Checkpoints for Complying with Japan's AI Act and the AI Guidelines for Business
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
Japan's AI Act (the Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies) is not a statute that lines up a long list of specific prohibited acts and penalties for companies. Because it has the character of a basic law setting out principles, basic policies and a promotion framework, simply following the wording of its provisions makes it hard to see what, concretely, a company should put in place in its day-to-day operations. On the other hand, this does not mean that there are no legal obligations at all, or that everything is left to the discretion of businesses. This is why it is important to understand the legal framework and then translate it into the company's own practice.
Companies considering using generative AI internally or providing AI services often ask, "What does operating in line with the law actually mean?" and "To what extent should the guidelines be reflected in internal rules?" What I tell them is that the AI Act and the related guidelines are not documents that the legal team can read once and be done with. They bear directly on the design of company-wide business operations: which AI tools are used, in which tasks, connected to what data, and who uses the resulting output and how.
At the entry point to practice, the matters to check ultimately come down to the following five points.
- Whether the data entered includes confidential information, personal information or third-party copyrighted works
- Who will use the generated output, in which tasks, and to what extent
- Whether the company can explain, through contracts and internal rules, how external transmission of data, use for model training, log retention and reuse are handled
- Whether the service's terms of use, the privacy policy, internal rules and contracts with vendors all rest on the same assumptions
- Whether, rather than taking AI output at face value, a person responsible for the final decision and a review procedure have been established
Building a framework in which the company can explain these five points concretely in its own words is, in my view, the real substance of responding to AI.
The Position of the AI Act and the AI Guidelines for Business
Responding to the AI Act in practice means putting in place the company's rules for using and providing AI, based on the legal framework for promoting the research, development and utilization of AI-related technologies. The AI Act sets out basic principles (Article 3) together with the responsibilities of businesses (Article 7). These include a responsibility to endeavor to make business activities more efficient and sophisticated through active use of AI, as well as an obligation to cooperate with measures implemented by the national and local governments.
The guidelines for ensuring appropriateness based on Article 13 of the AI Act and the "AI Guidelines for Business" published by the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry are related to each other but are separate documents. The measures described in the guidelines do not automatically and uniformly become legal obligations or penalties. The status of updates to the latest official guidance, such as the Cabinet Office guidelines of December 19, 2025 and Version 1.2 of the AI Guidelines for Business published by the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry on March 31, 2026, needs to be tracked continuously through official publications. The structure of the Act, the responsibilities of businesses and the overall picture of the basic policy are explained in detail in The AI Act (AI Promotion Act): Content, Basic Plan and Impact on Companies.
As a premise, Japan's AI regulatory environment overlaps closely with existing individual laws such as the Act on the Protection of Personal Information (APPI), the Copyright Act and contractual confidentiality obligations. Looking only at the provisions of the AI Act will not reveal all the business risks.
Furthermore, the AI Guidelines for Business classify actors as "AI developers," "AI providers" and "AI business users," and raise issues such as risk management, ensuring transparency and human involvement. What should be noted here is that a company's position is not fixed in a single category. If it merely uses external tools for internal work, it is close to a user, but if it builds AI functions into its own service and provides them to customers, it also takes on aspects of a provider. In addition, building an internal database for RAG (retrieval-augmented generation) does not by itself mean the company will uniformly be regarded as a developer; the role it should play is checked according to its degree of involvement in model development, additional training and the provision framework.
Understanding Individual Use by Each Department and Shadow AI
A major reason to treat AI adoption as a legal issue is that using generative AI brings together on a single screen risks that were previously managed by separate departments or under independent rules.
For example, loading a contract into AI raises confidentiality obligations, personal data and copyright all at once, and using AI for personnel evaluations or recruitment raises questions of fairness and consistency with labor management. For a customer service chatbot, preventing incorrect answers, regulations on representations, and the design of the terms of use and complaint handling all come into play.
In addition, AI tools tend to be introduced spontaneously at each workplace. The sales department uses them to write minutes of business meetings, the development department uses them to generate program code, the HR department uses them to write job postings, and the legal department uses them to review contracts. Even if each workplace's decision is rational, from the standpoint of the company as a whole, it can easily end up in a situation where no one knows what internal information is being sent to which external services.
Unless the company takes stock of usage including not only the tools it has officially approved but also "shadow AI," where employees use personal accounts, free tools, browser extensions and the like for work, the higher-risk forms of use will be the ones that slip through the management net. When a customer asks, "Is our data being used for AI training?" or "Where is personal information stored?", the company must avoid a situation in which the answer differs depending on which person responds.
Checks from Taking Stock of Operations to Operating Procedures
The first step in putting practice in order is to take stock of AI use within the company. Find out which departments use which services for which tasks, and what deliverables they produce.
Next, clarify the company's position for each service used. Whether the company is using the service internally, providing functions to customers, or going as far as tuning models and data changes the contract clauses it should prepare and the matters it should explain to users.
In managing input data, clearly define whether confidential information, personal information, unpublished management information and the like may be entered. Rather than simply listing prohibited information, it is realistic to also set up an approval flow for cases where use is permitted as an exception. Without a legitimate exception route, the likely result is that the workplace either uses the tools without permission or gives up on beneficial uses altogether.
Rules should also be set for handling output. Decide whether text, draft revisions and responses to customers created by AI may be disclosed outside the company as is. Make clear where the human review step is inserted, whether double-checking is required for high-risk uses, and how responsibility is allocated if there is an error.
In contracts with vendors, check whether input data is used for training, the retention period for input data and logs, cross-border transfer of data, and how rights in output are handled. Because the specifications and terms of AI services can change at any time, a procedure is needed to keep checking the content not only at the initial contract but also at renewals and revisions.
At the same time, set up an incident reporting desk in which legal, information systems, security and business departments are involved across functions. Deciding who checks revisions to public guidelines and to each service's terms, how often, and based on what sources keeps the operation alive rather than letting it become a formality.
Checkpoints for Developers, Providers and Users
From the standpoint of an AI developer, the central issues are how training data was collected and its licensing, and safety verification of the model. If development proceeds while the origin of the data is uncertain, it becomes difficult to show the basis for lawfulness when customers or investors later ask for an explanation. It is effective to keep records of the rights in the data and of pre-release test results from the early stages of development.
From the standpoint of an AI provider, the key points are accurate explanation to users and the demarcation of responsibility. Define what the AI functions of the company's service can achieve, what is not guaranteed, and what information users must not enter. If the terms of use, privacy policy, product documentation and notices on the admin screen are inconsistent, this becomes a factor that prolongs disputes over which agreement was effective when trouble arises.
From the standpoint of an AI business user, the most important matters to check are the input of information from within the company and the handling of generated output. It is necessary to prevent employees, in their eagerness for efficiency, from entering customer information or important confidential information into external AI tools, and from using output as is in customer responses or external documents without fact-checking it.
Even for the same service, the clauses a party should seek in the contract are the exact opposite depending on its position. A provider will want to define the extent to which it does not guarantee the completeness of output and the checks it requires of users, whereas a user will seek high-level security, a prohibition on use for training, and compensation in the event of failures. A developer should also check its contracts with data providers, the ownership of rights with joint development partners, and the terms of use of third-party models. The key is not to view the company's degree of involvement as fixed, but to reassess its role for each transaction and data flow.
Checking Whether It Fits Actual Practice
AI can also be used to extract candidate issues relating to the handling of input data, cross-border transfers and rights in output from internal rules and terms of use. However, an answer that merely lists terms from the guidelines does not allow the company to judge what it needs to do for its own operations. The check should specify the services used, the departments, the information and the purposes for which output is used. Because AI may assume outdated laws or service terms, a person should check against current official information.
Also check whether the rules prohibit so broadly that the workplace cannot follow them, and whether leaving too much to user departments allows important information to flow outside. It is important that contracts, internal rules, explanations to customers and actual operations are aligned.
Creating internal rules on AI and reviewing their operation should proceed together with everyday contract review and legal consultations. At LegalAgent, we help companies build AI governance frameworks suited to their circumstances and the realities of their business through the following services.
Services connected to this topic