What Is Japan's AI Promotion Act (AI Act)? Corporate Obligations, Penalties and the Relationship with the AI Basic Plan

On June 4, 2025, the Japanese government promulgated the Act on the Promotion of Research, Development and Utilization of AI-Related Technologies (Act No. 53 of 2025; the "AI Act"), and the Act came fully into force on September 1 of the same year. The AI Act sets out the basic principles for promoting the research, development and utilization of AI-related technologies; the responsibilities of the national government, local governments, research and development institutions, utilizing businesses and citizens; the AI Basic Plan to be formulated by the government; and the establishment of the AI Strategy Headquarters. In character, it differs from a sector-specific regulatory statute such as the EU AI Act, which lists prohibited practices. In the little more than a year since the AI Act was promulgated, the Cabinet has approved the AI Basic Plan, the AI Strategy Headquarters has adopted guidelines, and the AI Guidelines for Business have been revised, one after another, so the documents that companies need to consult have been piling up outside the Act itself. This article first confirms the structure and legal nature of the AI Act itself, then sorts out what the Act does and does not require of utilizing businesses, and explains the hierarchy of the Basic Plan, the guidelines and the business guidelines in the order in which they should be consulted.

What Has Been Enacted (Structure and Legal Nature of the AI Act)

According to the Cabinet Office "AI System (AI Act)" page (Japanese), the AI Act was passed on May 28, 2025, partly came into force upon promulgation on June 4, and came fully into force on September 1. The Act consists of 28 articles in the main provisions and 2 articles in the supplementary provisions, organized into four chapters: Chapter I "General Provisions" (Articles 1 to 10), Chapter II "Basic Measures" (Articles 11 to 17), Chapter III "AI Basic Plan" (Article 18) and Chapter IV "AI Strategy Headquarters" (Articles 19 to 28).

Chapter I states its purpose as promoting measures concerning the research, development and utilization of AI-related technologies in a comprehensive and systematic manner (Article 1). It sets out basic principles, namely the importance of AI to the economy, society and national security, maintaining research and development capabilities and improving international competitiveness, comprehensive and systematic promotion of measures, ensuring transparency, and playing a leading role in international cooperation (Article 3), and then provides for the respective responsibilities of the national government, local governments, research and development institutions, utilizing businesses and citizens (Articles 4 to 8). Chapter II, alongside promoting research and development, developing human resources and international cooperation, includes a provision that the government will develop guidelines consistent with the purpose of international norms and take other measures to ensure the appropriate conduct of AI (Article 13), and a provision that the national government will conduct research and provide guidance, advice and information to research and development institutions and utilizing businesses (Article 16). Chapter III provides the basis for the government to establish the AI Basic Plan (Article 18), and Chapter IV provides for the establishment and functions of the AI Strategy Headquarters (Japanese), headed by the Prime Minister and composed of all Ministers of State.

The AI Act contains no penalty provisions. Article 2 of the Supplementary Provisions merely requires the government to review the status of enforcement in light of international trends and other changes in socioeconomic conditions and, where it finds it necessary, to take the required measures. The Act contains neither administrative fines nor categories of prohibited conduct. The AI Act can therefore be understood not as a regulatory statute that directly governs individual conduct, but as a statute that sets out the basic policy and promotion framework for government measures.

Whether Companies Bear Obligations (Article 7 "Responsibilities of Utilizing Businesses")

The provision directly relevant to companies is Article 7 of the AI Act (Japanese), which sets out the responsibilities of utilizing businesses. That Article defines a "utilizing business" as a person intending to develop or provide products or services that use AI-related technologies, or any other person intending to use AI-related technologies in its business activities, and provides that such a business, in accordance with the basic principles, shall endeavor to make its business activities more efficient and sophisticated and to create new industries through its own active use of AI-related technologies, and shall cooperate with the measures carried out by the national and local governments.

Of these, the efforts toward making business activities more efficient and sophisticated are an obligation to endeavor and are not legally enforceable. Cooperation with the measures of the national and local governments is framed as an obligation, but its content is limited to cooperating with individual measures carried out by the administration; it does not impose specific obligations to act, such as conducting risk assessments, documentation, filing with a third-party body or conformity assessments. There are no penalties either. Accordingly, I think the AI Act itself is not a statute that imposes new affirmative obligations or prohibited conduct on companies that use AI.

That said, this analysis concerns the AI Act as an individual statute, and it does not exempt the research, development or use of AI from the application of existing laws such as the Act on the Protection of Personal Information (APPI), the Copyright Act and the Unfair Competition Prevention Act. Obligations under existing laws continue to apply regardless of whether the AI Act has been enacted.

The Hierarchy of the AI Act, the Basic Plan, the Guidelines and the Business Guidelines

The AI Basic Plan (Japanese), which the government establishes under Article 18, must be approved by the Cabinet and published under that Article, and the same procedure applies mutatis mutandis to amendments. The plan is addressed to the government, and the first plan, subtitled "Japan's revival" through "trustworthy AI," was approved by the Cabinet on December 23, 2025. The plan is a document that shows the basic policy for the measures the government should take, and it is not a norm of conduct directed at utilizing businesses. The draft of the second plan was adopted by the AI Strategy Headquarters on July 10, 2026, but as of the time of writing I have not been able to confirm Cabinet approval, and its content is covered in a separate article.

Positioned under the plan are the "Guidelines for Ensuring the Appropriateness of Research, Development and Utilization of AI-Related Technologies" (Japanese), adopted by the AI Strategy Headquarters on December 19, 2025 under Article 13. The guidelines cover all of the actors whose responsibilities are set out in Articles 4 to 8, namely the national government, local governments, research and development institutions, utilizing businesses and citizens. They set out the elements of human-centricity, fairness, safety, transparency, accountability, security, privacy and personal information, fair competition, AI literacy and innovation, and then state basic policies such as a risk-based approach. The guidelines describe themselves as intended to "encourage voluntary and proactive efforts," and they are not a document that creates new legal obligations.

Consulted together with these guidelines are the guidelines of the various ministries and agencies, such as the AI Guidelines for Business (Japanese) jointly developed by the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry. Many of these documents existed before the guidelines and were not newly created as subordinate norms based on them, but in the AI Basic Plan the government describes them as various guidelines it has developed consistent with the purpose of the guidelines. All of them are documents that show specific items businesses can check at each stage of AI development, provision and use, and none of them is legally binding. The versions of the business guidelines and the corresponding checkpoints are covered in Checkpoints for Compliance with the AI Act and the AI Guidelines for Business.

Viewed this way, the only thing that legally binds companies is the duty to cooperate under Article 7 of the AI Act; the Basic Plan, the guidelines and the business guidelines are all non-binding government policies or documents in the nature of administrative guidance. That said, I think the status of compliance with the business guidelines will increasingly be treated as a de facto item to be checked in AI vendor due diligence by business partners and in contract review.

What Companies Should Check Now

The fact that legal obligations are limited does not mean that companies need do nothing. In contract review with AI vendors, one option is to check, at the next contract renewal, whether the vendor's representations and warranties clause in the contract includes an obligation to explain or provide information on the elements indicated in the AI Guidelines for Business or the guidelines (the source of training data, the reliability of outputs, security measures, and so on). The perspective of vendor due diligence is explained in Checkpoints for AI Vendor Due Diligence and Contract Review.

For an internal generative AI use policy, a practical starting point is to take stock, once, of which clauses of existing rules cover each of the elements listed in the guidelines: human-centricity, transparency, accountability, security, and privacy and personal information. If the stocktaking reveals elements not expressly addressed in the rules, the results serve as material for deciding whether an addition to the existing information security rules or personal information handling rules is sufficient, or whether a stand-alone generative AI use policy should be created. For rule design, see How to Create a Generative AI Use Policy.

As for reporting to the board of directors, if you confirm who will track revisions to the AI Basic Plan and the guidelines, how often, and when they will be reported to the board, together with the department responsible for preparing the next board materials, you can avoid the burden of responding individually each time a revision is made. The items to check are organized in A Checklist for Discussing AI Governance at the Board of Directors.

Moves to Watch in Future System Reviews

Article 2 of the Supplementary Provisions of the AI Act continuously requires the government to review the status of enforcement and take necessary measures. The government itself has also set out a policy of revising the AI Basic Plan every year for the time being, and documents other than the statute need to be handled on the assumption that they will continue to be revised. As of the date of writing, the following points are undecided or unpublished, and they need to be monitored on an ongoing basis.

• Whether the second AI Basic Plan has been approved by the Cabinet, and the content of the final version
• The revision status and version number of the AI Guidelines for Business
• The results of the review of the status of enforcement under Article 2 of the Supplementary Provisions of the AI Act, and whether the AI Act itself needs to be amended
• The status of related laws referred to in the Basic Plan, such as the promulgation of the amendment to the APPI enacted on July 10, 2026 and the development of its subordinate regulations

Each of these, once published, should be treated as material for deciding whether it needs to be reflected in the company's contract review and internal rules.