Compliance & Governance

Compliance, by construction.

The regulatory environment around AI shifted faster in the last twelve months than in the previous decade. This page is a public summary of how TenetCode aligns engineering practice with the Korean AI Framework Act, FDA–EMA joint principles, and MFDS generative-AI medical device guidelines.

Korea AI Framework Act (effective 2026-01-22)

The Framework Act on the Development of Artificial Intelligence and Establishment of Trust took effect on 22 January 2026 — the world's second comprehensive AI law after the EU AI Act. It introduces specific obligations for "high-impact" AI systems in critical sectors including healthcare, energy, and public services, and mandatory labeling for certain generative-AI applications.

What we ship to align

Risk classification documented per deployment, with the high-impact assessment archived alongside the system
Generative-AI labeling baked into the UI layer for end-user-facing surfaces
Korean data residency by default — KR-region inference and storage unless the customer opts out in writing
Audit-grade logs (request, prompt, model version, output, decision) retained per the customer's policy

FDA–EMA Good AI Practice in Drug Development (Jan 2026)

On 14 January 2026 the FDA and EMA jointly released ten guiding principles covering the entire AI lifecycle in drug development: human-centric design, risk-based approach, adherence to standards, clear context of use, multidisciplinary expertise, data governance and documentation, model design and development practices, risk-based performance assessment, lifecycle management, and clear essential information.

How our Regulatory AI track maps

Context-of-use specification authored at project kickoff and re-validated at each milestone
Evaluation harness with human-in-the-loop checkpoints for any output that informs a regulatory submission
Data lineage tracked from source document → extraction → model output → submitted artifact
Lifecycle plan filed before deployment: drift monitoring, retraining triggers, decommission criteria

MFDS generative-AI medical device guidelines

Korea's Ministry of Food and Drug Safety published the world's first approval-and-review guideline specifically for generative-AI medical devices, alongside an AI utilization guide for drug development. We treat both as binding for engagements that touch a regulated medical workflow.

TenetCode is not a medical device manufacturer. We design the data and AI infrastructure that supports manufacturers and sponsors. Where deliverables enter a medical device or submission package, the customer remains the regulatory holder.

Data residency & sovereign infrastructure

Korean financial institutions, government agencies, and defense contractors face strict data residency requirements that hyperscaler routing through Tokyo or Singapore does not satisfy. Our default deployments use Korean cloud capacity (NHN Cloud, KT Cloud, NAVER Cloud) or on-prem, with cross-region traffic explicitly authorized.

KR-region GPU inference where required, including coordination with the National AI Computing Center timelines
Hybrid topology: training on whichever region the data permits; inference on-shore
Encryption at rest and in transit; key custody documented and customer-controlled where requested

Questions, audits, evidence requests

If your security or compliance team needs a specific evidence package — data flow diagrams, model cards, eval reports, lineage exports — write to hello@tenetcode.com and we will scope a response within five business days.