Tech AI News - 테카이

Korea's digital trust society 2026 — from Incheon Airport's Smart Pass to the AI Basic Act

· 13 min read

This post was translated from the Korean original by AI.한국어 원문 읽기 →

Contents
  1. Background — why this topic now
  2. Key data and current state
  3. In-depth analysis
  4. 1. Enforcement of the AI Basic Act — what is new, and what is missing
  5. 2. The two faces of infrastructure and industry — benefits and shadows
  6. 3. The Personal Information Protection Commission's 'Biometric Information Protection Guide' — where Korean guidelines stand
  7. The four variables of Korea's balance point
  8. Implications for Korea — for citizens, companies, and government
  9. Outlook and variables to watch
  10. Conclusion
  11. ? AI Basic Act — statutes and policy
  12. ?️ Personal data protection and biometric data
  13. ? CCTV and Incheon Airport Smart Pass
  14. ? Korean facial recognition companies and industry

Korea's digital trust society 2026 — from Incheon Airport's Smart Pass to the AI Basic Act

Korea has one of the world's highest CCTV densities per capita, holds an EU GDPR adequacy decision, and on January 22, 2026 became the first country in the world to fully enforce an AI Basic Act. The infrastructure is in place and the legal system is aligned. But the real question lies elsewhere: where is Korea's balance point being formed, and what is missing? From the 158 Smart Pass gates to the global expansion of Suprema and Alchera and the subordinate rules of the AI Basic Act, a data-driven look.

Background — why this topic now

On January 22, 2026, the 'Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust' (the AI Basic Act) took effect.

It is the world's second comprehensive AI law after the EU AI Act. But its real significance is not that it is second; it is that Korea became the first country in the world to apply AI rules in full. With the EU having pushed back the application of its high-risk AI rules in stages to December 2027, Korea brought forward the actual full enforcement schedule the most (MS Today, December 2025).

At the same time, Korea's surveillance and biometric infrastructure is rapidly becoming everyday. Incheon Airport's Smart Pass expanded in 2025 to all 158 boarding gates with 11 airlines participating. Suprema's AI facial recognition products are projected to exceed 50% of total revenue in 2025 with exports at 80% (eToday, May 2025). Alchera's 'FaceTrust' solution is spreading across finance, the public sector, and manufacturing.

The regulatory side is being put in order too. On December 30, 2024, the Personal Information Protection Commission published its 'Biometric Information Protection Guide', setting out concrete guidance on processing sensitive biometric data such as facial recognition.

This article answers three questions.

First, where does Korea stand today?

Second, what does the AI Basic Act change in facial recognition and surveillance?

Third, what is missing, and where should we look over the next one to two years?

Key data and current state

  • AI Basic Act effective date: January 22, 2026, the world's second comprehensive AI law (Ministry of Science and ICT, January 2026)
  • Enforcement decree, notices, and guidelines: One enforcement decree and a total of seven notices and guidelines published in time for enforcement (Imagination Group, January 2026)
  • CCTV in Korea: About 19.6 million nationwide, about 1.61 million public (Personal Information Protection Commission, as of end-2022)
  • Incheon Airport Smart Pass: Expanded to all 158 boarding gates, 11 airlines participating (Incheon International Airport Corporation, September 2025)
  • Biometric Information Protection Guide: Revised edition published December 30, 2024, six principles for processing biometric data such as face, fingerprint, and iris (Personal Information Protection Commission)
  • Major Korean facial recognition companies: Suprema (AI facial recognition over 50% of revenue, 80% exports), Alchera (FaceTrust, FireScout), Hanwha Vision (edge AI video security, top-tier share in North America) (eToday / Korea Economic Daily / THE VC, 2025–2026)
  • GDPR adequacy decision: Korea's adequacy decision took effect in December 2021 — recognized as aligned with EU data protection standards

? Interpretation: Korea holds three assets at once: infrastructure (the pace of CCTV and biometric adoption), industry (facial recognition exporters), and a legal system (the AI Basic Act and GDPR adequacy). The problem is that these three assets do not automatically converge into a 'digital trust society'.

In-depth analysis

1. Enforcement of the AI Basic Act — what is new, and what is missing

The AI Basic Act adopts a 'risk-based regulation' model. It shares the same idea as the EU AI Act, but the classification scheme and intensity differ.

Newly introduced obligations (five):

  1. Transparency obligation — notice of AI use, mandatory watermarking of generative AI output (Korea Policy Briefing, January 2026)
  2. Safety obligation — procedures for verifying training data and algorithms
  3. Special responsibilities of high-impact AI operators — impact assessment, monitoring, and building a risk management system
  4. AI impact assessment — mandatory impact assessment before releasing a high-impact AI system
  5. Designation of a domestic representative — aimed at foreign Big Tech (Peekaboo Labs, February 2026)

Domains of high-impact AI: Mobility (autonomous driving), medical devices (diagnostic and treatment AI), finance (credit scoring and lending AI), and domains with a significant effect on an individual's rights, body, or lifeare included.

The decisive difference between Korea's AI Basic Act and the EU AI Act:

The EU AI Act has explicit prohibited practices . Real-time remote biometric identification in public places for law enforcement, emotion recognition in workplaces and educational institutions, and indiscriminate facial scraping are in principle illegal in the EU.

Korea's AI Basic Act, by contrast, sets no separate 'prohibited' domain, opting instead to manage risk by imposing obligations on high-impact AI. In other words, where the EU declares 'this is not allowed', Korea answers 'this must go through an impact assessment and safety obligations'.

Analysis: Risk-based regulation is a favorable model for pursuing industrial growth and trust-building at the same time, but the absence of EU-level clear red lines becomes a major variable in the dystopian scenario covered in Part 1. The key question is how additional restrictions on specific uses such as facial recognition, emotion recognition, and predictive policing are established at the enforcement decree and guideline stage.

2. The two faces of infrastructure and industry — benefits and shadows

The benefit side — the Smart Pass success story

Incheon Airport's Smart Pass, first introduced in Korea in July 2023, expanded to all 158 boarding gates in 2025. Eleven airlines participate (Korean Air, Asiana Airlines, Jeju Air, Jin Air, T'way Air, Air Seoul, Eastar Jet, Air Premia, Cathay Pacific, EVA Air, Delta Air Lines), and beyond the mobile app it links with financial apps such as KB Kookmin, Toss, Shinhan, Woori, and Hana, lowering the barrier to registration (Kyunghyang Shinmun / Nongmin Shinmun, 2025).

The key phrase in user reviews is 'the liberation of going hands-free'. Users say the hassle of repeatedly pulling out a passport and phone while holding a child's hand and dragging a suitcase disappears (personal review blog, November 2025). At the same time, the unease of 'they keep my sensitive facial biometric data for five years?'is expressed in everyday language. What matters is that both feelings appear at once in the same review by the same user.

The industry side — Korean facial recognition companies go global

Suprema's AI facial recognition became its flagship product in 2025, exceeding 50% of revenue, with exports at 80% (eToday, May 2025). It supplies access security products to one of the world's top two data center operators and the largest US social media company, among others, and in October 2025 unveiled an 'AI facial recognition search solution' for police and public agencies. The system aims to secure the golden hour in missing-person searches and suspect tracking (Korea Economic Daily, October 2025).

Alchera is a vision AI solutions company supplying FaceTrust (facial recognition) and FireScout (early AI detection of fire and smoke). FireScout is deployed at about 50,000 households in 60 apartment complexes in Korea, with more than 3,700 cameras (THE VC analysis, April 2026).

Hanwha Vision holds a top-tier share of the North American market with edge-AI-based video security solutions (industry analysis, April 2026).

Analysis: The success of Korean facial recognition companies cuts both ways. On one hand it is the advance of globally validated K-AI technology; on the other, Korean companies now face the same question raised in the Digital Silk Road discussion of Part 2 — is due diligence on the human rights and regulatory environment of export destinations sufficient? .

3. The Personal Information Protection Commission's 'Biometric Information Protection Guide' — where Korean guidelines stand

The 'Biometric Information Protection Guide' published by the Personal Information Protection Commission on December 30, 2024 is the key document that concretizes Korean standards for processing biometric data such as facial recognition.

The guide's six core principles (reflecting privacy-by-design):

  • Clear definitions: distinguishing physical (fingerprints, face, iris and retinal blood vessel patterns, etc.), physiological (brainwaves, ECG, genetic information, etc.), and behavioral (voice, handwriting, gait, typing speed, etc.) characteristic data
  • Distinguishing authentication from identification — separating 'authentication' for verifying permissions such as access control from 'identification' for picking out a specific person among many, with differentiated protection
  • Consent-based processing, minimal collection, and stated retention periods
  • Disclosure of processing policies and guarantee of data subject rights
  • Security measures (encryption, access control, etc.)
  • Case-by-case application guidance based on compliance inspections

In addition, a guide to providing alternative authentication for those who do not provide biometric datais issued separately, spelling out the right to be guaranteed another authentication method when refusing facial recognition (Personal Information Protection Commission materials).

Analysis: Compared with the EU AI Act's explicit prohibitions, Korea's guidelines are less about 'preventing use' and more about 'setting the procedures to follow when using'. This difference is also a difference in policy philosophy. For the Korean model to work, a compliance inspection and sanction system that ensures the guidelines' effectivenessmust operate alongside them, and this remains the key task for the next one to two years.

The four variables of Korea's balance point

The conclusion of Part 1 proposed four forks separating the two scenarios: ① clear red lines, ② the binding force of after-the-fact verification, ③ citizens' right to know and to refuse, and ④ whether PETs are mandated. Applied to Korea, they look like this.

First, red lines — weak. The AI Basic Act takes a risk-based approach without explicit prohibitions. Unless additional restrictions on specific uses such as facial recognition, emotion recognition, and predictive policing are added in the enforcement decree and guidelines, the dystopian variable from Part 1 remains as is.

Second, after-the-fact verification — taking shape. New procedures such as mandatory AI impact assessments and special responsibilities for high-impact AI operators are being introduced. But external verification of assessment results and the adequacy of effective sanctions for violations (fines at the 30 million won level) will be judged through one to two years of operation after enforcement.

Third, citizens' rights — good, but awareness is low. The institutional basis exists: the 'Biometric Information Protection Guide', data subject rights regarding automated decisions, and the guide on alternative authentication. The problem is that most citizens do not know these rights exist.

Fourth, mandatory PETs — undecided. The AI Basic Act does not directly mandate the application of privacy-enhancing technologies such as federated learning, differential privacy, and homomorphic encryption. On the industry side it encourages voluntary adoption, but whether to mandate them for high-impact AI is a future policy decision.

Implications for Korea — for citizens, companies, and government

From the citizen's perspective: The right to refuse facial recognition, the right to demand alternative authentication, and the right to demand an explanation of how one's data is processed already exist in law. Even with convenience services like Incheon Airport's Smart Pass, real balance is created when citizens form the habit of comparing options at the adoption stage and checking retention periods and scope of use.

From the company's perspective: As the global expansion of Korean facial recognition companies such as Suprema, Alchera, and Hanwha Vision gets under way, self-directed development of a human rights due diligence framework for export destinationsis needed. The Digital Silk Road cases covered in Part 2 carry strong implications for Korean companies too. Absorbing global standards such as the EU's dual-use regulation and the US entity list into their own review criteria is advantageous for long-term market trust.

From the government's perspective: The operating data from the first one to two years after the AI Basic Act's enforcement will decide the success or failure of the Korean model. Supplementing the enforcement decree and guidelines, the accumulation of violation cases, and whether citizen feedback channels function are the keys. Absorbing the incidents and rulings that emerge when the EU AI Act fully applies in August 2026 and quickly updating Korean guidelines is another important task.

Outlook and variables to watch

  • AI Basic Act operating data (2026–2027): Whether impact assessments work as a substantive verification tool rather than becoming a formality, and whether the watermarking and transparency obligations are enforced effectively, are the key indicators.
  • Additional guidelines from the Personal Information Protection Commission: Whether additional guidance aligned with the EU AI Act emerges for facial recognition, emotion recognition, and predictive policing.
  • Global compliance of Korean companies: How Suprema, Alchera, and Hanwha Vision pass AI Act conformity certification when entering the EU is the touchstone showing the global standards fit of Korean facial recognition technology.
  • Civil society monitoring capacity: Whether monitoring by digital rights groups, academia, and the press takes root as a mechanism for verifying compliance by government and companies.

Conclusion

Three things the reader should take from this article.

First, Korea is a rare country holding all three assets at once: infrastructure, industry, and a legal system. But holding the assets is not the same as achieving balance. The AI Basic Act is a starting point, not a destination.

Second, the decisive difference from the EU AI Act is the 'absence of explicit prohibitions'. The risk-based model favors industrial growth, but unless additional guidelines follow for areas such as facial recognition, emotion recognition, and predictive policing, the dystopian variable from Part 1 remains as is.

Third, the balance point does not form automatically. Citizens' awareness of their rights, companies' voluntary due diligence, the government's operational supplements, and civil society's monitoring must work as four axes at the same time. 2026–2027 will be the period when the substance of Korea's digital trust society is revealed.

In Part 4, we widen the view back to the global level and analyze in depth how the boundary between real-time and retrospective facial recognition is drawn as the EU AI Act fully applies in August 2026.

? AI Basic Act — statutes and policy

?️ Personal data protection and biometric data

? CCTV and Incheon Airport Smart Pass

? Korean facial recognition companies and industry

This series is the four-part 'Surveillance Society: Utopia/Dystopia'.

Part 1: Surveillance society 2026 — utopia or dystopia, which are we closer to? 
Part 2: China's social credit system 2026 — why the real threat is 'integrated data infrastructure', not a single score
Part 3: Korea's digital trust society — from Incheon Airport's Smart Pass to the AI Basic Act (this post)
Part 4: The EU AI Act in August 2026, what really changes — the boundary between real-time and retrospective facial recognition (upcoming)

  • #suprema
  • #personal information protection commission
  • #alchera
  • #incheon airport smart pass
  • #hanwha vision
  • #ai basic act
  • #korean ai regulation
  • #biometric data protection
  • #facial recognition korea
  • #digital trust society

Related posts

AI Industry Analysis

Surveillance society 2026 — utopia or dystopia, which are we closer to?

The future shaped by AI and facial recognition forks in two directions. On one side is a utopia that protects privacy while maximizing social benefit; on the other, a dystopia in which everyday life is reduced wholesale to data. Looking evenly at the three axes of technology, regulation, and national models as of 2026, the conclusion is clear: neither is inevitable, and everything depends on how governance is designed.

· 12 min

AI Industry Analysis

AI and the future of human relationships and mental health

A clinical trial found an AI chatbot cut depressive symptoms nearly in half, while a study found that the more people rely on AI friends, the lonelier they get, and both landed at the same time. Whether AI becomes a treatment for the mind or a substitute for relationships that deepens isolation: we are at that fork now.

· 7 min

AI Industry Analysis

The AI data center power problem — 'electricity hog' or engine of the green transition? (2026 Utopia vs. Dystopia ⑥)

The GPU drought is over, and the contest is now decided by power. In 2026, the approval rate for data center grid connections in Korea's capital region fell to 1.9%, and in the US a $130 billion project was canceled 'for lack of power'. Is AI devouring the climate, or bringing the energy transition forward? This installment examines both faces with data.

· 8 min