Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| Act on the Promotion of Research and Development, and Utilization of AI-Related Technology (AI Promotion Act) | Binding statute, in full effect 1 September 2025, but a promotion law. Passed 28 May 2025, promulgated 4 June 2025. The Act itself creates no penalties and no prohibitions. Other Japanese law still applies in full. Article 7 calls on business operators to endeavor to develop and use AI-related technology appropriately, and to cooperate with national and local government measures promoting it. The government's published overview states the Act also covers foreign business operators whose AI activities target Japan. | National AI policy infrastructure: the AI Strategic Headquarters chaired by the Prime Minister, the AI Basic Plan, and authority for ministries to issue guidelines and request cooperation in incident inquiries. |
| AI Basic Plan · Cabinet Office | Cabinet-decided strategy, not binding on private parties. First plan adopted 23 December 2025; a new plan adopted 14 July 2026 superseded it. | Government objectives and coordination. Describes government policy direction; it creates no private-party obligation. |
| Guidelines on Ensuring Appropriateness in R&D and Utilization of AI-related Technology (December 2025) and AI Guidelines for Business v1.2 (MIC / METI, March 2026) | Non-binding guidance. The Appropriateness Guidelines were adopted on 19 December 2025 under Article 13 of the Act; the Guidelines for Business consolidate earlier ministry guidance. | Voluntary expectations across the AI lifecycle: human involvement, transparency, risk management, and record-keeping practices. |
| Act on the Protection of Personal Information (APPI) · PPC | Binding law. | Personal data handling, including by AI systems. Using AAES does not discharge the business operator's duties; a vendor can itself be a personal-information-handling business operator depending on its role. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Named accountability for AI use (AI Guidelines for Business; governance expectations under the Basic Plan) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human involvement in consequential actions (Appropriateness Guidelines) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Material for responding to incident inquiries (Act, Article 7; ministry information requests) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers whether the Act's cooperation duties or ministry guidelines reach your organization.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026.
- Status changes. Ministry guidelines under the Act are still being issued; re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.