AI Healthcare Regulations in South Korea: Approval and Compliance

Introduction: 

South Korea is one of the most closely watched markets in healthcare AI regulations in Asia, and for good reason. In early 2026 it switched on two major regimes within days of each other, and a third rulebook, the MFDS device-approval process, sits underneath both.

Quick answer: In South Korea, medical AI is regulated as a medical device by the Ministry of Food and Drug Safety (MFDS), now also under the Digital Medical Products Act. Separately, the AI Basic Act treats healthcare AI as “high-impact,” which adds duties on risk management, human oversight and explainability. To enter the market, you need the right device classification, validation and clinical evidence, KGMP quality certification and a Korean license holder. After approval, you must keep up with renewals and change control.

This guide explains each layer in plain language, so you can plan approval and compliance in the right order.

The medical AI regulatory framework in South Korea

Think of it as three layers:

Most overseas teams get tripped up by treating these as one thing. They aren’t.

Layer 1: AI medical device regulations in South Korea

MFDS decides whether AI software is a medical device based on its intended use, the harm it could cause if it fails, and whether it preserves a medical professional’s clinical judgment. If it qualifies, it’s classified like other medical devices into four risk classes.

The classification is not cosmetic. Under the MFDS approach, the regulatory route (notification, certification or approval) depends on risk level, novelty and similarity to existing devices. Get it wrong and, as one consultancy warns, you can end up restarting the whole process.

What MFDS typically expects in an AI submission:

• Technical documentation, including details such as the cloud server environment, cloud service type and security standards.
• Clinical validation. Algorithms with no predicate device need clinical trial documentation, while those with a predicate may be able to waive a trial but must show equivalence.
• Software verification and validation, with performance verification using healthcare data.
• Korean-language labeling, KGMP quality-system compliance and a local license holder.

A common trap: ISO 13485 helps, but it does not replace KGMP, which has Korea-specific procedural and inspection criteria.

Layer 2: The Digital Medical Products Act

South Korea moved early here. Digital medical devices and digital integrated drugs came under the Act on January 24, 2025, and digital medical/health support devices followed on January 24, 2026, completing a two-phase rollout.

MFDS has since been refining the rules. A few updates worth knowing:

• Notice 2026-4 (January 2026) revised the classification and designation rules for digital medical products.
• Notice 2026-6 created a structured pre-submission framework, with set procedural steps, standard documentation and predictable review timelines. It’s recommended for novel or AI-enabled products where classification is unclear.
• Notice 2026-54 (July 27, 2026) clarified which software functions can skip certain clinical evidence, as long as they don’t claim clinical effectiveness and fall within a defined list. It also allows real-world evaluation for up to three years under reporting conditions. This is a narrow list, not a blanket waiver for software.

MFDS has also moved toward accepting real-world evidence as clinical data for digital health devices, including AI/ML-based ones, which can ease the evidence burden for some products.

Layer 3: The AI Basic Act and healthcare AI compliance in South Korea

The AI Basic Act took effect on January 22, 2026 and classes healthcare AI as high-impact. Operators of high-impact systems must have specific risk management plans, human oversight protocols and Korean-language explanations of how the AI reached its conclusions.

In practice, high-impact operators need to cover:

• Explainability: a meaningful explanation of outcomes, the key criteria used and a summary of training data.
• A user protection plan and a mechanism for human intervention.
• Documentation of the steps taken to secure trust and safety.
• Impact assessments on fundamental rights before launch.

Who is covered, including foreign companies? 

Overseas operators above certain user or revenue thresholds set by decree must appoint a domestic representative and report it to the minister. That representative handles compliance reports and supports safety measures.

What are the penalties? 

Fines reach up to KRW 30 million (roughly US$21,000) for failing to notify users of AI use, failing to appoint a domestic representative, or ignoring corrective orders. Other duties, like risk management plans, have no direct fine but can escalate through guidance and corrective orders.

Is there a grace period? 

Yes. The ministry committed to deferring fines and investigations for at least one year from January 2026. Don’t read that as permission to wait: the hard-enforcement clock is already running.

How long does MFDS approval take?

There’s no official guaranteed timeline for AI devices, but industry estimates give a realistic range. One consultancy puts a standard MFDS review at about 6 to 12 weeks, with each deficiency-query round adding 2 to 6 weeks. KGMP certification, if required, can add 6 to 16 weeks. Products needing clinical trials can add 6 to 18 months.

Treat these as planning ballparks, not promises. Your classification, evidence quality and local partner all move the number.

Step-by-step: medical AI approval requirements in South Korea

1.    Confirm device status. Check intended use and claims against MFDS criteria for AI software.
2.    Classify and pick the route. Notification, certification or approval depends on class, novelty and predicates.
3.    Use pre-submission engagement if classification or evidence expectations are uncertain.
4.    Appoint a Korean license holder early. A responsive one speeds up communication and answers to MFDS queries.
5.    Prepare the technical file and validation data, with Korean translations done carefully, since inconsistent terminology can trigger resubmission.
6.    Start KGMP in parallel with your submission rather than after it.
7.    Respond to deficiency letters quickly and track every round.
8.    Prepare AI Basic Act documentation in parallel: oversight, explainability and user notices.

After approval: staying compliant

Approval isn’t the finish line. MFDS product approvals are valid for five years and KGMP certificates for three, so renewals belong in your launch plan from day one.

Software updates need care too. Changes to intended use, algorithms, performance, risk controls, cybersecurity or clinical claims may require notification, approval or documentation updates, so don’t treat a model update as a routine release in Korea.

Common mistakes to avoid

• Assuming ISO 13485 alone satisfies KGMP.
• Treating the AI Basic Act as an “AI company” problem rather than a device-and-deployment one.
• Assuming the Notice 2026-54 exemptions cover any “information” feature.
• Waiting out the grace period before building explainability and oversight files.
• Not planning for post-approval change control on model updates.

How South Korea compares in healthcare AI regulations in Asia

Looking across healthcare AI regulations in India, China, Japan, South Korea and Vietnam, South Korea stands out for layering a dedicated digital-products law and a comprehensive AI law on top of device regulation. Japan offers a pre-agreed update pathway for AI changes, China pairs device registration with heavy data law, India has just formalised software guidance, and Vietnam has a new risk-tiered AI law. If you’re building a country-by-country healthcare AI regulatory comparison, Korea is the market where documentation and explainability are most explicitly written into law.

FAQ: Korea healthcare AI laws and guidelines

Is medical AI regulated as a medical device in South Korea?

Yes, if its intended use and risk profile make it a medical device, and it falls under MFDS oversight and the Digital Medical Products Act for digital products.

What is “high-impact AI” in Korean healthcare?

It’s a category under the AI Basic Act for systems that could affect life, safety or fundamental rights, with healthcare among the covered sectors. Operators face duties on risk management, oversight and explainability.

Do foreign companies need a local representative?

Foreign AI operators meeting the user or revenue thresholds must appoint a domestic representative under the AI Basic Act, and device approval also requires a Korean license holder.

Can I skip clinical data for AI software?

Only in narrow cases. Notice 2026-54 allows certain exemptions for listed functions without clinical-effectiveness claims, and AI devices still need performance verification using healthcare data.

How long is an MFDS approval valid?

Five years, with KGMP certificates valid for three.

Is there a pre-submission process?

Yes. Notice 2026-6 set up a structured framework, which is especially useful for novel AI products.

Regulations and thresholds change quickly. Confirm current requirements with MFDS or a qualified local regulatory partner before filing. This is general information, not legal advice.