AI Security Wiki GitHub

Home / Japan AI Compliance / Japan AI Regulatory Hub

Japan AI Regulatory Hub

Verification required. Claims on this page about Japanese law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

This page maps Japanese laws, guidance and standards that bear on AI to the wiki's controls.

1. Regional model

Japan puts soft law first. Obligations on private firms come mainly from existing laws (privacy, copyright, consumer and sector rules). The AI Promotion Act sets principles and national coordination. The guidelines are voluntary, and they are the reference that buyers use [Reported].

2. Instrument register

# Instrument Type / status Key points Wiki controls Tag To verify
JP1 AI Promotion Act Law; 4 Jun 2025 Basic principles, AI Basic Plan, AI Strategic Headquarters; favours promotion over restriction AI-CTRL-012 [Reported] Any duties on businesses; investigation or publication powers
JP2 AI Basic Plan Cabinet decision; adopted 14 Jul 2026, replacing the plan of 23 Dec 2025 National policy priorities; not binding on firms AI-CTRL-012 [Reported] Content
JP3 Guidelines for AI Business (MIC and METI), version 1.2 (31 Mar 2026) Non-binding Voluntary risk reduction across the AI lifecycle for developers, providers and users AI-CTRL-012, AI-CTRL-037, AI-CTRL-039, AI-CTRL-041 [Reported] Official text; the English version is provisional
JP4 Act on the Protection of Personal Information (APPI) Binding Personal data use, purpose limits, cross-border rules AI-CTRL-013, AI-CTRL-007, AI-CTRL-035 [Recalled] AI points from the PPC
JP5 Copyright Act Art. 30-4 (information analysis exception) Binding Permits certain uses for AI training, with limits AI-CTRL-029 [Recalled] Current interpretation and limits
JP6 Sector rules (financial, medical devices, others) Binding Existing rules apply to AI AI-CTRL-014, AI-CTRL-037 [Unverified] Per sector

3. Categories, tiers and roles

Category / role What it means
AI developer Builds or fine-tunes AI
AI provider Offers AI systems or services
AI business user Uses AI in business
Non-business user / third party Affected persons
No statutory tiers The guidelines work by role and have no risk classes

4. Timeline

Date Event Tag
4 Jun 2025 AI Promotion Act [Reported]
23 Dec 2025 First AI Basic Plan [Reported]
31 Mar 2026 Guidelines version 1.2 [Reported]
14 Jul 2026 Revised AI Basic Plan [Reported]

5. Mapping of common wiki controls

Wiki control Regional hook
AI-CTRL-012 Policy Guidelines for AI Business self-assessment (JP-T1)
AI-CTRL-013 Privacy APPI
AI-CTRL-029 Training data Art. 30-4 analysis (JP-T2)
AI-CTRL-037 Risk Guideline risk reduction across the lifecycle
AI-CTRL-039 Content safety Guideline safety and transparency points
AI-CTRL-014 Vendor Split of responsibility between developer, provider and user

6. Where the wiki covers this

The topics raised on this page are covered by the following controls, test cases and templates.

Topic Covered by
Responsibility by role (developer, provider, user) JP-T1; TC-L03-020, TC-L02-004; TC-L03-037
Copyright analysis of training data JP-T2; AI-CTRL-029; TC-L03-028
APPI duties AI-CTRL-013; TC-L03-001, TC-L03-012

7. Conflicts and cautions

  • Naming or investigative powers under the Act are not confirmed.
  • The guideline version and the status of its English translation need checking.
  • The APPI points on AI were not verified.

8. Verification checklist

  • [ ] AI Promotion Act text and enforcement provisions
  • [ ] AI Basic Plan content
  • [ ] Guidelines version 1.2, Japanese text
  • [ ] PPC guidance on AI
  • [ ] Current limits of Copyright Act Art. 30-4
  • [ ] Add the primary URL and retrieval date beside every confirmed row

9. Sources

All sources are secondary unless marked as a regulator or government page. Each fetched page was summarised by a tool and was not read line by line. A source marked "not read" appeared only as a title or snippet in search results, so do not treat it as support for any claim.

No primary legal text (statute, regulation or circular) was read for any row. Confirm each row against the primary source, and add its URL and retrieval date in the Japan Regulatory Crosswalk.