Japan METI updates AI governance guidelines: supply chain transparency now required for enterprise procurement

Japan's Ministry of Economy, Trade and Industry (METI) published version 3.0 of its AI Governance Guidelines on April 17, the most substantive update since the framework launched in 2022.

The headline addition is **supply-chain transparency**: enterprises procuring AI systems from third-party vendors must now obtain and document the following from their suppliers:

- Training data provenance (categories of data used, geographic jurisdiction of collection, any third-party licensed datasets) - Model capability disclosures aligned with the G7 Hiroshima AI International Code of Conduct - Incident reporting commitments (response timelines, notification obligations) - Human oversight mechanisms for high-impact deployment contexts

This affects procurement teams at Japanese enterprises buying AI software from domestic and international vendors. The guidelines do not impose obligations on the vendors themselves — but buyers are expected to contractually require the disclosures.

The update also formalises METI's position on **generative AI in the workplace**: enterprises are expected to publish internal AI usage policies, provide employee AI literacy training commensurate with the AI systems being deployed, and establish channels for employees to raise concerns about AI-mediated decisions.

**AIMenta take:** METI's supply-chain transparency requirement is a quiet but significant procurement shift. Japanese enterprises — particularly the large industrial groups that form our typical client base — will need to update their vendor evaluation playbooks. Any AI vendor that cannot provide clear training data provenance documentation will face increasing friction in enterprise procurement processes, regardless of product quality. This is a market-structure change that favours established vendors with clear data governance documentation over newer models with opaque training datasets.

The guidelines carry advisory rather than mandatory status, but METI typically converts advisory frameworks into mandatory requirements through sector-specific regulations within 18–24 months.