日本語 
Japan has enacted its Active Cyber Defense Law (ACDL), an innovative legal mechanism to transform the manner in which organizations are being protected from the increasing threats of cybercrimes in an interconnected world. This legal framework will be fully rolled out in 2027, as the Japanese government enacted the ACDL on May 16th of 2025. This legally mandated mechanism will enable organizations in Japan to proactively protect itself from cyber threats as the focus of the Japanese government continues to grow in the realm of cyber security and regulation.
This speed and broad sweep of digital transformation across industries such as manufacturing, finance, telecommunications, and energy have brought to the forefront the issue of cybersecurity as a national need. ACD Law introduces new obligations for critical infrastructure and information and communication technologies, noting one of the most significant developments in Japan’s evolving cybersecurity laws over the past year.
Why the Active Cyber Defense Law Was Introduced
Japan’s digital infrastructure continues to grow exponentially, especially cloud computing, IoT, smart manufacturing, and AI-based infrastructures, which are central to Japan’s economic blueprint. However, this digital revolution has opened Japan’s entities and critical infrastructure to a whole array of sophisticated cyber threats. States around the globe are rethinking their cybersecurity posture, starting with Japan itself.
Also Read: HENNGE One Introduces SSO for Cato SASE Platform
The ACD Law reflects Tokyo’s intention of moving away from the reactive approach of simply reacting to cyber breaches as the incidents arise to the proactive approach of building the foundation of national cyber security through data sharing, joint analysis, and rapid reporting of incidents.
Key Elements of the ACD Law
The ACD Law is built around four strategic pillars, but two in particular — public‑private collaboration and use of communications data — carry the most direct impact on businesses.
- Public‑Private Collaboration
Some of the major characteristics of this law include the formulation of a body of authorities composed of government entities, Critical Infrastructure Operators (CIO), and tech firms to come up with a body referred to as a ‘Council on Information Sharing and Countermeasures.’ Gathering of entities in this forum helps in examining cyber threats in real-time and sharing of sensitive information to boost national cyber readiness.
- Incident Reporting & Data Sharing
CIOs or entities that are defined as such by the Economic Security Promotion Act of Japan are set to submit reports of cyber security incidents and potential threats to various Japanese ministries and the PMO by the ACD. Telecommunications providers and IT companies could also be asked to supply communication data when needed to prevent potential cyber security or internet threats.
These reporting requirements are noteworthy as they not only require companies to maintain records of breaches but also to cooperate with the relevant government agencies when necessary.
Who Must Comply?
The ACD Law applies to a broad range of businesses that support national functions or operate critical systems, including:
Critical infrastructure operators, including those for power, gas distribution, finances, telecommunications, and various modes of transport
Telecommunications service providers
Vendors of information technology who have integrated their products within key system
For these organizations, this equates to “taking steps to strengthen cyber due diligence practices, reporting mechanisms, and cooperation protocols with government cybersecurity organizations.”
Practical Impacts on Businesses
Increased Compliance Requirements Companies labelled as CIOs or operating in certain critical sectors must now prepare for emerging compliance demands, which include the requirement for notification in the event of a particular type of breach, as well as participation in government-sponsored cyber analysis.
Real‑Time Threat Sharing
The ACD law facilitates the voluntary sharing of threat-related information amongst IT providers as well as infrastructure operators. This contrasts with the past practices of threat information sharing, which were often limited. This sharing process also ensures the information shared is done real-time. This enhances the threat awareness throughout the nation, while also giving rise to some concerns.
Regulatory and Legal Risk
However, such non-compliance could have legal implications, as violation of reporting incidents or sharing information may result in enforcement action. Organizations would have to invest in legal as well as cybersecurity support services to effectively operate in a changed scenario.
Broader Industry Implication
The ACD Law in Japan fits well into the larger context of a global trend that has emerged in active collaboration in the design of a new breed of security systems in which the role of the state in the context of defense has been a shared responsibility between state and private actors in the case of nations such as the United States, the United Kingdom, and the European nations.
However, in the context of multinational businesses operating within the Japanese market, the above signals a move that reinforces the harmonization of global cybersecurity standards with the prevailing legal standards within the Japanese market. A number of businesses operating within the Japanese market are required to ensure that they adopt the ACD Law into their approach to corporate governance.
Cybersecurity as a Strategic Business Priority
The ACD law takes into account the concept that the days when cybersecurity was an IT issue are long past, and today it is a strategic business driver measured by the rise of resilience, trust, and continuity. Companies that take a forward approach to investing in sophisticated information classification, threat detection technologies, and collaboration-based security models are working towards gaining a competitive edge.
Additionally, the level of compliance with the ACD Law is expected to affect investor confidence, especially for industries where digital operations play an essential role in creating value. Ultimately, as Japanese organizations adapt to cybersecurity measures aligned with Japanese citizens’ views, the Japanese business environment will become better positioned to face cyber risks in the future.
Preparing for the Future
As full implementation approaches in 2027, organizations operating in Japan should take immediate steps to:
Conduct cybersecurity risk assessments
Update incident response and reporting protocols
Align internal governance with ACD Law requirements
Collaborate with legal experts to create compliance frameworks
Within this context, businesses may improve their resiliency in a digital disruption era by embracing these changes as a set of strategic security practices, as opposed to regulatory requirements.
English