Our thinking

AI Watch: Global regulatory tracker

What's inside

Keeping track of AI regulatory developments around the world.

The global dash to regulate AI

Artificial intelligence (AI) has made enormous strides in recent years and has increasingly moved into the public consciousness.

Increases in computational power, coupled with advances in machine learning, have fueled the rapid rise of AI. This has brought enormous opportunities, as new AI applications have given rise to new ways of doing business. It has also brought potential risks, from unintended impacts on individuals (e.g., AI errors harming an individual's credit score or public reputation) to the risk of misuse of AI by malicious third parties (e.g., by manipulating AI systems to produce inaccurate or misleading output, or by using AI to create deepfakes).

Governments and regulatory bodies around the world have had to act quickly to try to ensure that their regulatory frameworks do not become obsolete. In addition, international organizations such as the G7, the UN, the Council of Europe and the OECD have responded to this technological shift by issuing their own AI frameworks. But they are all scrambling to stay abreast of technological developments, and already there are signs that emerging efforts to regulate AI will struggle to keep pace. In an effort to introduce some degree of international consensus, the UK government organized the first global AI Safety Summit in November 2023, with the aim of encouraging the safe and responsible development of AI around the world. 

Most jurisdictions have sought to strike a balance between encouraging AI innovation and investment, while at the same time attempting to create rules to protect against possible harms. However, jurisdictions around the world have taken substantially different approaches to achieving these goals, which has in turn increased the risk that businesses face from a fragmented and inconsistent AI regulatory environment. Nevertheless, certain trends are becoming clearer at this stage:

  1. "AI" means different things in different jurisdictions: One of the foundational challenges that any international business faces when designing an AI regulatory compliance strategy is figuring out what constitutes "AI." Unfortunately, the definition of AI varies from one jurisdiction to the next. For example, the draft text of the EU AI Act adopts a definition of "AI systems" that is based on (but is not identical to) the OECD's definition, and which leaves room for substantial doubt due to its uncertain wording. Canada has proposed a similar, though more concise, definition. Various US states have proposed their own definitions, which differ from one another. And many jurisdictions (e.g., the UK, Israel, China, and Japan) do not currently provide a comprehensive definition of AI. Because several of the proposed AI regulations have extraterritorial effect (meaning more than one AI regulation may apply simultaneously), international businesses may be forced to adopt a "highest common denominator" approach to identifying AI based on the strictest applicable standard.
  2. Emerging AI regulations come in different forms: The various emerging AI regulations have no consistent legal form – some are statutes, some are executive orders, some are expansions of existing regulatory frameworks, and so on. The EU AI Act is a "Regulation" (which means that most of it will apply directly in all EU Member States, without the need for national implementation in most cases). The UK has taken a different approach, declining to legislate at this early stage in the development of AI, and instead choosing to task existing UK regulators with the responsibility of interpreting and applying five AI principles in their respective spheres. In the US, there is a mix of White House Executive Orders, federal and state initiatives, and actions by existing regulatory agencies, such as the Federal Trade Commission. As a result, the types of compliance obligations that international businesses face are likely to be materially different from one jurisdiction to the next. Many other jurisdictions have yet to decide whether they will issue sector-specific or generally applicable rules and have yet to decide between creating new regulators or expanding the roles of existing regulators, making it challenging for businesses to anticipate what form their AI regulatory relationships will take in the long term.
  3. Emerging AI regulations have different conceptual approaches: The next difficulty is the lack of a consistent conceptual approach among emerging AI regulations around the world – some are legally binding while others are not, some are sector-specific while others apply across all sectors, some will be enforced by regulators while others are merely guidelines or recommendations, and so on. As noted above, the UK approach is to use existing regulators to implement five AI principles, but with no new explicit legal obligations. This has the advantage of meaning that businesses will deal with AI regulators with whom they are already familiar but has the disadvantage that different UK regulators may interpret these principles differently in their respective spheres. The EU AI Act is cross-sectoral and creates new regulatory and enforcement powers for existing bodies, including the European Commission, and also creates entirely new bodies such as the AI Board and the AI Office, while leaving EU Member States to appoint their own AI regulators tasked with enforcing the AI Act. In the US, the Federal Trade Commission, Equal Employment Opportunity Commission, Consumer Financial Protection Bureau, and Department of Justice issued a joint statement clarifying that their existing authority covers AI, while various state regulators are also likely to have competence to regulate AI. International organizations including the OECD, the UN, and the G7 have issued AI principles, but these impose no legal obligations on businesses. In principle, these initiatives encourage consistency across members of each organization, but in practice this does not seem to have worked.
  4. Flexibility is a double-edged sword: In an effort to create AI regulations that can adapt to technological advances that have not yet been anticipated, many jurisdictions have sought to include substantial flexibility in those regulations, either by using deliberately high-level wording and policies, or by allowing for future interpretation and application by courts and regulators. This has the obvious advantage of prolonging the lifespan of such regulations by allowing them to be adapted to future technologies. However, it also creates the disadvantage of uncertainty because it leaves businesses uncertain of how their compliance obligations will be interpreted in the future. This is likely to mean that it is harder for businesses to know whether their planned implementations of AI will be lawful in the medium-to-long term and may make it harder to attract long-term AI investment in those jurisdictions.
  5. The overlap between AI regulation and other areas of law is complex: A substantial number of laws that are not directly focused on AI nevertheless apply to AI by association within their respective spheres, meaning that any use of AI will often trigger compliance issues and legal challenges even where there is not (yet) any enforceable AI-specific law. These areas of overlap include: IP (e.g., IP infringement issues with respect to AI model training data, and questions about copyright and patentability of AI-assisted inventions); antitrust; data protection (which adds restrictions to processing of personal data, and in some cases imposes special compliance obligations for processing carried out by automated means, including by AI); M&A (where AI innovation is driving dealmaking in many markets); financial regulation (where financial regulatory requirements may limit the ways in which AI can lawfully be deployed); litigation; digital infrastructure; securities; global trade; foreign direct investment; mining & metals; and so on. This overlap will mean that many businesses need to understand not just AI regulations in general, but also any rules that affect the use of AI in the context of the relevant sector or business activity.

Businesses in almost all sectors need to keep a close eye on these developments to ensure that they are aware of the AI regulations and forthcoming trends, in order to identify new opportunities and new potential business risks. But even at this early stage, the inconsistent approaches each jurisdiction has taken to the core questions of how to regulate AI is clear. As a result, it appears that international businesses may face substantially different AI regulatory compliance challenges in different parts of the world. To that end, this AI Tracker is designed to provide businesses with an understanding of the state of play of AI regulations in the core markets in which they operate. It provides analysis of the approach that each jurisdiction has taken to AI regulation and provides helpful commentary on the likely direction of travel.

Because global AI regulations remain in a constant state of flux, this AI Tracker will develop over time, adding updates and new jurisdictions when appropriate. Stay tuned, as we continue to provide insights to help businesses navigate these ever-evolving issues.

Articles

Australia

Voluntary AI Ethics Principles guide responsible AI development in Australia, with potential reforms under consideration.

Australia

Brazil

The enactment of Brazil's proposed AI Regulation remains uncertain with compliance requirements pending review.

Sao Paulo

Canada

AIDA expected to regulate AI at the federal level in Canada but provincial legislatures have yet to be introduced.

Canada

China

The Interim AI Measures is China's first specific, administrative regulation on the management of generative AI services.

China

Council of Europe

The Council of Europe is developing a new Convention on AI to safeguard human rights, democracy, and the rule of law in the digital space covering governance, accountability and risk assessment.

European Union

European Union

The EU introduces the pioneering EU AI Act, aiming to become a global hub for human-centric, trustworthy AI.

 

European Union

France

France actively participates in international efforts and the EU AI Act negotiations, and proposes sector-specific laws.

Paris

G7

The G7's AI regulations mandate Member States' compliance with international human rights law and relevant international frameworks.

G7 flags

Germany

Germany evaluates AI-specific legislation needs and actively engages in international initiatives.

Germany

India

National frameworks inform India’s approach to AI regulation, with sector-specific initiatives in finance and health sectors.

India

Israel

Israel promotes responsible AI innovation through policy and sector-specific guidelines to address core issues and ethical principles.

Israel

Italy

Italy plays a prominent role in EU AI Act negotiations and engages in political discussions for future laws.

Milan

Japan

Japan adopts a soft law approach to AI governance but lawmakers advance proposal for a hard law approach to generative AI foundation models.

Tokyo

Norway

Position paper informs Norwegian approach to AI, with sector-specific legislative amendments to regulate developments in AI.

Norway

OECD

The OECD's AI recommendations encourage Member States to uphold principles of trustworthy AI.

country flags

Singapore

Singapore's AI frameworks guide AI ethical and governance principles, with existing sector-specific regulations addressing AI risks.

Singapore

Spain

Spain creates Europe's first AI supervisory agency and actively participates in EU AI Act negotiations.

Madrid

Switzerland

Switzerland's National AI Strategy sets out guidelines for the use of AI, and aims to finalize an AI regulatory proposal in 2025.

Switzerland

Taiwan

Draft laws and guidelines are under consideration in Taiwan, with sector-specific initiatives already in place.

Taiwan city

United Kingdom

The UK prioritizes a flexible framework over comprehensive regulation and emphasizes sector-specific laws.

London hero image

United Nations

The UN's new draft resolution on AI encourages Member States to implement national regulatory and governance approaches for a global consensus on safe, secure and trustworthy AI systems.

United Nations

United States

The US relies on existing federal laws and guidelines to regulate AI but aims to introduce AI legislation and a federal regulation authority.

New York city photo

Contacts

Tim Hickman
Partner
London
Erin Hanson
Partner
New York
Dr. Sylvia Lorenz
Partner
Berlin
Tokyo

AI Watch: Global regulatory tracker - Japan

Japan adopts a soft law approach to AI governance but lawmakers advance proposal for a hard law approach to generative AI foundation models.

Insight
|
8 min read

Laws/Regulations directly regulating AI (AI Regulations)

Japan currently has no law specifically directed to regulating AI. Thus, at this time, Japan is taking an indirect approach to support the policy goal of prioritizing innovation while minimizing foreseeable harms.

To this end, the Ministry of Economy, Trade and Industry (METI) published Japan's AI regulatory policy (AI Governance Report 1.1) (the METI Guidelines) in January 2022.1 The METI Guidelines are not legally binding but are expected to support and induce voluntary efforts in good practices by companies developing and deploying AI systems. Separately, Japan has also published the Hiroshima International Guiding Principles for Organizations Developing Advanced AI Systems (the Hiroshima Principles), which aim to establish and promote guidelines worldwide for safe, secure and trustworthy AI.2

A working group of the governing Liberal Democratic Party is reportedly advancing a proposal, titled "the Basic Act on the Advancement of Responsible AI," that would adopt a "hard law" approach to regulate certain generative AI foundation models (Proposed AI Bill). Under the proposed law, the government would designate the AI system and developers subject to regulation, impose obligations on them with respect to vetting, operation and output of the systems, and require periodic reports. The proposed obligations would likely be similar to the "voluntary commitments" that some major AI companies in the US (such as OpenAI, etc.) made to the White House in July 2023. It is thought that the law would provide a general framework, while industry groups and/or individual developers would be expected to establish the specific standards by which they would comply. It is further thought that the government would have the authority to monitor AI developers and impose fines and penalties for violations of the reporting obligations and/or compliance with the substance of the law. Thus, if the Proposed AI Bill is passed on these terms, this would mark a shift from a "soft law" approach to a "hard law" approach to regulating AI in Japan.

Status of the AI Regulations

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. Note, however, the Proposed AI Bill (see above) may result in a "basic law" directed at AI-based systems and applications.

Other laws affecting AI

There are various laws that, though not adopted specifically to regulate AI, are likely to affect the development or use of AI in Japan. A non-exhaustive list of key examples includes:

  • The Digital Platform Transparency Act, which imposes requirements on large online malls, app stores, and digital advertising businesses to ensure transparency and fairness in transactions with business users
  • The Financial Instruments and Exchange Act, which requires businesses engaging in algorithmic high-speed trading to register with the government, establish a risk management system, and maintain transaction records
  • The Civil Code, which allows tort claims to be brought against a person who has given instructions to AI to produce defamatory content about another person and published such content
  • The Copyright Act and the Act on the Protection of Personal Information, which can be applied to inappropriate uses of AI

In addition, various acts involving AI may already be caught by the Criminal Code: Using AI to defame another could fall under the ambit of defamation; using AI-generated fake content to interfere with someone's business could be punishable as an obstruction of business; and giving unauthorized commands to another person's computer can also be punishable under the criminal code.

Definition of AI

There is no legally recognized definition of "AI" in Japan. The Draft AI Guidelines for Business published by METI and the Ministry of Internal Affairs and Communications ("Draft AI Guidelines for Business") note that there is currently no established definition for AI and that it is difficult to strictly define its scope. However, for the purpose of the Draft AI Guidelines for Business document, METI states that AI is an abstract concept that includes AI systems themselves, as well as machine learning software and programs.3

Territorial scope

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. The non-binding METI Guidelines do not refer to a territorial scope or contemplate extra-territorial jurisdiction; nor do they distinguish between on-shore and off-shore entities or actions. However, the proponents of the Proposed AI Bill are considering the appropriate territorial scope for a regulatory system.

Sectoral scope

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. Accordingly, there is no specific sectoral scope at this stage. 

The Draft AI Guidelines for Business are broadly applicable to AI developers, AI providers and those using AI in the private sector.

Compliance roles

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. Accordingly, there are currently no specific or unique compliance obligations imposed on developers, users, operators and/or deployers of AI systems.

Core issues that the AI Regulations seek to address

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. Nevertheless, the Hiroshima Principles identify a number of significant risks, including disinformation, copyright, cybersecurity, risks to health and safety, and societal risks such as the ways in which advanced AI systems can give rise to harmful bias and discrimination.

Further regarding copyright, in-depth discussions are being held in Japan about how existing laws (i.e., the Copyright Act of Japan) should address issues concerning rights and harms that may arise from Generative AI. Also, the Council of the Agency for Cultural Affairs is expected to announce its position regarding copyright where AI is trained on the works of humans and AI-generated content.

Risk categorization

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. In addition, AI or AI systems are not generally classified according to risk in the relevant guidelines and principles announced in Japan. However, it has been reported that some government officials believe that a risk-based approach is necessary.5

Key compliance requirements

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI.

Nevertheless, the METI Guidelines note that certain AI principles adopted by Japan are moving toward a consensus. Those principles are:6

  • Human-centric – i.e., the utilization of AI must not infringe upon the fundamental human rights guaranteed by the constitution and international standards
  • Education/literacy – i.e., policy makers and managers of businesses involved in AI must have an accurate understanding of AI, as well as suitable knowledge and ethics to permit the appropriate use of AI in society
  • Privacy protection – i.e., each stakeholder must consider whether to handle personal data with greater discretion, in accordance with the level of importance and sensitivity of the data
  • Ensuring security – i.e., society must be aware of the balance between the benefits and risks of AI, and endeavor to improve social safety and sustainability as a whole
  • Fair competition – i.e., a fair competitive environment between countries and stakeholders regarding the use of AI must be maintained
  • Fairness, accountability and transparency – i.e., in an "AI-Ready Society," it is necessary to ensure fairness and transparency in decision-making, appropriate accountability for the results, and trust in the technology, so that people who use AI are not subject to undue discrimination with regard to personal background, or to unfair treatment in terms of human dignity
  • Innovation – i.e., equal collaboration among universities, research institutions and companies regarding AI research should be promoted, and governments should proceed with regulatory reforms to reduce impeding factors and establish an efficient and beneficial society with the aid of AI technologies

Regulators

As noted above, at this time, there are no specific laws or regulations in Japan that directly regulate AI, and so there is no specific AI regulator. Nevertheless, the following ministries and agencies are substantively engaged in establishing and promoting guidelines regarding AI:

  • The Ministry of Economy, Trade and Industry
  • The Ministry of Internal Affairs and Communications
  • The Agency for Cultural Affairs (particularly for copyright issues)
  • The Personal Information Commission

Guidelines promulgated by ministries in Japan are often followed closely by companies and the public, even though they are not binding law.

Enforcement powers and penalties

As noted above, at this time, there are no laws or regulations in Japan that expressly govern the development, use, or provision of AI. As such, enforcement and penalties relating to the creation, dissemination and/or use of AI are governed by related violations in non-AI legislation (such as those set out in Item 3 above).7 However, the Proposed AI Bill contemplates implementing a regulatory system that includes fines and penalties for violations.

See the METI Guidelines here
See the Hiroshima Process International Code of Conduct for Organizations Developing Advancing AI Systems here
3
See the "Draft AI Guidelines for Business" (here), page 8.
See the "Draft AI Guidelines for Business" (here), page 3 and the Appendices here.
5
See here
See the METI Guidelines (here), page 9: "As mentioned above, the discussion on what AI Principles are is moving toward a general consensus. Japan adopts seven principles in "Social Principles of Human-centric AI" (decision of the Integrated Innovation Strategy Promotion Council)", and the Social Principles of Human-Centric AI here
7 In addition to enforcement set out in item 3: METI is authorized to issue a recommendation or an order to a large digital platform provider if they do not disclose certain factors used to determine search rankings; the Personal Information Commission (the PIC) is authorized to supervise and monitor businesses handling personal or other related information, and it may issue a recommendation or an order; the PIC may publish the name of businesses that failed to comply with its order; and, while the Criminal Code does not specifically focus on AI, as discussed above, activity using AI may constitute a crime and be punished.

White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.

This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.

© 2024 White & Case LLP

Maoko Kamiya (Associate, White & Case, Tokyo) and James Keate (Associate, White & Case, Tokyo) contributed to this publication.

Top