Japan Active Cyber Defence Act Guide: Asset Notification and Incident Reporting Duties

Since 1 October 2026, Japan's designated critical infrastructure operators must report cyber intrusions on their most important computers to both their sector minister and the Prime Minister, and must tell the government which products those computers run. The duties come from the Act on the Prevention of Damage from Unauthorised Acts Against Critical Computers (Act No. 42 of 2025), widely called the Active Cyber Defence law and described by the Cabinet Office as the Cyber Countermeasure Capability Enhancement Act. This guide covers the operator side only: who is in scope, what has to be notified and reported, the deadlines in the October 2026 ministerial ordinance, enforcement, and how to prepare. It is written for CISOs, OT security leads and compliance teams at Japanese critical infrastructure operators and their suppliers. It does not describe the government's own countermeasure powers beyond naming them. Status line: checked on 27 October 2026 against the Act and ordinance texts on e-Gov and Cabinet Office guidance. This guide is not legal advice; translations are our own.

Key takeaways

• Two operator duties: notify the competent minister of each specified critical computer introduced (Article 4), and report specified intrusion events and events that could cause them to the minister and the Prime Minister (Article 5).
• Reporting started on 1 October 2026: an initial report promptly after recognising the event, then a full report within 30 days, under Article 4 of the reporting ordinance (Ministerial Ordinance No. 4 of 2026).
• Asset notification has deadlines: within four months of introducing a specified critical computer, and within six months of enforcement for computers already in use, which Cabinet Office guidance puts at 31 March 2027.
• Scope rides on economic security designations: operators designated under Article 50(1) of the Economic Security Promotion Act are the core population.
• Penalties follow orders: failure to notify or report can lead to a ministerial order under Article 6, and breaching that order carries a fine of up to 2 million yen (Article 83), with corporate liability under Article 86.

Scope: who and what is covered

Article 1 sets out the Act's purpose: preventing damage from unauthorised acts against critical computers through a basic policy, a reporting system for critical infrastructure operators, the collection and analysis of communications information to counter attacks originating overseas, oversight by an independent monitoring committee, and the sharing of analysis results. A Basic Policy under the Act was approved by Cabinet decision on 23 December 2025.

Which computers count

Cabinet Office guidance dated 1 October 2026 groups specified critical computers into three categories, drawing on the Cabinet Order and ministerial ordinance:

1. Computers that form part of the specified critical facility itself.
2. Computers connected to the facility, such as internet-facing devices, authentication servers, DMZ devices and network control devices.
3. Computers that feed data into the facility, for example via USB media or cloud services.

The second category matters for identity teams: authentication servers that front a critical facility are in scope for notification. The guidance also lists exemptions: widely used products designated by ministers (the guidance names Windows and Windows Server), custom products used only within a corporate group, and, for non-appliance computers, hardware and firmware (only the operating system, middleware and applications are notifiable). For appliances, hardware and software count as one item.

Key obligations

What goes into a report

Ordinance Article 4(3) lists the contents: the type of report, an overview of the operator, an overview of the event, the specified computer affected, technical details of the event, response measures taken, and other notes. The National Cyber Office publishes a unified attack reporting format, and Cabinet Office guidance says filings go through a public-private collaboration platform, with forms prescribed by ordinance.

What goes into a notification

According to the guidance, the required content is an operator overview, facility category, computer category, product name and manufacturer, plus an attachment showing how systems relate to each other. Version information, global IP addresses and management responsibility are optional but recommended. Where a filing has already been made under Article 52 of the Economic Security Promotion Act, those documents can substitute for the matching part.

The ordinance carves out some cases from the staged reporting procedure, including events in the first six months after a new designation or after a computer newly becomes a specified critical computer. Check the exact wording for your situation.

Timeline and current status

The Act's supplementary provisions set the main enforcement no later than 18 months after promulgation. Government communications-information analysis and the access and neutralisation measures in the companion amendment law follow a separate timetable and are outside this guide.

Enforcement and penalties

• Orders: under Article 6, if the competent minister finds a breach of Article 4(1), 4(3) or 5, the minister may set a deadline and order the operator to notify, report or correct a report.
• Prime Minister's opinion: under Article 7, the Prime Minister may tell the competent minister that an order or other disposition should be issued.
• Fines: violating an Article 6 order is punishable by a fine of up to 2 million yen (Article 83). Failing to submit, or falsifying, reports or materials requested under Article 9 carries up to 300,000 yen (Article 84). Article 86 extends fines to the corporation.
• No direct fine for a late first report: the Act text we read does not attach a criminal penalty directly to Articles 4 or 5; the route is order first, then penalty.

Guidance from the Cabinet Office says following its recommended step-by-step process is advisable but not following it is not in itself a violation.

What it means for AI agents and non-human identities

The Act does not mention AI agents or machine identities. It does make identity infrastructure reportable in two ways:

• Authentication servers are notifiable assets: directory, federation and authentication servers connected to a specified critical facility fall into the second category of specified critical computers. Keep their product and version data accurate.
• Unauthorised access is a reportable event: misuse of service account credentials, API keys, remote access tokens or vendor accounts against an in-scope computer is unauthorised access, so your detection must attribute machine credential use. See the Identity for OT Environments Guide.
• Cloud feeds are in scope: computers that feed data via cloud services are in the third category, which brings integration credentials and workload identities into the notification picture.
• Agents in operations: if AI agents or automation hold credentials into facility networks, treat them as remote access paths: unique identity, owner, least privilege and logging. See the Agent Identity and Access Guide.

Compliance steps

1. Confirm designation: check whether your organisation is designated under Article 50(1) of the Economic Security Promotion Act and which sector minister is competent.
2. Scope the asset inventory: list computers in each of the three categories for each specified critical facility, applying the exemptions. See the Asset Inventory and CMDB Security Guide.
3. File existing assets on the public-private collaboration platform before 31 March 2027, using Form 1.
4. Change control: add a step to the change process that triggers a Form 1 or Form 2 filing within four months of introduction or change.
5. Update the incident playbook: add a decision point for "specified intrusion event or event that could cause one", a prompt initial report to both recipients, and a 30-day full report, with the seven content items as a template. See the Incident Response Plan Template.
6. Test it: run a tabletop that ends with a drafted initial report, then measure time from detection to filing.
7. Align with other regimes: map the reporting against personal data breach reporting under APPI and sector rules. See the Japan APPI Guide and the Cyber Incident Reporting Requirements Map.

Mapping to frameworks

Metrics

• Share of in-scope computers notified, by facility.
• Median days from asset introduction to notification (target well under four months).
• Hours from recognition to initial report in exercises and real events.
• Full reports filed within 30 days.
• Machine credentials on in-scope authentication servers with a named owner.
• Vendor and integrator contracts for in-scope facilities that contain an intrusion notification clause with an hours-based deadline.

Decision guidance: when to file an initial report

Article 5 covers events that could cause a specified intrusion event as well as confirmed ones, so the hard call is usually about early signals. A practical rule set:

• Report: confirmed malware execution, confirmed unauthorised logons or changes on a specified critical computer, or business interference affecting a specified critical facility.
• Usually report: a credible indicator of compromise on a connected authentication server or DMZ device, such as a stolen service account used from an unknown source, even before impact is known. The initial report only needs the items known at that point.
• Record and monitor: blocked scanning or failed attacks with no foothold, unless sector guidance says otherwise. Keep the rationale in the incident record.

Large operators with many facilities should centralise the decision in one reporting cell that knows which computers are specified, so that local teams do not have to interpret the law. Smaller designated operators often rely on vendors and integrators for OT; write the reporting trigger into those contracts so a vendor who sees an intrusion tells you in hours, not at the next maintenance visit. See the Third-Party Incident Notification Clauses Guide.

Common failure patterns

• Inventory scoped to the facility only: missing the connected authentication servers and cloud data feeds in categories two and three.
• Waiting for certainty: holding the initial report until forensics finish, when the ordinance asks for a prompt report with what is known.
• One recipient only: reporting to the sector minister but not the Prime Minister, although Article 5 names both.
• Change control blind spot: replacing or upgrading products without triggering a change notification within four months.
• Shared vendor credentials: integrator accounts used across sites make unauthorised access hard to detect and attribute. See the OT Third-Party and Integrator Access Guide.

Practitioner checklist

• Confirm designation status and the competent minister.
• Build the three-category inventory per specified critical facility.
• Record exemptions applied and the reason.
• File existing assets before 31 March 2027.
• Wire four-month notification into change management.
• Add the prompt initial report and 30-day full report to the incident playbook.
• Pre-fill the seven report content items in a template.
• Get platform access set up for named filers in advance.
• Bring machine credentials on in-scope systems under ownership and logging.
• Add an intrusion notice duty, with a deadline in hours, to every OT vendor and integrator contract covering in-scope facilities.

Standards and references

• e-Gov: Act on the Prevention of Damage from Unauthorised Acts Against Critical Computers (Act No. 42 of 2025)
• e-Gov: Ordinance on Reporting of Specified Intrusion Events (Ministerial Ordinance No. 4 of 2026)
• Cabinet Office: Cyber security and national security portal
• Cabinet Office and ministries: Guide for specially designated critical infrastructure operators (October 2026)
• Cabinet Office: Enforcement explanation

Related NHI Mgmt Group resources: Japan APPI Guide · Critical Infrastructure Regulation Map · Critical Infrastructure Identity Security Guide · Cyber Incident Reporting Requirements Map. This guide summarises Japan's Act on the Prevention of Damage from Unauthorised Acts Against Critical Computers and is not legal advice.