying AI (development). In particular, the transparency obligation to tell users that AI is used is considered separately for the case of providing it. If the interpretation is divided, mark "legal review required".
Application to AI work
| Step | What to apply |
|---|---|
| 5 AI Risk Assessment | Legal category risks and the controls that support them |
| 6 AI System Impact Assessment | Whether it is high-impact AI, personal information, automated decisions |
| 7 Control Implementation and SoA | List of legal requirements and compliance obligations, usage guidelines |
| 8 Verification and Use Approval | Mandatory actions before adoption and conditions of use |
| 9 Operational Control | Legal requirements column of the register and applicable legal requirements |
| 11 Monitoring | Schedule of effective dates and ends of grace periods, notices and logs |
| 14 Management Review | Input on changes in interested party requirements and compliance obligations (5-line summary) |
Operation indicators
| Indicator | Target | Formula and cycle |
|---|---|---|
| Currency of the AI legal requirements register | Updated every half year | Months elapsed since the last review date |
| Implementation rate of compliance obligation checks | 100% | Items checked as complete / items whose cycle has arrived; half-yearly |
| Legal violations and administrative sanctions | 0 cases | Number of occurrences / continuous |
| Lead time to reflect legal amendments | Within 30 days | Promulgation to the date reflected in the register, controls and guidelines |
Prohibited: entering clause numbers, penalty amounts or effective dates that have not been confirmed; copying previous review results without rechecking; definitive conclusions that replace legal advice. Compliance conclusions are given together with the evidence document number.
Only the method has been generalized from AI legal identification and half-yearly monitoring prompts, ISO/IEC 42001, and operating cases of actual client companies (legal requirements and compliance obligation monitoring guidelines, compliance evaluation reports, AI-related legal registers); company names and results are not included. The content of laws is rechecked against primary sources at every review.
Next steps
Preceding steps: 7 Control Implementation and Statement of Applicability (SoA) · 9 Operational Control · 11 Monitoring, Change and Revision Control · 4 AI System Inventory · 1 AI Context Analysis · 10 Documented Information Control · The results of this step are used in the following steps: 1 AI Context Analysis · 5 AI Risk Assessment · 14 Management Review · 15 Nonconformity and Corrective Action · 16 Improvement
