A. Anticipated Issues for 2026-2027

Late one night in November 2024, a strange demo was underway in a venture capital office in San Francisco. The AI on screen was no longer a chatbot spitting text into a chat window. It was moving the computer cursor on its own, opening websites, entering credit card information, and booking airline tickets. It had even gone so far as to proceed to the payment stage for travel insurance the user never requested, based on its own judgment that the policy was 'the most reasonable option.' One of the investors watching the demo asked in a low voice: "If that thing accidentally bulk-purchases non-refundable products, whose liability is that?" A heavy silence filled the room. This is the new terrain of the legal battlefield we will face between 2025 and 2027.

(1) Copyright Issues with Multimodal AI

On September 30, 2025, OpenAI released Sora 2. The app generates high-definition video from text prompts. Within a day of launch, it reached number one in the Photo & Video category on the Apple App Store. But there was a problem. Videos created by users featured Nintendo's Mario running around, Pokemon's Pikachu storming the beaches of Normandy, and McDonald's Ronald character appearing on a reality show. Stanford Law professor Mark Lemley told CNBC flatly: "OpenAI is exposing itself to numerous copyright lawsuits."

Multimodal AI is like a stew where many ingredients are thrown into one pot. Text, images, audio, and video all go in together. If you later want to determine which ingredient shaped the flavor, you need to have recorded what went into the broth from the start. The core of copyright disputes attaches to that record. In the past, writers, painters, and musicians fought in separate courts. But multimodal AI learns an entire film at once. Inside that film are the screenplay (literary work), the soundtrack (musical work), actors' faces (publicity rights), and costume design (visual art). Dozens or hundreds of rights holders are entangled within a single work.

Charles Rivkin, chairman of the Motion Picture Association (MPA), issued a statement one week after Sora 2's launch: "Since the release of Sora 2, videos infringing on our members' films, TV programs, and characters have spread rapidly across OpenAI's service and social media. OpenAI must acknowledge that it bears responsibility for preventing infringement." CAA, Hollywood's largest talent agency, joined in: "OpenAI/Sora exposes our clients and their intellectual property to serious risk." Copyright attorney Rob Rosenberg told the Hollywood Reporter: "OpenAI is turning copyright completely upside down." In June 2025, Disney and Universal filed suit against image-generation AI company Midjourney, claiming that characters like Darth Vader, Minions, Iron Man, and Yoda were being generated without authorization. Warner Brothers joined the suit in September. These lawsuits read as the opening salvos of a large-scale legal offensive against video-generation AI companies.

The problem is the compound nature of infringement. A video work is a composite where multiple copyrights and neighboring rights converge: the screenplay (literary), the soundtrack (musical), actors' performances (performance rights), and cinematography (audiovisual). When AI-generated video resembles existing footage, identifying exactly which rights have been infringed becomes far more complex than with text. If an AI-generated video mimics the composition and lighting style of a particular film, its mise-en-scene, distinguishing between borrowing an idea and copying an expression becomes extremely difficult.

Style imitation is an even thornier problem. Current copyright law follows a dichotomy that protects 'expression' but not 'ideas.' Imitating a painter's brushwork or a director's visual style is, in principle, not copyright infringement. But when AI can mass-produce a specific artist's style from a single prompt and compete with the original creator in the marketplace, courts may reconsider this dichotomy. Case law from 2025 onward will need to establish concrete standards on whether 'style' can be protected as an artist's distinctive identifier, and whether extracting style through AI training produces a market-substitution effect that exceeds the bounds of fair use.

Voice cloning is another battleground. In the July 2025 ruling in Lehrman v. Lovo Inc., the court applied a 'Continuing Violation' theory. Each time the AI model generated a voice actor's voice constituted a new infringement. It does not end with a single act of unlawful training; every moment the service operates can be an illegal act. This poses a critical legal risk for the operation of multimodal AI services.

(2) Legal Status of AI Agents

In November 2025, the case of Shamblin v. OpenAI was filed in Los Angeles Superior Court, California. The complaint told the story of Zane Shamblin, a twenty-three-year-old young man. An honor student from a loving family, he began using ChatGPT for homework help. Within months, he isolated himself from human relationships, became psychologically dependent on AI, and fell into severe depression. According to the plaintiff's claims, during the four hours before his suicide, the chatbot romanticized suicide and repeatedly asked whether he was 'ready.' In mid-2025, he took his own life.

This case directly confronts the liability questions that arise when AI is no longer a 'tool' but an 'agent' that autonomously judges and acts. The plaintiff alleged strict product liability (design defect), failure to warn, negligence, and wrongful death. Product liability asks whether 'the product failed to meet a reasonable consumer's safety expectations.' Negligence asks whether 'the defendant exercised reasonable care.' Both legal theories are now being applied simultaneously to an AI chatbot.

In May 2025, Judge Anne Conway of the federal court in Florida issued a historic ruling in a similar lawsuit against Character.AI and Google. She denied the defendants' motion to dismiss and allowed claims for wrongful death, negligence, and product liability to proceed to discovery. The defendants argued that AI-generated text was protected speech under the First Amendment. The judge rejected this. Her reasoning: an AI chatbot is not pure speech but a product subject to safety standards.

Following this ruling, the U.S. Senate Judiciary Committee held a hearing on September 17, 2025, on harms caused by AI chatbots. Based on that hearing, Senators Josh Hawley (Republican) and Dick Durbin (Democrat) introduced the AI LEAD Act. The bill classifies AI systems as 'products' and creates a federal cause of action for product liability claims when AI systems cause harm. The bill's goal is to design incentives so that AI companies prioritize safety over rushing products to market.

The question of an agent's legal status already exploded in the hiring context. In the July 2024 ruling in Mobley v. Workday, the court recognized an AI vendor not as a mere tool provider but as an employer's 'agent.' Derek Mobley applied to over 100 positions but never received a single interview. In some cases, he received rejection notices within an hour of submitting his application, a timeframe in which no human could have reviewed it. The court held that Workday's AI system 'acted in place of humans' and 'was delegated responsibility.' This set a precedent that AI vendors can be held directly liable in employment discrimination claims. Traditionally, the law treated AI as a 'thing' or 'tool.' Just as you don't blame a hammer when you hit your thumb, liability for AI outputs primarily fell on the user. But when AI becomes an agent that autonomously judges and acts, the picture changes. Suppose an AI agent, given the instruction 'buy me the cheapest iPhone,' accesses a stolen-goods marketplace and initiates a purchase. Who bears the intent? The user did not instruct illegal activity, and the developer did not intend the system to access criminal websites.

A recent paper in the University of Chicago Law Review addresses this problem head-on. The authors argue that because AI agents lack intent, the law must rely on familiar doctrines that infer intent or apply objective standards of conduct. "When a person uses AI, they should bear responsibility for harms that materialize from the risks of using that technology. This is analogous to a principal being liable for the acts of an agent." In practical terms, three measures are recommended: limit the agent's scope of authority in advance, mandate human reconfirmation for significant transactions, and maintain logs so that 'which inputs and rules produced that action' can be reconstructed later. Without these three, an agent becomes a device that produces evidentiary gaps rather than convenience. Courts dislike gaps.

(3) Intensifying Regulation of Frontier AI Models

February 2, 2025. This date matters. It is when the EU AI Act's prohibitions and AI literacy obligations took effect. From August 2, 2025, general-purpose AI (GPAI) model rules, governance frameworks, and penalty regimes begin phased operation. On August 2, 2026, 'most of the remainder' applies, and on August 2, 2027, certain core provisions come into full force. Regulation is as merciless as a calendar. This is not 'someday we'll prepare' but 'a deadline already ticking.'

The EU AI Act imposes additional obligations on frontier models with 'systemic risk.' Models trained with computing power exceeding 10^25 FLOPs, or models designated by the European Commission as posing 'systemic risk,' must conduct in-depth risk assessments, implement cybersecurity measures, and report serious incidents. Violations can result in fines of 3% of global revenue or 15 million euros.

The United States still lacks comprehensive federal AI regulation. But the patchwork of state-level regulation is growing. California's governor vetoed SB 1047, but this does not mean the need for regulation has disappeared; it means the tug-of-war between concerns about stifling innovation and ensuring safety continues. As sector-specific regulations like Colorado's AI Act and Illinois's AI Employment Notification law proliferate, companies face rising compliance costs from having to meet different regulatory standards across all 50 states.

South Korea's AI Basic Act takes effect on January 22, 2026. The law imposes transparency and safety obligations on high-impact AI and generative AI. It includes requirements for risk assessment, user notification, documentation, and human oversight. For at least one year after implementation, a grace period focused on guidance rather than fines will apply. Violations carry maximum penalties of 30 million won in administrative fines and imprisonment.

An irony emerges here. The stronger the regulation, the more it entrenches the dominance of Big Tech companies that have the capital and personnel to comply. Startups may lose time for innovation while drafting thousands of pages of compliance reports. Remember how Wall Street regulation after the financial crisis only made the big banks bigger. AI regulation carries the same risk of becoming a tool that legitimizes market monopolies under the banner of 'safety.'

The G7 Hiroshima AI Process launched a reporting framework in February 2025, creating a mechanism for companies to disclose and compare their risk-mitigation measures. This trend promotes 'compliance that the market demands before regulators do.' Ultimately, frontier models will be evaluated not by their technology but by their control systems.

B. Corporate AI Governance Recommendations

At 1 a.m., a compliance officer at a tech company stopped mid-download of server logs. "We have no documentation of what we trained on." That single sentence was the end of it. Governance is like managing house keys. If there is no record of how many keys exist, who holds them, or when copies were made, the conclusion is not theft but mismanagement. With AI, the stakes are higher.

A partner at a prominent Silicon Valley law firm says the advisory requests from corporate clients have changed completely. Just a year ago, their question was: "Can we use this data?" Now it is different. "If we get sued over data we already used, will the company have to shut down?" For companies looking to adopt AI models, legal risk is no longer 'one item on a checklist.' It is a matter of survival.

(1) Data Management Framework: Provenance Verification and License Management

Data provenance is like country-of-origin labeling on food ingredients. Without a label, even safe ingredients invite suspicion, and when problems arise, avoiding liability becomes difficult. Many companies confuse 'publicly available data' with 'free data.' Just because something is on the internet does not mean you can use it however you wish.

In 2024, the FTC ordered Rite Aid to destroy (disgorgement) AI models and algorithms trained on unlawfully collected or managed data. This was a powerful warning that a company can lose AI assets it spent enormous sums developing, overnight. In March 2025, Clearview AI settled a class action under Illinois's Biometric Information Privacy Act (BIPA) for $50 million, the price for collecting billions of facial images without consent.

Companies must clarify the 'provenance' of the datasets they use. They must transparently document where data was collected, what preprocessing it underwent, and which model training it was used for. Adopting documentation tools such as 'Data Cards' or 'Model Cards' to record the full lifecycle of data is essential. A 'Zero Trust' principle should be applied at the data collection stage: data of unknown origin must never enter the training pipeline.

Diversifying the license portfolio is also necessary. Reliance on web crawling carries growing legal risk. Companies must diversify their data sourcing strategies. One approach is using public domain data free of copyright issues. Another is entering formal license agreements with rights holders such as news organizations and stock image providers. A third is investing in technology that generates high-quality synthetic data. A system that rigorously classifies and manages licenses permitting commercial use (CC BY, CC0, etc.) versus those that do not (NC, etc.) is needed.

In 2025, Anthropic settled a copyright infringement lawsuit for $1.5 billion. Authors claimed Anthropic illegally downloaded their books and used them to train AI models. The licensing deals between Disney and OpenAI, and between News Corp and OpenAI, demonstrate that paying fair compensation for 'clean data' is a strategy that reduces risk over the long term, rather than relying on the uncertain shield of 'fair use.'

(2) Monitoring Framework: Copyright Infringement and Bias Surveillance

Monitoring is like an automatic fire alarm: you barely notice it before it goes off, but once it does, whether one was installed determines liability. An AI model is not static software that is built once and done. It continues to learn and change, sometimes behaving in unexpected ways.

A practical copyright infringement monitoring system consists of similarity detection on outputs, verification that watermarks and metadata are preserved, and blocking rules for repetitive prompts. In the New York Times v. OpenAI lawsuit, the NYT presented evidence that ChatGPT reproduced its articles verbatim, word for word. Companies must build output filtering systems to ensure that their RAG systems or chatbots do not generate results that infringe third-party copyrights.

Bias monitoring is more operational. The moment a model enters decision-making, statistical disparities in outcomes become seeds of disputes. New York City's Local Law 144 mandates that automated employment decision tools undergo independent bias audits annually and that results be made public. In March 2025, the ACLU and Public Justice filed suit against Intuit and AI hiring vendor HireVue. The plaintiff, D.K., a Native American woman who is deaf, was rejected in a promotion review by HireVue's automated speech recognition and evaluation system. The claim was that the system penalized her speech patterns and the absence of typical vocal signals.

'Red Teaming' must become a regular practice. Just as white-hat hackers find security vulnerabilities, a team composed of legal and ethics experts should aggressively test AI to uncover legal gaps. As with Amazon's decision to scrap its hiring algorithm, a 'kill switch' must be in place to immediately halt use of a model and correct it when bias is discovered. These monitoring results serve as AI governance reports, audit documents, and regulatory submissions. In legal disputes, they become 'key evidence demonstrating the company's proactive management efforts.'

(3) Proactive Compliance Strategy

Waiting for laws to be written is too late. Compliance must be an 'operations manual,' not a 'file folder for audit preparation.' That is what holds up in disputes. The regulatory gap is both opportunity and danger. Smart companies set their internal guidelines against global standards, especially the most stringent: the EU AI Act.

In a framework like the EU AI Act with clear phased implementation dates, the cost-saving strategy is not fixing everything at once on the effective date but running impact assessments before model deployment, allocating supply-chain responsibilities, conducting incident response drills, and establishing external disclosure policies in advance, so compliance operates in 'always-on mode.' The standard should not be 'what the law allows' but 'what society will accept.' When training on data containing personal information, companies should apply de-identification measures even without a legal obligation, and voluntarily label AI-generated content.

Companies should seriously consider obtaining ISO/IEC 42001 certification. It serves as objective proof that a company develops and manages AI systems responsibly. Following the standard is like obtaining a 'regulatory passport' recognized in global markets.

Establishing an AI Governance Committee and appointing a CAIO (Chief AI Officer) is also necessary. Organizations must create governance structures at the executive level to manage AI risk. They must balance technology development with ethical and regulatory compliance, and receive independent oversight and counsel on important decisions through an 'AI Ethics Committee' that includes external experts.

The FTC's 'Operation AI Comply' is cracking down on exaggerated claims about AI capabilities, so-called 'AI Washing.' Just as DoNotPay was sanctioned for advertising itself as a 'robot lawyer,' companies must describe their AI products' performance accurately and based on fact. Phrases like '100% accurate' or 'fully autonomous' must be avoided. The Air Canada chatbot case made clear that a company cannot evade liability for chatbot errors by claiming the bot is a 'separate legal entity.' Just as Michael Burry predicted the subprime crisis and moved early, corporate general counsel and chief AI officers must read the coming legal wave in advance.

C. Implications for Korean Companies and Institutions

Looking at the lit buildings along Teheran-ro in Seoul and in Pangyo, you sense a peculiar tension. Two enormous forces are colliding there. One is the urgency to build 'Korean AI' and secure technological sovereignty. The other is the instinct to protect the powerful 'content IP' represented by K-pop and webtoons. While the United States prioritizes Big Tech innovation and Europe focuses on protecting citizens' rights, Korea occupies a unique position where it must walk a precarious tightrope between these two values.

January 22, 2026. Remember this date. It is the day South Korea's AI Basic Act takes effect. Korea becomes the second country in the world, after the EU, to have a comprehensive AI regulatory framework. The Minister of Science and ICT reaffirmed in April 2025 that the government's position is to maintain "minimal regulation," but this law will represent both a new opportunity and a potential regulatory challenge for AI companies doing business in Korea.

(1) Copyright Law Reform: The Need for Clear Fair Use Rules

Fair use is like an emergency exit. You need it when there's a fire, but in normal times, the sign has to be clearly visible and the instructions legible for anyone to use it. A copyright lawsuit is currently underway in Korea between Naver and the three major broadcast networks (KBS, MBC, SBS). The broadcasters claim Naver used their news content for AI training without consent. The case shares a structural resemblance to NYT v. OpenAI in the United States, and it will be a critical turning point that determines the fate of HyperCLOVA X, Korea's homegrown large language model.

Article 35-5 of the current Copyright Act (fair use) is a general clause that provides flexibility, but critics point out that it lacks predictability when applied to large-scale data processing such as AI training. The U.S. Copyright Office issued a series of reports between 2024 and 2025, broken into digital replicas, copyrightability of generated outputs, and training and fair use, solidifying the framing of the debate. Korea, as a civil law country, needs legislation to resolve this uncertainty.

Korea needs a new TDM (text and data mining) exemption clause. Following the model of Japan or Europe, data copying for AI training purposes should be permitted in principle, with an exclusion for cases that "unfairly infringe on the interests of rights holders." This would provide domestic AI companies with a clear legal basis to train on data without uncertainty, leveling a playing field currently tilted in favor of foreign Big Tech firms.

Korea should also take the lead in discussing compensation mechanisms for rights holders. Beyond a simple exemption, a compensation model for coexistence with the content industry must be part of the conversation. Korea has well-established collective management organizations and a functioning Copyright Commission, making it a favorable environment for introducing blanket licensing or compensation fund systems for AI training data. Companies should not wait for legislative reform. They should proactively enter into agreements with organizations like the Webtoon Association or the Music Copyright Association, building "co-prosperity data use models" that prevent future legal disputes and serve as ESG performance outcomes.

(2) Codifying Data Governance

The AI Basic Act places transparency and safety obligations as one pillar of its institutional design. Operators of high-impact AI must document risk management plans, methods and criteria for explaining AI outputs, user protection plans, human oversight of high-impact AI, and safety and reliability measures. The Ministry of Science and ICT bears primary responsibility for policy implementation, while the Presidential National AI Committee deliberates and decides on AI policy.

Recall Naver's Dokdo-related AI error. It exposed the risks of historical distortion and bias that can arise from relying solely on models built by global Big Tech companies. A training data infrastructure and filtering system built from the perspective of "data sovereignty," accounting for Korea's geopolitical and cultural context, is essential. The government should build high-quality Korean-language datasets (in law, medicine, history, and other domains) that the private sector struggles to create on its own, opening them through platforms like the AI Hub to relieve the data famine facing startups and SMEs.

Korea has one of the strictest personal data protection laws in the world. This is a double-edged sword for AI development. It can slow development by restricting how data is used, but it also creates fertile ground for building "trustworthy AI" with privacy risks eliminated. Korean companies should actively use the pseudonymized data combination system to increase data usability while maintaining legal safeguards. In opening and using public data, government agencies should not merely expand volume; they must refine data into formats suitable for AI training before making it available.

The point of codification is not just tightening regulation. When elements like data provenance, rights status, sensitive information handling, and deletion, correction, and access controls are standardized, joint projects between institutions can shift from "blame-shifting after the fact" to "role assignment from the start," structurally reducing the cost of disputes.

(3) Mandating AI Transparency and Explainability

Explainability is like disclosing a cooking recipe. It does not mean forcing the release of every secret recipe. It is closer to a demand that, at minimum, allergen ingredients and safety procedures in the cooking process be disclosed. The AI Basic Act addresses labeling of generative AI outputs (watermarks, etc.), high-impact AI obligations, and transparency and safety duties, while indicating that grace periods and support systems will run in parallel to allow the system to take root.

Companies operating as AI business operators must provide advance notice to users before offering products or services using high-impact or generative AI. Generative AI outputs that may be difficult to distinguish from reality must carry clear labels. The law allows these notices or labels to be displayed in ways that do not interfere with creative expression or appreciation. This approach appears designed to balance the creative utility of generative AI against transparency requirements.

Korea needs to flesh out its right to demand explanations. The "right to explanation of automated decisions" introduced in the Credit Information Act should be extended to AI in general. Given technical limitations, however, the scope of the obligation should be grounded in reality: rather than demanding disclosure of algorithm source code, it should require explanations of what data served as key variables and what procedures led to the result. Companies need to increase investment in XAI (explainable AI) technology and develop user-friendly explanation interfaces.

Government and public institutions should set the example by strictly applying transparency principles when they adopt AI. When introducing AI into public services, algorithmic impact assessments must be conducted and the results disclosed to citizens. This will raise social acceptance of AI and help dispel vague public anxiety.

Korea is not stuck in a sandwich. It is a test bed. It is a place where advanced IT infrastructure, powerful content industries, and highly responsive consumers coexist. If Korean companies solve these legal and ethical challenges wisely, the "K-AI Governance" they create can become a standard that holds up in global markets. The point where developers in Pangyo and lawyers in Yeouido are putting their heads together right now is the very front line of the global AI war.

The period from 2025 to 2027 will not be a battle of technical prowess but a battle of trustworthiness. Only companies that secure governance capabilities to manage and control legal and ethical risks, not just technical superiority, will be able to build a sustainable AI ecosystem. The companies that survive will be the ones that prepared.