Regulación de IA en Japón

Resumen ejecutivo

Why «Japan has a soft-law approach» misses the operational design

The most common framing of Japanese AI regulation describes it as soft-law, voluntary, deferential to industry, and structurally weaker than the EU AI Act, the Council of Europe Convention, or even Chinese AI regulation. The framing captures the absence of monetary penalties and misses the design logic. Japan has built the most operationally cohesive innovation-first AI framework among major jurisdictions, with three structural features that distinguish it from European rights-first regulation, US dominance-first orientation, and Chinese state-centric regulation.

The dominant narrative reads Japanese AI regulation as light-touch by default, a residual of regulatory caution rather than a deliberate design choice. The reading misses what Japan has actually done. First, Japan passed a horizontal AI law: the AI Promotion Act, passed by the Diet on 28 May 2025, in force from 4 June 2025. It is brief, principles-based, and explicitly non-binding in its substantive obligations, but it establishes statutory anchor for the entire Japanese AI governance regime. Second, Japan paired the statute with an operational guidelines framework that has been continuously updated: the METI/MIC AI Guidelines for Business reached version 1.01 in March 2025, with version 1.2 reportedly in preparation addressing EU AI Act interoperability and cross-border data flows. Third, Japan has backed soft-law with hard money: JPY 196.9 billion in FY2025 alone and a public support ambition up to JPY 10 trillion by 2030. The investment is the operational mechanism that gives the soft-law framework its compliance pull.

What Japanese AI regulation actually is, then, is a cooperative-innovation regulatory model built on the explicit premise that AI is a strategic national asset whose responsible development requires industry-government cooperation rather than penalty-driven compliance. The model has three operational features that produce real compliance behavior despite the absence of fines.

Procurement-driven compliance. Government procurement and major corporate procurement in Japan expect AI vendors to demonstrate alignment with the METI/MIC AI Guidelines for Business and with the METI Contract Checklist (formally adopted 18 February 2025). Vendors that cannot demonstrate alignment do not win contracts. The compliance pull is commercial rather than penal.

Reputational enforcement. The AI Promotion Act enables the Japanese government to publicly name AI operators that fail to cooperate with investigations or to make reasonable efforts to align with the principles. In a Japanese commercial context, public naming has substantive consequences that fines do not always replicate.

Sectoral enforcement via existing statutes. AI uses are subject to the Act on the Protection of Personal Information (APPI), the Copyright Act, the Financial Instruments and Exchange Act, the Pharmaceutical and Medical Device Act, and other sectoral statutes that carry their own penalties. The AI Promotion Act does not displace these; it complements them. AI-related violations of APPI or copyright produce monetary penalties through those statutes regardless of the AI Promotion Act’s soft-law status.

For organizations operating in the Japanese AI market, the practical implication is that compliance is a procurement-and-reputation system rather than a penalty system. Demonstrable alignment with the METI/MIC Guidelines, completion of METI Contract Checklist requirements, and operational evidence of «reasonable efforts» toward the AI Promotion Act principles are the substantive deliverables. Standards-based assurance — particularly ISO/IEC 42001 — has gained traction precisely because it provides the documentation infrastructure that makes Japanese soft-law compliance demonstrable.

The rest of this reference treats the regime as the cooperative-innovation framework it is, with the three pillars and the operational mechanisms that animate them.

—

The AI Promotion Act

The Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies (the AI Promotion Act) is Japan’s first dedicated AI law. It was passed by the National Diet on 28 May 2025 and is largely in force from 4 June 2025. The Act is brief and principles-based. It does not create a comprehensive regulatory regime in the EU AI Act sense; it creates the statutory anchor for the wider Japanese AI governance system.

Definition. The Act defines AI broadly as technologies that simulate human cognition. The breadth is intentional: it captures the full range of AI applications without creating a risk-tier classification system that would require ongoing regulatory categorization.

Four core principles. The Act articulates four principles that frame the entire Japanese AI policy:

1. AI as a strategic asset for national welfare and economic resilience
2. Promoting industrial use of AI across Japanese economy and society
3. Mitigating risks through transparency rather than prescriptive prohibition
4. Active contribution to international AI norms, building on Japan’s role as G7 host of the 2023 Hiroshima Summit

Multi-stakeholder model. The Act assigns roles to central government, local governments, academia, businesses, and citizens, with explicit emphasis on coordination rather than top-down prescription. This is a structural choice that distinguishes Japan from the EU’s centralized AI Office model, the US’s executive-action-and-state-law patchwork, and China’s CAC-led centralized model.

AI Strategy Headquarters. The Act establishes the AI Strategy Headquarters under the Prime Minister, with operational coordination through the AI Strategy Council. The Headquarters develops and updates the Basic Plan for AI (sometimes called the Fundamental AI Plan), which sets national AI strategy across R&D, computing infrastructure, talent development, public literacy, and international engagement.

Implementation measures. The Act commits the government to support AI research and development, computing infrastructure, talent development, and public literacy. The substantive funding to operationalize these commitments — JPY 196.9 billion FY2025, ambition up to JPY 10 trillion by 2030 — is the real compliance pull of the framework.

Operator obligations. AI business operators are required to make «reasonable efforts» to align with the Act’s principles, with particular emphasis on transparency, safety, and fairness, and to cooperate with government investigations when requested. The reasonable-efforts standard is intentionally elastic. It accommodates different organizational sizes, AI use cases, and risk levels without specifying prescriptive technical requirements.

No monetary penalties. The Act does not provide for fines or other monetary sanctions for failure to align with its principles. Enforcement operates through reputational measures (public naming of non-cooperative operators), procurement consequences (government and major corporate buyers expect demonstrable alignment), and sectoral enforcement under existing statutes that do carry penalties.

This combination — statutory anchor with explicit principles, multi-stakeholder governance with Prime Minister-level oversight, substantive industrial investment, and elastic operator obligations enforced through reputation and procurement rather than penalties — is the structural innovation of the Japanese model. It is neither EU comprehensive regulation nor pure US permissiveness; it is a deliberate third path.

—

The AI Guidelines for Business

The AI Guidelines for Business (sometimes called the AI Business Operator Guidelines) were issued jointly by METI and MIC on 19 April 2024, updated to v1.01 on 28 March 2025, with v1.2 reportedly in preparation (industry reporting indicates EU AI Act interoperability and cross-border data flows are in scope). The Guidelines translate the AI Promotion Act’s principles into concrete operational expectations.

Three-tier structure.

1. Foundational values: human dignity, inclusion, sustainability — framing principles drawn from international AI ethics work and Japanese constitutional tradition
2. Ten cross-sector principles: human-centric AI, safety, fairness, privacy protection, transparency, accountability, education and literacy, fair competition, innovation, and respect for human rights
3. Role-specific guidance: differentiated expectations for AI developers, AI providers, AI business users, and AI deployers, recognizing that different stages of the AI value chain face different compliance considerations

Operational expectations. The Guidelines specify expected practices for AI risk management, data governance, model evaluation, transparency to users and downstream parties, incident handling, and human oversight. The expectations are framed as «should» rather than «shall,» consistent with the soft-law character, but procurement and reputation expectations make the practices substantive in commercial terms.

Alignment with international frameworks. The Guidelines are explicitly aligned with the OECD AI Principles, the G7 Hiroshima Code of Conduct, the UNESCO Recommendation on the Ethics of AI, and — in the reportedly forthcoming v1.2 — the EU AI Act. The alignment is structural design: Japan positions itself as the OECD-aligned AI policy reference for Asia-Pacific organizations seeking interoperability with EU markets.

Continuous update cycle. The Guidelines are updated continuously, not on a fixed legislative cycle. The April 2024 v1.0 was updated to v1.01 in March 2025; v1.2 is reportedly forthcoming. This update cadence reflects the soft-law model’s adaptive design — governance evolves with technology rather than waiting for statute amendment.

—

The METI Contract Checklist

Formally adopted on 18 February 2025, the METI AI Contract Checklist is the operational instrument that makes the Guidelines applicable to procurement and vendor relationships. The Checklist covers three categories of AI engagement:

1. General-purpose AI services (commercial cloud-based AI services like ChatGPT, Claude, Gemini, Cohere, when used by Japanese organizations)
2. Customized AI (services adapted or fine-tuned for specific Japanese organization use cases)
3. New AI development (AI systems built specifically for or with Japanese organizations)

For each category, the Checklist specifies expected contract clauses on input data handling, APPI compliance, cross-border data transfers, output ownership, breach reporting, model update obligations, vendor warranties, indemnities, audit rights, and explicit vendor undertakings not to use customer inputs for model training without consent.

Why the Checklist matters operationally. Japanese government procurement and major Japanese corporate procurement now expect AI vendors to satisfy the Checklist requirements. Vendors that cannot demonstrate Checklist alignment lose deals. The Checklist has become the de facto compliance benchmark for the AI Promotion Act in B2B contexts. Combined with ISO/IEC 42001 certification and METI Guidelines alignment, the Checklist forms the substantive Japanese AI compliance package.

—

Reinterpretation of existing statutes

Japan’s third regulatory pillar is the deliberate reinterpretation of pre-AI statutes to address AI-specific issues. Three statutes carry particular weight.

Copyright Act Article 30-4. Japan’s copyright law contains an unusually broad exception permitting the use of copyrighted works for AI training without licensing, subject to a proviso that the use must not «unreasonably prejudice» the interests of copyright holders. The exception has made Japan unusually attractive for AI model training and is one of the structural reasons Japanese AI development has accelerated. The «unreasonably prejudice» proviso has not yet been substantively tested in litigation; legal analysts anticipate that the first test cases involving AI training data will define the operational boundary of the exception. Organizations relying on Article 30-4 should monitor Japanese court filings, not just METI guidance.

Act on the Protection of Personal Information (APPI). The APPI is Japan’s primary privacy statute, broadly comparable to the GDPR but with different operational provisions. AI use cases involving personal information must comply with APPI consent, purpose limitation, cross-border transfer, and data subject rights provisions. The APPI was overhauled in April 2026 to remove the AI research opt-in consent requirement, simplifying compliance for legitimate AI research use of personal data while preserving consent obligations for commercial deployment.

Sectoral statutes. The Financial Instruments and Exchange Act addresses AI in financial services; the Pharmaceutical and Medical Device Act addresses AI as Software-as-Medical-Device; the Telecommunications Business Act addresses AI in telecommunications services; product liability law addresses AI-caused harm under Article 709 (general tort) and the Product Liability Act. Each statute carries its own penalty structure and applies independently of the AI Promotion Act’s soft-law character.

—

Enforcement and the role of reputation

Understanding Japanese AI enforcement requires understanding the specific role reputation plays in Japanese commercial governance.

Public naming. The AI Promotion Act enables the Japanese government to publicly name AI operators that fail to cooperate with investigations or to make reasonable efforts to align with the principles. Public naming in Japanese commercial culture has substantive consequences — procurement loss, partnership disruption, customer attrition, talent flight — that often exceed what equivalent fines would produce.

Cooperation duties. AI operators are required to cooperate with government information requests under the Act. Refusal to cooperate is itself a basis for public naming. The cooperation requirement gives the government substantial visibility into AI deployment without requiring prescriptive ex-ante registration of the Chinese type.

Procurement consequences. Japanese government procurement and major corporate procurement in Japan operate as de facto AI compliance enforcement. Vendors that cannot demonstrate alignment with the METI Guidelines, the Contract Checklist, and ISO/IEC 42001 or equivalent management system structure increasingly lose deals. This operates as commercial pressure for compliance even in the absence of statutory penalties.

Sectoral enforcement. APPI violations carry administrative monetary penalties (up to several hundred million yen) and criminal sanctions in serious cases. Copyright Act violations involving AI training that fail the Article 30-4 proviso would be actionable through ordinary copyright litigation. Financial services AI violations are enforceable under the Financial Instruments and Exchange Act. The AI Promotion Act does not displace any of these; it complements them.

Litigation as the next test. Legal analysts anticipate that the first significant Article 30-4 litigation involving AI training data will be the operational test of the Japanese soft-law model. The approaching one-year anniversary of the AI Promotion Act (late May 2026) may also prompt official government commentary on implementation progress and signal whether the soft-law approach will continue or evolve toward more prescriptive obligations.

—

Intersections with other regimes

Five intersections shape how Japanese AI regulation operates within the broader international architecture.

G7 Hiroshima Process. Japan was the host of the 2023 G7 Hiroshima Summit that launched the Hiroshima Process. Japanese frontier AI developers are direct addressees of the Hiroshima Code of Conduct and engage with the OECD-hosted Reporting Framework. The Japanese Guidelines were explicitly designed to align with Hiroshima Code of Conduct expectations.

OECD AI Principles. Japan is OECD member and has contributed to OECD AI policy work. The Japanese Guidelines align structurally with OECD Principles. Japan participates in the Global Partnership on AI (GPAI) and supports international AI standardization through ISO/IEC.

Council of Europe Framework Convention on AI. Japan was an initial signatory on 5 September 2024. The Convention entered into force on 1 November 2025. Japanese ratification status as of May 2026 reflects Japan’s broader pattern of engaging with international AI frameworks while preserving domestic flexibility — expect continued engagement without immediate rights-based statutory adoption.

EU AI Act. Japanese AI providers placing systems on the EU market are subject to the AI Act regardless of Japanese soft-law status. Major Japanese AI vendors operating in EU markets satisfy both regimes. The reportedly forthcoming METI Guidelines v1.2 update specifically addresses EU AI Act interoperability, signaling Japan’s intention to make dual-regime compliance manageable for Japanese organizations.

Japan AI Safety Institute. Japan AISI was established as part of the international AISI network alongside UK AISI, US AISI, CAISI, and the EU AI Office. It conducts technical evaluation of frontier AI models and contributes to international coordination. Japan AISI does not have enforcement powers; it is a technical capability that supports the AI Strategy Headquarters’ work.

—

## ⚖️ How Zertia operates within the Japanese AI regulatory regime

Built for Japan AI Promotion Act compliance from day one

Accreditations and memberships: 🎖️ ANAB-accredited (US) · 🎖️ UKAS process (UK) · 🎖️ ENAC process (EU) · 🏛️ IAPP member · 🏛️ INCITS member · 🏛️ UKAI member · 📜 EU AI Pact signatory

Zertia is an ANAB-accredited AI management system certification body, with offices in Boston, Madrid, and London. The Japanese AI regulatory model — soft-law statute, operational guidelines, sectoral statutes, and procurement-driven compliance — makes accredited certification and standards-based assurance directly material to commercial compliance in Japan. ISO/IEC 42001 certification is the substantive vehicle for demonstrating alignment with the METI/MIC Guidelines and the AI Promotion Act’s reasonable-efforts standard.

Certification — ISO/IEC 42001, AIUC-1, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 22301. ISO/IEC 42001 certification is the most direct way for Japanese organizations and international vendors operating in Japan to demonstrate alignment with the AI Guidelines for Business and the AI Promotion Act’s reasonable-efforts standard. Procurement teams in Japanese government and major Japanese corporates increasingly expect ISO/IEC 42001 evidence as part of the METI Contract Checklist process. ISO/IEC 27001 supports APPI compliance for AI systems processing personal information; ISO/IEC 27701 extends this to privacy-specific governance. AIUC-1 provides agent-level technical assurance for AI vendors deploying agents into Japanese enterprise procurement environments.

Regulatory frameworks — EU AI Act Conformity Assessment, NIST AI RMF Attestation, ISO/IEC 23894 Risk Assessment, Algorithmic Impact Assessment, Pre-Certification Assessment. Algorithmic Impact Assessments are structured to support the METI Guidelines’ role-specific governance expectations and the AI Promotion Act’s risk-mitigation-through-transparency principle, with documentation that integrates with the METI Contract Checklist requirements for procurement.

Audit — AI Management System audits, High-Risk AI System audits, AI Model audits, EU AI Act audits, NIST AI risk audits. Independent audits structured to support the procurement-driven Japanese compliance model, the cooperation duties under the AI Promotion Act, and the multi-jurisdictional integration that Japanese organizations with EU and US exposure require. Audit evidence supports the Japanese reputational compliance environment without substituting for METI Guidelines alignment work.

Training — AI Governance, Data Governance, Privacy Governance through Zertia Academy. Programmes treat the Japanese regime explicitly, including the AI Promotion Act, the AI Guidelines for Business v1.01 (and forthcoming v1.2), the METI Contract Checklist three-category structure, the Article 30-4 copyright training data exception, and the APPI April 2026 overhaul. Particularly relevant for Japanese subsidiaries of multinationals, Japanese AI vendors with international exposure, and procurement teams evaluating Japanese AI providers.

Zertia operates from Boston, Madrid, and London, with ANAB accreditation in the United States and active accreditation processes with UKAS (United Kingdom) and ENAC (Spain/EU). Member of IAPP, INCITS, and UKAI. Signatory to the EU AI Pact.

🎯 Take action

🔍 Diagnose your gap	📊 Build the management backbone
Pre-Certification Assessment →	ISO/IEC 42001 Certification →
Independent diagnosis against the Act on Promotion of Research, Development and Utilisation of AI-Related Technologies, METI AI Guidelines, and APPI obligations for AI processing.	The accredited management system that operationalises Japan’s soft-law AI framework into auditable practice, anticipating the harder enforcement layer expected to emerge.

Discuss Japanese AI compliance integration in multi-jurisdictional governance programs →

—