Japan AI procurement: who owns the release?

An AI answer can sound confident and still be wrong. If your team supplies AI to Japan's national government, your tender and contract deserve more attention than a generic claim that your product is "AI compliant".

Japan's updated government generative-AI procurement and use guidelines, version 2.0, were adopted on 12 June 2026. The decision took effect on 1 September 2026. They are separate from Japan's AI framework law, which came fully into force on 1 September 2025.

Checked against official Japanese sources on 10 September 2026. This is an operational explainer, not legal advice or a compliance certification.

Two instruments. Different jobs.

The AI Promotion Act, Act No. 53 of 2025 promotes AI research, development and use while addressing risks. The Cabinet Office confirms promulgation and partial commencement on 4 June 2025, followed by full commencement on 1 September 2025.

Article 7 distinguishes an endeavour obligation around active business use from a requirement to cooperate with national and local government measures. The Act is not simply optional. Article 7 does not itself prescribe a particular approval or logging architecture, and it does not impose a human-approval gate on every AI action. The government's English reference translation is useful; the Japanese law controls.

The separate Digital Agency procurement and use guidelines v2.0, DS-920, are a normative government standard. Calling them guidance must not imply that government staff within their scope can ignore them. Calling them a universal private-business AI law would also be wrong.

The supplementary provisions distinguish three dates:

• Necessary Chief AI Officer measures were to be laid down by 30 June 2026.
• The stated AI-governance scope applied from 1 July 2026.
• The decision took effect on 1 September 2026.

Check the role and system before choosing controls

Sections 2.2.1-2.2.3 define the scope. The guidelines cover specified government information systems and government staff involved in procuring and using generative AI. Suppliers operating under government contracts are not their direct addressees. Government planners and providers secure the measures through procurement, contracts, supervision and cooperation. For a supplier, the actual tender and contract matter.

Incorporated Administrative Agencies and the defined category of Designated Corporations are expected to follow the guidelines in their procurement and use. Local public bodies are expected to refer to them as necessary. These categories are not interchangeable.

The guidelines exclude systems handling designated secrets, critical economic security information, information requiring secret-document treatment, or sensitive national-security/public-safety-and-order information and information that could become such information. This is not an exemption from other security duties.

There is an important agent distinction. Section 2.2.2 does not prescribe detailed specific measures for systems with the listed advanced capabilities, including AI agents. It still places them within the specified governance framework in sections 4.1, 4.2 and 6.7. Neither "agents are exempt" nor "every detailed checklist item automatically applies to every agent" is accurate.

What the procurement controls actually say

For systems within the detailed scope:

• Section 6.3.1 addresses use-case risk analysis, appropriate access permissions and the collection and management of necessary logs, including inputs, outputs and access history. Sensitive logs still need appropriate handling.
• Section 6.3.2 connects requirements to procurement specifications and check sheets. Contract considerations include items the planner should consider incorporating; every example clause is not automatically mandatory in every contract.
• Appendix 3, item 27 includes incident-controllability examples, such as switching away from a tampered model and an isolated higher-privilege control interface that remains unaffected during abnormal conditions. These are not a universal per-action human-approval mandate.

Identify the owner, assess the use case, and test the controls promised in the procurement documents. That is our operational synthesis, not a verbatim statutory checklist or a government endorsement of HaltState.

Hypothetical: an unchecked answer is ready to publish

An agent prepares an answer for a government-facing service. It sounds credible. Nobody has reviewed it. The team has to decide who can release it and what evidence to retain.

This is an illustrative scenario, not a reported Japanese incident or a finding of breach. A review gate is one possible engineering choice. It does not establish which legal rules apply, and it does not imply that every detailed procurement control applies to an advanced agent.

Separate actual isolated HaltState test

We evaluated an authored content.publish request with in-memory policy and Redis fixtures against an immutable source archive. The inputs included region: JP and publication_review_required: true. Those flags were written for the test; they are not a Japanese legal classifier.

The real policy engine returned APPROVAL_REQUIRED. No publisher was connected. Nothing was published, no connected publication was blocked, and no human approval was completed. The test did not execute an autonomous agent.

The generated proof pack recorded the policy version and a verified content digest. It was unsigned HASH_ONLY evidence. Independent guarded execution and independent recomputation supported that narrow result. The record below is a faithful transcription of the actual isolated output, not a simulated product interface.

This does not establish answer accuracy, Japanese-language suitability, legal applicability, procurement compliance, government acceptance or a completed production enforcement path. No production database, persistent evidence storage, network connector or signing service was used.

Read the Japanese text and the translation carefully

Official originals and the government's provisional English translation are linked from the Digital Agency v2.0 announcement. The current standard-guidelines index identifies DS-920 as normative.

Selected original-language excerpts, with independently machine-reviewed English renderings:

規範として遵守するドキュメントの一つとして位置付けられる。

Section 1.2: "Positioned as one of the documents to be observed as a normative standard." This is a translated excerpt, not the entire paragraph.

この決定の内容は、2026 年（令和８年）９月１日から施行する。

Supplementary provisions: "The content of this decision takes effect from 1 September 2026." The following sentences specify the earlier June and July milestones described above.

具体的対応事項は定めないが、AI ガバナンスの枠組みの対象とする

Section 2.2.2: "Specific measures are not prescribed, but [these systems] are included within the AI governance framework." Read the full provision for the system categories and specified governance sections.

We retained original Japanese attachments and exact hashes and compared focused Japanese passages with the government's provisional English. This was independent machine review, not native-human legal advice. The source PDF SHA-256 is dbe4497a86bbd1c9ccd9c9c0ba5483bb8cc20c0b70569f7482cfc9d08e09175f.

Before a real release, check scope, ownership and the actual contract. Keep decision evidence that says what happened without pretending it proves legal clearance. Explore HaltState.

Inspect the isolated test record and limitations.