REGULATORY INSIGHT

Japan's Act on Strengthening Cyber Response Capabilities — what critical infrastructure operators must notify and report from 1 October 2026

22 October 2026

Who has to show what, and from when

Japan’s legislation on what is commonly called active cyber defence — the Act on the Prevention of Damage Caused by Unauthorised Acts Against Important Computers (Act No. 42 of 2025, promulgated in May 2025) — brought its notification and reporting duties for critical infrastructure operators into force on 1 October 2026.

The duties fall on “designated critical infrastructure operators”: operators designated by the competent minister under the Economic Security Promotion Act that use “specified important computers” (Article 2). There are two duties — to notify the product names and manufacturers of the specified important computers in use (Article 4), and to report intrusion events affecting them (Article 5). Overseas vendors whose products sit in those systems will feel the effect through their customers.

What the Act and Order set out

• What is notified: an outline of the operator, the category of specified important facility, the category of specified important computer, the product name and the manufacturer
• Notification deadlines: within four months of introduction for new equipment; within six months of the date of effect (by the end of March 2027) for equipment already in place; within four months of any change
• Not notifiable: purpose-built products used only within the group, and products designated as general-purpose (common operating systems and the like)
• Reportable events: specified intrusion events (deployment of malware, unauthorised access, disruption of business and so on) and events that may cause them (receipt of electromagnetic records giving unauthorised commands, unauthorised entry of another person’s identification code, traces of such acts, and so on)
• To whom and when: to the minister responsible for the business and to the Prime Minister — a first report promptly after becoming aware, and a detailed report within 30 days of awareness. Forms set by public notice distinguish DDoS, ransomware and other events
• Report contents: type of report, outline of the operator, outline of the event, computers affected, technical matters, measures taken and so on
• Enforcement: the responsible minister may order corrective action for breaches of the notification and reporting duties, and breach of such an order is subject to criminal penalty

Unlike the EU Cyber Resilience Act or the NIS2 Directive, there are no 24-hour or 72-hour deadlines. The meaning of “promptly” is, however, being given indicative timeframes by type of event.

Where it gets difficult in practice

1. Because events that “may cause” an intrusion are reportable as well as intrusions themselves, deciding what to report and what not to becomes a daily occurrence. Without a record of why something was not reported, the decision cannot be defended later
2. Only events relating to specified important computers are reportable. Unless the notification register is linked to the monitored asset inventory and logs, you cannot tell quickly whether a detected event concerns a reportable machine
3. Notification is due within four months of introduction or change. Procurement and operations may know that equipment or a product version has changed, but without a route to the person responsible for notification, the deadline passes
4. What is known will change between the first report and the detailed report. Unless the facts known and the content reported at each point are versioned, the changes cannot be explained

Carry it by hand, or build it in

There are two ways to meet a requirement like this. One is to carry it by hand: write the procedures and have people check and record. The other is to build in a mechanism that leaves the record you will be asked for as a matter of course.

The first is quicker to start, but it breaks down as the procedures and the people involved multiply. Exceptions accumulate, the granularity of the record drifts, and you lose the ability to establish the scope afterwards. The second puts the design effort up front, but keeps you able to check after the event.

We research and develop technology that carries conformity with regulation as a mechanism rather than as manual routine, and we hold the results as patent applications. See Domains for more.

We follow these rules as they come into force. Updates are available by RSS.

← Back to Insights