Japan's AI Promotion Act 2024: what global operators need to understand.

Japan's Diet enacted the Basic Act on the Promotion of Development and Utilization of Artificial Intelligence Technology as Law No. 53 of 2025, promulgated on 4 June 2025 and fully in force on 1 September 2025, establishing a principles-based national framework for AI. It does not mirror the EU AI Act's risk-tier structure or its enforcement architecture. For global operators deploying AI agents in Japan or processing data belonging to Japanese residents, understanding what the framework does and does not require is the starting point for a defensible governance posture.

Structure of the Act

The Act on the Promotion of Research and Development and Utilization of Artificial Intelligence Related Technology passed the House of Councillors on 28 May 2025, was promulgated on 4 June 2025 as Law No. 53 of 2025, and came fully into force on 1 September 2025. An earlier version of this guide dated it to May 2024 and to entry into force in June 2024. That was wrong by a full year, and the error ran through the whole timeline argument below. It sits in the tradition of Japan's technology promotion legislation rather than in the tradition of European regulatory law. The Act creates a national framework for government AI policy, designates responsibilities across ministries, and articulates the principles that should guide AI development and use. It does not create a prohibition list, a mandatory registration system, or an administrative penalty structure directed at private companies.

The Act designates the national government as the primary responsible party for implementing AI policy and requires the Cabinet to adopt a Basic Plan for AI. The Basic Plan is the operational document: it sets targets, allocates ministry responsibilities, and establishes the policy initiatives that translate the Act's principles into government actions. The most recent Basic Plan, updated following the Act's passage, includes directives for METI, the Ministry of Internal Affairs and Communications (MIC), and the Ministry of Health, Labour and Welfare (MHLW) to develop sector-specific guidance.

For private operators, the Act creates a normative environment rather than a compliance checklist. Ministries use its principles as the basis for their sectoral guidance, and courts or regulators may reference its framework when evaluating whether an operator's conduct met an expected standard. The practical compliance question is therefore not "does my organisation comply with the Act" but "does my governance programme align with the principles and guidelines that ministries are issuing under the Act's framework."

The seven core principles

An earlier version of this guide said the Act codifies seven principles, listed them, and said they superseded the Social Principles of Human-Centric AI. None of that is right. Article 3 of the Act sets out five basic principles, and they are policy principles rather than a governance checklist: grounding AI policy in the Basic Act on Science, Technology and Innovation and the Basic Act on the Formation of a Digital Society; recognising AI as important to the economy and to national security and to international competitiveness; promoting research, development and utilisation comprehensively; securing transparency so that misuse is prevented; and pursuing international cooperation. The Social Principles of Human-Centric AI were finalised in March 2019 by the Cabinet Office and were not superseded by the Act. The passage that followed here, mapping seven principles, has been removed because the principles it mapped were not in the statute.

The first principle is human-centricity: AI must be used in ways that respect fundamental human rights and promote human dignity. The second is safety: AI systems must not endanger the life, body, or property of individuals. The third is fairness and non-discrimination: AI must not produce outputs that unjustly disadvantage individuals based on personal attributes. The fourth is accountability: developers and deployers must be prepared to explain AI system behaviour and outputs, and to accept responsibility for harm caused. The fifth is privacy protection: AI must handle personal information in compliance with the APPI and related data protection norms. The sixth is security: AI systems must be designed and operated with resilience against cyberattacks and unauthorised access. The seventh is innovation promotion: the framework should not unduly constrain the development and deployment of beneficial AI applications.

The seventh principle is a deliberate counterweight to the first six. Japan's regulatory approach reflects a government view that excessive restriction would disadvantage Japanese companies relative to US and Chinese competitors. This distinguishes Japan from the EU, where the precautionary principle carries more regulatory weight.

Japan AISI and model safety evaluation

Japan's AI Safety Institute was established on 14 February 2024 within the Information-technology Promotion Agency (IPA). An earlier version of this guide placed it within AIST, which is a cooperating institution rather than the host. Japan AISI joins the UK AI Safety Institute, the US AI Safety Institute at NIST, and the institutions formed under the Bletchley Declaration's international framework for frontier AI safety evaluation.

Japan AISI's primary function is to evaluate large-scale AI models for safety properties, with a particular focus on models capable of generating hazardous content or enabling cyberattacks. It publishes evaluation reports and methodology documents, and coordinates its findings with international counterparts through the Seoul and Bletchley process. For operators deploying frontier models in Japan, AISI evaluation findings carry reputational and practical weight: a negative evaluation from AISI affects the model provider's position with Japanese government clients and large corporate deployers.

For most enterprise deployers of commercial AI agents, direct AISI engagement is not a near-term concern. The more relevant function of AISI is its participation in developing evaluation standards that eventually feed into METI operational guidelines and procurement requirements. Operators maintaining ISO/IEC 42001 management systems and conducting regular red-team testing of their AI deployments are already aligned with the governance expectations AISI's methodology reflects.

Sector-specific guidelines: where the practical obligations sit

The most operationally significant documents for global operators are not the Act itself but the sector guidelines published by METI, the FSA, and the MHLW.

MIC and METI jointly published the AI Business Guidelines (AI事業者ガイドライン), version 1.0, on 19 April 2024. The current version is 1.2, dated 31 March 2026. There is no "Generative AI Edition"; an earlier version of this guide gave that title and attributed the document to METI alone. These are voluntary but represent the reference document that Japanese courts and regulators will apply when evaluating enterprise AI governance. The guidelines distinguish between AI developers, AI providers, and AI users (roughly analogous to the EU AI Act's developers, providers, and deployers). For each category, the guidelines specify expected governance practices including risk assessment, documentation, transparency to end users, and incident response.

The Financial Services Agency published an AI Discussion Paper, version 1.0 in March 2025 and version 1.1 in March 2026. It is expressly framed as an initial mapping of issues, not supervisory guidance, and an earlier version of this guide described it as the latter. For financial services operators deploying AI agents in credit decisioning, investment advice or insurance underwriting in Japan, the discussion paper signals the FSA's direction of travel; the binding tools remain those in the Financial Instruments and Exchange Act and the Banking Act. The guidance aligns with the Basel Committee on Banking Supervision's principles for operational resilience and the FSB's work on AI and machine learning in financial services.

For healthcare AI, the operative route is medical device programme regulation under the Pharmaceuticals and Medical Devices Act rather than a single MHLW AI guidance document. An earlier version of this guide asserted a healthcare AI guidance covering clinical decision support, imaging analysis and pharmaceutical applications; no such single instrument could be located at mhlw.go.jp and the claim has been withdrawn.

Operators in sectors not covered by specific ministerial guidance face a more diffuse standard: the METI Business Guidelines, the APPI framework, and the Act's Article 3 principles together define the expected governance posture.

Comparison with the EU AI Act

The contrast with Regulation (EU) 2024/1689 is structural. The EU AI Act is a directly applicable regulation with a four-tier risk architecture, legally binding obligations for providers and deployers, mandatory conformity assessments for high-risk systems, an EU database for registration, and administrative penalties reaching EUR 35 million or 7 per cent of worldwide annual turnover. Japan's Act creates no equivalent penalty mechanism at the company level. The Act directs the government to create a supportive policy environment; it does not direct companies to comply with specific requirements under threat of sanction.

This does not mean Japan is ungoverned. The FSA, MHLW, and METI exercise supervisory authority through existing regulatory frameworks. A financial institution operating in Japan that deploys an AI agent in violation of FSA guidance faces the full range of supervisory tools available to the FSA under the Financial Instruments and Exchange Act and the Banking Act. Those tools include business improvement orders, licence suspension, and criminal referral. The difference from the EU model is that the AI-specific obligations are embedded in sector regulators' existing authority rather than in a standalone AI regulation.

For an operator building a cross-jurisdictional AI governance programme, the practical implication is that EU AI Act compliance provides a strong foundation for Japan alignment. An organisation that has built the Article 9 risk management system, the Article 26(2) oversight register, and the Article 17 technical documentation required under the EU AI Act has documented its AI governance against a standard that substantially covers what Japanese guidance expects. The additional work for Japan compliance is typically limited to mapping that documentation to the METI Business Guidelines structure and ensuring that APPI requirements for any Japanese-resident personal data are addressed.

OECD AI Principles and Japan's international commitments

Japan was a founding signatory of the OECD AI Principles, adopted in May 2019 and revised on 3 May 2024. The May 2024 revision updates the principles to address generative AI, agentic systems, and frontier model risks. Japan's AI Promotion Act is designed to be consistent with the revised OECD Principles, and the Cabinet Office's Basic Plan references them directly. For operators building an international compliance programme, the OECD AI Principles provide a useful common framework that is recognised in Japan, the EU (through the EU AI Act's recitals), the United States, where Executive Order 14110 was revoked on 20 January 2025 by Executive Order 14148 and OMB M-24-10 was ordered revised, so neither is a current reference, and the Council of Europe Framework Convention on AI adopted in September 2024.

Japan signed the Council of Europe Framework Convention on AI and Human Rights, Democracy and the Rule of Law on 11 February 2025. It has not ratified it, and an earlier version of this guide said it had. The Convention opened for signature on 5 September 2024. The Framework Convention is the first binding international treaty on AI governance. Its obligations fall primarily on state parties in their public-sector use of AI, but its principles of transparency, accountability, and non-discrimination inform how Japan's courts will eventually interpret operator liability in AI-related disputes.

Practical steps for global operators

An operator deploying AI agents in Japan or processing data belonging to Japanese residents should take four practical steps.

First, conduct a Japan-specific scope review. Map each AI agent deployment against Japan's seven Act principles and the METI Business Guidelines. For any deployments in financial services, healthcare, or regulated sectors, cross-reference the relevant ministerial guidance. Identify gaps between current governance documentation and the expected standard.

Second, address the APPI layer. Review data flows involving personal information of Japanese residents. Confirm that purpose statements, accuracy measures, and third-party transfer agreements are in place. The PPC's 2023 AI guidance is the reference document for how APPI applies to AI-generated outputs.

Third, establish Japan AISI monitoring. Subscribe to AISI evaluation publications and METI guidelines updates. The Japanese regulatory environment is evolving quickly, and the gap between the current soft-touch Act and future binding measures may close faster than many operators expect if AI incidents with significant consumer harm occur in the Japanese market.

Fourth, document the cross-map to ISO/IEC 42001. If the organisation holds or is pursuing ISO 42001 certification, document how each Japan governance requirement maps to the management system standard. ISO 42001 certification is increasingly recognised by Japanese enterprise clients and financial regulators as evidence of a mature AI management programme.

For the cross-jurisdictional comparison covering the EU, US, and UK, see three approaches to AI liability in 2026. For the APAC governance landscape more broadly, see Asia-Pacific AI governance 2026. For how the NIST AI RMF intersects with Japan's governance expectations, see NIST AI RMF and the emerging standard of reasonable care.