Split View: EU AI법 컴플라이언스 완전 가이드: 2026년 8월 시행 전 준비해야 할 모든 것

1. Prohibited Risk
   - Example: Concealed surveillance, child exploitation material generation
   - Penalty: Immediate ban and fines

2. High-Risk
   - Systems affecting fundamental human rights
   - Major examples detailed below
   - Penalty: Fines up to 3.5 billion euros for non-compliance

3. Medium-Risk
   - Significant impact applications
   - Penalty: Fines up to 10 million euros
   - Enforcement: December 2026

4. Minimal-Risk
   - Spam filters, video game AI
   - Penalty: None
   - Voluntary compliance recommended

1. Biometric Systems
   - Facial recognition, fingerprint recognition, iris scanning
   - Emotion recognition technology
   - Gender, age, race inference AI

   Examples: Airport border control AI, retail surveillance

2. Critical Infrastructure
   - Power grid management AI
   - Transportation system control
   - Telecommunication security

3. Education
   - Student evaluation AI
   - Scholarship allocation AI
   - Admission assessment AI

4. Employment
   - Job applicant screening AI
   - Worker performance evaluation
   - Employee monitoring systems

   Examples: Resume auto-screening, work-hour tracking

5. Essential Public Services
   - Housing allocation AI
   - Social security benefit determination
   - Medical resource allocation

6. Law Enforcement
   - Crime pattern prediction AI
   - Suspect profiling AI
   - Recidivism risk assessment

7. Judicial Decisions
   - Judgment prediction systems
   - Sentencing recommendation AI
   - Bail determination AI

8. Fundamental Rights Impact Areas
   - Credit scoring AI
   - Insurance approval AI
   - Loan assessment AI

Required Elements:

1) Initial Risk Assessment
   - Determine if system is high-risk
   - Analyze fundamental rights impact
   - Estimate potential harm scale

2) Risk Management Plan
   - Mitigation strategy for each identified risk
   - Risk monitoring methodology
   - Emergency response procedures

3) Periodic Re-assessment
   - Minimum every 6 months
   - Based on operational data
   - Document improvements

Documentation:
- Minimum 10-year retention
- Submission to authorities upon request
- Delivery to EU representative

Required Standards:

1) Training Data
   - Representativeness verification
   - Bias validation
   - Diversity assurance
   - Quality documentation

2) Validation Data
   - Separated from training data
   - Third-party verification
   - Bias and accuracy reporting

3) Testing
   - Multi-demographic testing
   - Edge case testing
   - Adversarial attack testing

4) Post-Deployment Monitoring
   - Real-time performance tracking
   - Error rate monitoring
   - User feedback collection

Documentation Example:
"Our recruitment AI trained on 10,000 resumes from 5 regions, 30 job categories. Accuracy by gender: Male 95%, Female 94.2%. Accuracy by age: 25-35 years 95.5%, 55-65 years 92.1%. Variance analysis: Female selection rate 3.8 percentage points difference."

Required Standards:

1) Transparency Declaration
   - System purpose specification
   - Operation principle explanation
   - Limitation disclosure
   - User-language documentation

2) Explainability (Explain-ability)
   - Decision process must be explainable
   - Particularly for negative decisions

   Example: "Hiring rejection reasons:
   1) Less than 3 years relevant experience (weight 40%)
   2) Technical stack mismatch (weight 35%)
   3) Regional preference (weight 25%)"

3) Public Registry
   - Registration in EU AI Register
   - Publicly accessible
   - Real-time updates mandatory

4) User Notification
   - Notification when receiving AI decision mandatory
   - "This decision was made by automated AI system"
   - Appeal method guidance

Required Standards:

1) Human-in-the-Loop
   - Final decisions by humans mandatory
   - Fully automated decisions prohibited

   Prohibited Examples:
   - AI making hiring decision alone
   - Automated credit assessment only
   - AI delivering court judgment

2) Designated Responsible Person
   - Designate person per high-risk AI
   - That person reviews AI decisions
   - Accountability tracking enabled

3) Audit Rights
   - Regulatory authority verification right
   - Company mandatory data disclosure
   - 3-month response requirement

4) Record Maintenance
   - Comprehensive operational records
   - Decision history traceability
   - Minimum 10-year preservation

Required Standards:

1) Technical Robustness
   - Withstand adversarial attacks
   - Fail safely when errors occur
   - Alert systems for performance collapse

   Testing Examples:
   - Minimal result change with slight input variation
   - Extreme input value handling
   - Noisy data processing

2) Security Standards
   - Unauthorized access prevention
   - Data encryption
   - Audit log protection

3) Cybersecurity Incident Response
   - Incident response plan
   - Swift response procedures
   - Authority notification within 72 hours

High-Risk AI Non-Compliance:

Stage 1: Warning
   - Initial detection
   - Remediation request
   - 3-month improvement opportunity

Stage 2: Administrative Fines
   - 7% of global annual revenue OR 350 million euros, whichever higher
   - Based on previous year's global revenue

   Calculation Examples:
   Apple's high-risk AI non-compliance:
   → Global annual revenue 39.4 billion dollars
   → 7% = 2.75 billion dollars
   → Maximum: 3.5 billion euros (about 4 billion dollars)

   Samsung's high-risk AI non-compliance:
   → Global annual revenue 24.3 billion dollars
   → 7% = 1.71 billion dollars
   → Maximum: 3.5 billion euros

Stage 3: Criminal Prosecution and Ban
   - System operation stop order
   - Board-level penalties
   - Criminal liability (in some cases)

Transparency Non-Compliance:
- Maximum 10 million euros or 3% revenue, whichever higher
- Less stringent but still serious

Examples:
- Emotion recognition AI lacking transparency
- Inadequate AI usage notification
- Missing explainability

Direct Impact Companies:
1) Global AI Service Providers
   - Recruitment AI service providers
   - Credit evaluation AI providers
   - Facial recognition technology companies

2) Global Manufacturers
   - AI-inclusive products sold in EU
   - Autonomous vehicle makers
   - Medical device companies

3) EU Subsidiaries/Branches
   - EU-based AI development
   - EU AI deployment

Major Companies Affected:
- Samsung: Autonomous driving, biometrics, IoT AI
- LG: Appliance AI, robotics AI
- SK: Subsidiary AI, factory automation
- Naver/Kakao: Recommendation algorithms, image recognition

March-April 2026 (Now):
□ Conduct Audit
  - Create inventory of all AI systems
  - Determine high-risk status for each
  - Prioritize affected systems

□ Establish Legal Team
  - Hire EU AI expert lawyer (or external counsel)
  - Form internal compliance team
  - Designate departmental liaisons

April-June 2026:
□ Begin Risk Assessments
  - Draft formal assessment documents for high-risk AI
  - Identify current deficiencies
  - Develop improvement plans

□ Data Management Enhancement
  - Organize and document training data
  - Introduce bias analysis tools
  - Establish independent validation process

June-August 2026:
□ Technical Improvements
  - Implement improvements per assessments
  - Add transparency features
  - Enhance explainability

□ Complete Documentation
  - Finalize all required documents
  - Prepare EU AI Register registration
  - Establish authority response systems

Post-August 2, 2026:
□ Full Compliance
  - All systems meet requirements
  - Ongoing monitoring
  - Record maintenance and reporting

Estimated Compliance Costs by Company Size:

Small (50 employees, 1-2 high-risk AIs):
- Legal consulting: 2-3 million won/month × 6 months = 12-18 million won
- Technology improvement: 5-10 million won
- Monitoring tools: 20-50 million won/year
- Total: Approximately 100-200 million won

Medium (500 employees, 5-10 high-risk AIs):
- Dedicated team: 3-5 people, approximately 200-300 million won/year
- Legal consulting: 5-10 million won/month × 6 months
- Technology improvement: 500 million - 1 billion won
- Monitoring systems: 100-200 million won/year
- Total: Approximately 500-1,500 million won

Large (5,000+ employees, 20+ high-risk AIs):
- Dedicated department: 10-20 people, approximately 1-2 billion won/year
- Legal consulting: 10-20 million won/month
- Technology improvement: 500 million - 10 billion won
- Monitoring and compliance: 500 million - 1 billion won/year
- Total: Approximately 10-20 billion won

Preparation Status:
- Azure AI Services compliance mode added
- Copilot transparency options enhanced
- Face Recognition API usage restricted

Specific Actions:
- AI usage terms presented to all customers
- Data localization per EU customer
- Cooperation with independent oversight bodies

Preparation Status:
- AI Principles strengthened
- Gemini AI restriction features added
- Quarterly transparency reports

Specific Actions:
- Enhanced recommendation algorithm bias validation
- User advertising AI choice provision
- Pre-registration in EU AI Register

Preparation Status:
- Rekognition (facial recognition) usage limited
- Hiring Tools partially discontinued
- AWS AI service compliance options added

Specific Actions:
- Law enforcement exclusion policy
- Biometric technology usage restrictions published
- Enhanced EU customer protection standards

□ Board-level compliance approval
□ Designate Chief AI Compliance Officer
□ Set August 2026 full compliance target
□ Allocate budget (per cost estimate above)
□ Contract EU AI expert consultant

□ Comprehensive audit of current AI systems
□ Determine high-risk status per EU AI Act
□ Develop improvement plan per system
□ Prepare risk assessment documents
□ Establish compliance policies
□ Prepare EU AI Register registration
□ Create authority response procedures

□ Improve training data quality (bias analysis)
□ Enhance model interpretability (explainable AI)
□ Build monitoring systems (performance tracking)
□ Strengthen security (encryption, access control)
□ Adopt documentation automation tools
□ Expand test suites (diverse demographics)

□ Review EU customer service plans
□ Adjust pricing (reflect compliance costs)
□ Revise marketing messages (emphasize transparency)
□ Prepare customer education programs
□ Monitor competitor compliance status
□ Review regulatory risk insurance