Japan: Advanced AI could become subject to criminal penalties, the government is preparing a revision of the law

Japan: Advanced AI could become liable to criminal sanctions, the government is preparing a revision of the law

🔎 Tokyo is set to turn its "soft law" into hard law

Japan has long been a paradise for AI optimists: no obligations, no sanctions, just principles and diplomacy. According to Kyodo News, that era is over. The government is preparing a revision of the AI law adopted in May 2025 to enshrine binding security measures — and criminal sanctions against companies that refuse to cooperate after an incident involving advanced AI.

The timeline is tight: the revision is expected before the end of the year. Behind this about-face lies an accumulation of incidents — massive data leaks, cyberintrusions in which AI is said to have played a role — and international pressure that is becoming increasingly hard to ignore.

And this is no local trifle. Between a European AI Act already in the process of being implemented and an America in full deregulation mode, Tokyo's choice will shape the third major global model of AI governance. It may well turn out to be the most pragmatic of the three.

The Key Takeaways

• The Japanese government is preparing an amendment to its May 2025 AI law, which currently has no binding force, expected by the end of the year (Kyodo News).
• The goal: making security measures mandatory for advanced AI players, with criminal penalties for failure to cooperate after an incident.
• The trigger: a string of data breaches and intrusions, some of which reportedly exploited AI.
• A stark contrast with Europe (AI Act, fines of up to 7% of global revenue) and the United States (openly embracing deregulation since January 2025).
• For businesses: traceability, logging, and the ability to cooperate with authorities are becoming urgent investments, not options.

Recommended Tools

Compliance isn't decreed — it's tooled up. Here are the building blocks I would put in place right now in any company exposed to the Japanese market.

One honest caveat: self-hosting state-of-the-art open models requires serious GPU hardware. A standard VPS is for hosting your applications and your data, not for running a frontier model.

What the revision contains: mandatory security measures, penalties for non-cooperation

The draft text would do two things the current law refuses to do: impose security measures on advanced AI actors, and criminally punish those who refuse to cooperate with authorities after an incident. According to Kyodo News, it is therefore the non-cooperation — not the accident itself — that would be criminalized.

A deliberately empty framework law

The law adopted in late May 2025 ("Act on the Promotion of R&D and Utilization of AI-Related Technologies") is an openly acknowledged shell: broad principles, moral responsibilities, and an AI strategic headquarters chaired by the Prime Minister. Zero obligations, zero sanctions.

This choice was strategic. In 2024, Microsoft announced a $2.9 billion investment in its Japanese data centers, OpenAI opened an office in Tokyo, and SoftBank sealed a massive partnership with OpenAI in early 2025. Regulatory softness was Japan's invitation card.

Twelve months later, the record demands a rethink: the capital came, but so did the incidents.

Who is targeted, and for what exactly?

The likely targets are developers and operators of frontier models — the category that includes systems like OpenAI's GPT-5.5, Google's Gemini 3 Pro Deep Think, or Anthropic's Claude Opus 4.7. The exact definition of "advanced AI" remains the sticking point of the dossier.

A crucial detail: the sanctions would target obstruction. A bug, a zero-day vulnerability, or unexpected model behavior will not send you to prison; refusing to provide the requested information or covering up the incident will. It is the proven logic of cybersecurity transposed to AI.

Why now: the grim string of leaks and intrusions

Because the political threshold has been crossed. Three years of major incidents have convinced Tokyo that voluntary trust is no longer enough to protect an entire digital ecosystem.

The examples keep piling up. Publisher Kadokawa, hit by ransomware in June 2024, saw its Niconico platform paralyzed for weeks and its data massively exfiltrated. Casio suffered a similar attack in October 2024. And in the fall of 2025, Asahi Group saw its orders and part of its production halted for weeks after a major cyberattack.

The cost follows the same slope. The global average cost of a data breach reached $4.88 million in 2024, up 10% year over year, according to the IBM Cost of a Data Breach 2024 report.

AI is changing the nature of the threat, not just its scale. Microsoft (2024 report) and OpenAI have documented state groups using LLMs for network reconnaissance, translation, and spear-phishing. The Japanese language barrier, long a natural shield against low-quality phishing, fell with multilingual models.

Kyodo mentions intrusions "suspected of having used AI." Judicial proof remains rare; the trend, however, is not. A country of more than 120 million people, ultra-digitized in its industry, can no longer afford purely symbolic regulation.

A doctrinal U-turn: from Hiroshima to the penal code

Yes, it's a 180-degree turn. And it had been written in the facts for two years.

Japan built its international brand on soft governance: the G7 Hiroshima Process (2023) and its voluntary code of conduct for advanced AI, consolidated guidelines for businesses (March 2025), the creation of an AI Safety Institute in 2024. The entire architecture rested on one conviction: agile beats rigid.

Three cracks brought this doctrine down. First, the digital deficit, on the order of more than 5 trillion yen per year according to METI (2024) — money leaving Japan for foreign clouds and services. Then the adoption lag: according to a Dentsu survey (2024), about a quarter of Japanese internet users regularly use generative AI, compared with nearly 70% in the United States. Finally, the incidents described above.

The government of Sanae Takaichi, which came to power in October 2025, has made AI an economic pillar while embedding it in the economic security doctrine. The minister in charge of AI now leads this revision effort.

My reading: Japan is not choosing between innovation and regulation; it is sequencing them. First, attract capital and models. Then set the framework, once the ecosystem is mature enough to absorb the rules. Cynical, but coherent.

Tokyo between Brussels and Washington: three doctrines that can no longer ignore one another

Japan is looking for a third way: binding after an incident, not before deployment. The table below summarizes why this positioning interests everyone.

Europe chose to codify before the technology is deployed. The European Commission's AI Act, which entered into force on August 1, 2024, has banned certain uses since February 2025 and has governed general-purpose models since August 2025. But even within the Union, the temptation of the private contract is gaining ground: Emmanuel Macron is pushing a charter with OpenAI and Anthropic to protect children, presented at the Paris Peace Forum — when the directive seems too burdensome, you sign a pledge instead.

The United States took the opposite path. The executive order of January 23, 2025 dismantled the Biden-era framework (October 2023), and the "America's AI Action Plan" (July 2025) turns deregulation into a lever of competition against China. Yet the debate there remains furious: California passed its own frontier model law in September 2025, and the Great American AI Act proposal seeks to freeze state legislation for three years. Even the most deregulation-minded federation doesn't yet know which hand it is playing.

In this landscape, Japan occupies a position I consider underrated. No European-style prior authorization, no American laissez-faire: a regime of security obligations and post-incident cooperation, close to the logic of Europe's NIS2 in cybersecurity. It is the only one of the three models directly exportable to Seoul, Singapore, or Taipei — and the OECD's AI Policy Observatory counts more than 1,000 public initiatives across more than 70 jurisdictions, all searching for a standard they can copy.

What This Means for Businesses

If you develop, resell, or deploy advanced AI in Japan, assume that traceability will become a legal obligation. Likely obligations include: an incident registry, documented cooperation with authorities, formalized and auditable security measures, and enhanced due diligence on third-party models.

The model supply chain will be the first battlefield. Self-hostable open models—DeepSeek V4 Pro, Kimi K2.6 from Moonshot AI, GLM-5 from Z.AI—are appealing to Japanese CIO/CTOs for data control. However, they transfer the security responsibility to the operator: the law will fall on the entity operating the system, not the foreign lab that published the weights.

Autonomous agents amplify the stakes. When Google launches permanent assistants like Gemini Spark, the 24/7 AI agent designed as a second brain, every gain in autonomy expands the radius of an incident's impact. An agent that reads, decides, and acts continuously produces consequences that no human has validated one by one. Regulators understood this before many CIO/CTOs.

And AI will not remain purely software. The arrival of Unitree G1 humanoid robots at Haneda Airport shows a Japan adopting embodied AI on a large scale. When the system steps out of the screen, the incident is no longer just digital—this criminal framework likely prefigures extensions to embedded systems.

Four actions to launch this quarter: inventory your models and uses; timestamp logs and evaluations; write an incident runbook with a channel to authorities; contractualize security with your model providers.

The Blind Spots: Vague Definition, Under-resourced State, Chilling Effect

Three clauses will decide the real value of this text — and none of them is settled yet.

The first is the definition of "advanced AI." Too broad, it makes the entire sector impossible to control and the law unenforceable. Too narrow, it lets real risks slip through. Expect a fierce lobbying battle over this single word.

The second is the capacity of the State. Japan's AI Safety Institute, created in 2024, remains a young structure in the face of laboratories employing thousands of researchers. Without technical inspection expertise, criminal penalties remain theater: deterrent to the timid, invisible to the rest.

The third is the chilling effect on disclosure. This is my main reservation about this text: threatening criminal liability can push companies to delay announcing an incident, while lawyers "secure" the file. Without a protection mechanism for good-faith rapid disclosure, the law risks producing exactly the opposite of its stated goal. The best cybersecurity regimes reward transparency; they don't merely punish silence.

❌ Common Mistakes

Mistake 1: believing that "no sanctions" meant "no obligations"

Many companies read the May 2025 law as a green light. That was wrong: civil liability already applied — the APPI law on personal data, contract law, the duty to secure information systems. The solution: map your AI uses now, not after the final text is published.

Mistake 2: waiting for the final text to start logging

Post-incident cooperation requires traces: deployment logs, model evaluations, frozen versions, patch history. You can't improvise an audit trail after an intrusion. The solution: timestamp everything starting this quarter. An AI incident runbook is worth more than a hundred commitments in principle.

Mistake 3: panicking about "criminal" without reading the exact scope

What would be penalized is the refusal to cooperate, not the incident itself. There's no need to freeze your AI projects out of fear of criminal liability. But don't underestimate it either: obstruction exposes natural persons — the executives — and not just the company. The solution: designate an AI incident lead, train them, and test the procedure at least once a year.

❓ Frequently Asked Questions

What criminal penalties are exactly being considered?

According to Kyodo News, criminal prosecution is being considered in cases of refusal to cooperate with authorities after an incident involving advanced AI. Fine amounts and penalties have not been finalized: they will be set in the final text of the revision, expected by the end of the year.

When will this revision be adopted?

The draft revision is expected before the end of 2025. The most likely scenario: review then a vote in the Diet during the 2026 ordinary session, with a phased entry into force. Japanese legislative schedules often slip by a few months, so build in some buffer.

Are foreign companies affected?

Yes, as soon as they provide or operate advanced AI on the Japanese market, including from abroad via subsidiaries or APIs. The extraterritorial enforcement mechanism remains to be clarified, but the precedent of the APPI law on personal data suggests a broad scope.

Should AI tools be banned for employees for now?

No. The text targets developers and operators of advanced AI, not office usage. But most leaks come from unmanaged use: a clear internal policy, vetted tools, and APPI compliance remain the baseline, revision or not.

Will this tightening slow down the Japanese AI ecosystem?

That's the labs' argument, but it's debatable. A credible rule reassures buyers, insurers, and public partners — precisely what the Japanese market lacks. The real risk isn't the text itself, it's slow bureaucratic execution and a poorly calibrated definition of "advanced AI."

✅ Conclusion

Japan has just confirmed that the window for voluntary regulation is closing everywhere, and that the real question is no longer "should advanced AI be regulated" but "who will set the rules, and after what disaster". To grasp the scale of this transatlantic battle, continue with our deep dive into the Great American AI Act — three continents are currently writing the rules of AI, and none can afford to ignore the other two.