Japan's Digital Agency has published the Gennai Standard on governance, security and safety for AI agents intended for about 180,000 government staff

What is the Gennai Standard, and does it bind anyone?

It is a Digital Agency standard for "Government AI Gennai", the AI environment the Agency runs for central government staff. The announcement says it sets out the basic approach and compliance items expected of the people involved, and that it was prepared with the cooperation of the AI Safety Institute. The standard itself (「源内基準」, Gennai Kijun) is dated October 2026, version 1, with initial publication on 20 October 2026.

On who it covers, the standard says it was written for Gennai as provided by the Digital Agency itself (the "Digital Agency-hosted" model). A ministry that runs its own self-built environment is responsible for its own rules, and the standard says it was written for the hosted model, not for that case. It names three roles. Users are central government staff, plus legislative and judicial staff and independent administrative agency staff who wish to use Gennai. Administrators are ministry AI officers, ministry-wide management offices and system administrators, designated by each ministry. Developers are Digital Agency staff, including contractors working on Gennai.

The Agency says municipalities and private firms considering AI agent environments can use the standard as a model for balancing safety and effective use. That is an invitation to reference it, and the source states no obligation or penalty for outside organisations. The Agency's own words on the role split: 「利用者」「管理者」及び「開発者」それぞれの立場に応じた責務・遵守事項を明確にしています。

What is the Digital Agency rolling out, and on what dates?

The Agency announced on 20 October 2026 that it is starting two AI agent environments in Gennai for about 180,000 government staff. Agent Chat is an environment for creating and running AI agents easily, and it is being introduced to ministries in sequence from that day. Gennai Kobo is an environment for building and running advanced agents, and the Agency is aiming to introduce it by about December 2026.

The Agency also plans to release both environments as open-source software, "Gennai OSS Ver. 2.0", around February 2027, under a licence that allows commercial use, so that municipalities and companies can use, modify and redistribute it. Version 1.0 of Gennai OSS was released in April 2026, according to the Agency's summary slides. The Agency says its own survey found that deploying an environment comparable to advanced AI coding agents as a common government platform for general staff, at the scale of about 180,000 people, is a world first. That is the Agency's claim, which we have not tested.

What does the standard ask of users, administrators and developers?

Users. The Agency's summary slides list principles that include keeping a human in the loop at suitable stages, not copying AI output that staff have not reviewed into administrative documents or official records, checking important information against primary sources, watching for prompt injection, using risk-based judgment for agents, and not using unapproved "shadow AI" for work. On personal information, AI searches for individuals are limited to what the assigned duty needs, and the slides say not to use AI to infer beliefs a person has not stated or to predict future behaviour.

Administrators. The standard says administrators are responsible for organisational controls and cannot rely on individual users' care alone. It suggests user education, risk awareness, periodic risk assessment and incident procedures. For work that affects people's rights and interests, such as licensing, benefits, adverse dispositions and hiring, it directs administrators to take a risk-based approach and to restrict Agent Chat use as appropriate. The Agency says it is considering a future "tenant administrator function" to let ministries suspend use quickly.

Developers. The standard separates development and production environments and keeps permissions and responsibilities to the minimum needed. Changes to production need prior approval by a person with decision authority, with the evidence recorded, and review by another developer. Human access to logs containing user inputs and outputs is to be avoided in normal times and, where unavoidable, approved in advance and limited in scope and time.

What controls does the standard describe for Agent Chat and Gennai Kobo?

The standard describes the controls as they stand in October 2026. For Agent Chat: users see a notice by pop-up and can use it only after agreeing; each user has a personal workspace with a size limit; the agent can overwrite or delete only files the AI itself created, and when it changes an uploaded original it works on an automatic copy; uploaded files are security-scanned, though the standard says scanning does not completely eliminate unknown threats; tools run only inside the user's own workspace; the agent cannot operate the user's local PC or reach APIs or MCP servers the developers do not manage; and web search is processed inside the government cloud.

For Gennai Kobo, which gives more freedom, use is switched off by default. An administrator grants access on application from staff confirmed as meeting a set literacy level; a literacy check provided by the developers is given as an example of how to confirm this, to be used as needed. Outbound data writes (POST and PUT requests) are blocked at system level; web search requests (GET) are allowed but logged by destination, volume and time; inputs, outputs and external communications are logged in a tamper-resistant form; and developers can suspend a user's access if a security problem, rule violation or misuse is suspected. The Agency's slides also flag the risk that long autonomous runs of dozens to hundreds of steps and direct web access could allow unintended leakage through supply-chain contamination.

What should governance, security and risk leads do with it?

What it means for them. Suppliers to Japanese government AI projects, and teams that have to show how agents are controlled, now have a published government reference for the controls specified for hosted Gennai. Because the standard applies to the Digital Agency-hosted Gennai, we would not read it as a rule for a vendor's own product. It is a benchmark, and the source says nothing about procurement requirements.

What to do now.

• Read the Agency summary slides first, then the agent sections of the standard (Agent Chat, Gennai Kobo, administrator duties) in the original Japanese or through a checked translation.
• Compare your own agent permissions with the controls above: for Agent Chat, consent before use and working on copies of original files; for Gennai Kobo, blocked outbound writes and tamper-resistant logs.
• Decide which agent tasks need a named human approval point, using the standard's rights-affecting work category as one reference.
• If you supply Japanese public bodies, ask the buyer which parts of the standard it expects you to meet, since the source does not say.

What we did not verify

What we opened on 24 October 2026: the Digital Agency announcement page, the Agency's summary slides dated 20 October 2026, and the full text of the Gennai Standard, version 1 (October 2026), all in Japanese.

What we did not open: the third attachment on agent introduction beyond its listing, the underlying policy documents the standard cites (the AI Act, the Basic AI Plan, the AI procurement and use guideline), and any English translation. We did not test the Agency's world-first claim, the system controls themselves, or how many staff actually have access. We rely on the standard's own wording for each control and have not checked it against the running system.

What we refuse to claim: that the standard binds private firms or municipalities, that it carries sanctions, or that AISI endorsed its content beyond the Agency's statement that it cooperated in preparing it. Dates for Gennai Kobo and Gennai OSS Ver. 2.0 are the Agency's targets, not commitments.

Related briefings

• AI Regulation News hub
• Asia-Pacific AI regulation tracker
• Digital Agency DS-920 guideline on government use of generative AI
• Japan AI Guidelines for Business version 1.2 on agents and physical AI
• Japan AISI AI safety evaluation guide version 1.20 on agents
• Japan Phase 2 AI Basic Plan