Japan AI Governance: What the AI Promotion Act, METI Guidelines and APPI Expect of Enterprises

Japan has chosen a different path from Brussels. On May 28, 2025, the Diet passed the AI Promotion Act — Japan's first AI-specific statute, fully in force since September 1, 2025. It contains no fines and no prohibited-practice lists; instead it establishes an AI Strategic Headquarters chaired by the Prime Minister and places a duty to cooperate with government AI measures on businesses. The operational detail lives in the METI/MIC AI Guidelines for Business, updated to Version 1.1 on March 28, 2025. Industry pushes in the same direction: Keidanren published its "AI Utilization Strategy II" in 2023, and JEITA members have issued joint AI-ethics initiatives. The formula is soft law with hard expectations.

Why does "voluntary" not mean optional in Japan?

The AI Promotion Act is deliberately innovation-first: enforcement runs through government advice, information requests and, ultimately, public disclosure of non-cooperating businesses — and in a market where trust drives procurement, being named is a real sanction. Three consequences follow for enterprises:

• Guideline conformance becomes a buying criterion. Boards, banks and large customers increasingly ask suppliers to evidence alignment with the METI/MIC Guidelines.
• Incidents are investigable. The government can collect information and analyse cases where AI harmed rights or interests.
• The paper trail is the defence. Without records of what your AI did and who approved it, "we cooperated" is an assertion, not evidence.

What do the METI/MIC AI Guidelines for Business actually expect?

The Guidelines apply to developers, providers and — crucially — business users of AI, built on Japan's human-centric AI principles. For deploying enterprises, three expectations stand out:

• Governance with executive-level responsibility — agile, risk-based, documented, not delegated to a lab.
• Transparency toward stakeholders — the AI's scope of use, data collection methods, capabilities and limits must be explainable and verifiable.
• Human oversight and incident handling — monitoring mechanisms and a human decision before consequential actions.

APPI: the hard-law edge around personal data

The APPI remains binding law with a statutory triennial review — and that review is tightening it. The Personal Information Protection Commission published its System Reform Policy in January 2026, and the Cabinet approved an APPI amendment bill in April 2026 that introduces administrative fines, strengthens protection of biometric and children's data, and opens only a narrow statistical-purpose lane for AI training. Feeding customer or employee personal data into an external AI service remains a regulated act: purpose limitation, consent or a defined exception, and cross-border transfer rules all apply. If you cannot show which personal data reached which model, APPI compliance is guesswork.

What should a Japanese enterprise demand of an AI platform?

• Domestic data control — inference, retrieval and logs inside your own perimeter, air-gap capable; the sovereignty posture ISMAP-assessed government cloud normalised.
• Append-only auditability — a per-call record added to but never edited or deleted, ready for regulator questions and the incident reporting JPCERT/CC coordinates.
• Human-in-the-loop approvals — enforced gates, not policy documents.
• Governed, JCT-aware automation — finance workflows that respect Japan's qualified invoice system rather than bypassing it.

Japan's message is consistent: the state will not fine you into governance — your customers, auditors and the PPC will expect you to prove it anyway.