South Korea Drafts Agentic AI Security Rules as Multi-Jurisdiction Pressure Builds

What happened

Why it matters

• ·Enterprises operating in South Korea now face a credible near-term regulatory obligation for agentic AI. The Korea AI Basic Act already establishes a baseline legislative framework, and sector-specific security rules from KISA would add binding operational requirements on top of it.
• ·The KISA initiative exposes a common gap: most enterprise AI governance programs treat agentic systems under generic AI risk frameworks rather than with purpose-built controls. Organizations that have not separately classified and governed their agentic deployments will face remediation pressure once guidelines are finalized.
• ·Multinationals with APAC compliance programs face compounding multi-jurisdiction obligations, since Korea, Singapore, China, and the Five Eyes nations are all converging on agentic AI controls simultaneously. Compliance teams that have not begun cross-jurisdiction mapping will find the requirements increasingly difficult to reconcile on a single timeline.

Governance controls affected

What to do now

• ☐Inventory all agentic AI systems deployed in or accessed from South Korean operations and document their current human oversight levels.
• ☐Map existing agentic controls (permission boundaries, kill switches, audit trails) against the stated KISA focus areas of autonomous behavior governance, operational accountability, and review gates.
• ☐Assign a compliance owner to monitor the KISA guideline development process and flag the finalization date as a regulatory deadline trigger.
• ☐Review your multi-jurisdiction agentic AI compliance map to confirm South Korea is included alongside existing Five Eyes and Singapore agentic guidance obligations.
• ☐Update your AI vendor due diligence questionnaire to ask third-party providers deploying agentic systems into Korean environments about their readiness for KISA security requirements.

What to watch next

Compliance teams should monitor KISA for the draft guideline publication, which will reveal whether requirements are advisory or carry enforcement mechanisms. Watch for the Korea AI Basic Act to be referenced as the legislative basis for any binding security obligations that follow. More broadly, the APAC agentic governance landscape is moving fast: Singapore's MDDI Response on Extending AI Governance to Agentic AI Systems and China's Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents may both influence how KISA frames its final requirements, making cross-jurisdiction monitoring a near-term priority.