On 1 October 2026, the core of Japan's Act No. 42 of 2025, known as the Cyber Response Capability Enhancement Act or the Active Cyber Defense law, took effect. From that date, designated critical infrastructure operators must report cyber incidents affecting their most important systems to their sector minister and the Prime Minister. They must also notify the government of the products and versions those systems run, and the Act gives ministers a channel to push vulnerability information and requests to the vendors who supply them.
What's affected
Who reports. The Cabinet Office's September 2026 briefing covers critical infrastructure operators in 15 sectors, 258 operators in total. Named sectors include finance, airports and aviation, electricity, water, telecommunications, gas, oil, railways, trucking, ocean shipping, port transport, broadcasting, postal services and credit cards.
What they report. Under Article 5, an operator must report when it becomes aware of a cyber incident on a "specified critical computer," or of an event that could cause one. The Cabinet Office explainer gives examples such as malware execution and unauthorized access. For the most critical category of systems, attempted attacks must be reported whether they succeeded or not.
Deadlines, per the Cabinet Office's October 2026 explainer on the reporting system:
- Preliminary report: DDoS incidents as soon as possible after awareness. Ransomware and other attacks within 3 to 5 days of the day the operator became aware.
- Detailed report: within 30 days of awareness.
The clock starts when the incident is reasonably judged to meet the criteria, not at the first alert. The explainer warns that awareness often starts outside the operator, for example at a cloud provider or an outsourced monitoring firm. It advises operators to check SLAs, cloud terms and outsourcing contracts for how those parties will notify them.
Asset notification. Operators must notify the product names of specified critical computers. Systems already in place on 1 October 2026 are due by 31 March 2027. New ones are due within four months of introduction. The explainer stresses version information: without it, the government cannot narrow the vulnerability information it sends back. The government plans to match these notifications against vulnerability data, including unpublished data, and alert affected operators directly.
What it means for vendors. Article 42 lets ministers give vendors of computers and programs, including those offered as a service, information about vulnerabilities in their products. For products used as specified critical computers, the minister responsible for the vendor's industry can request that the vendor take the measures needed to prevent damage. Ministers can also ask vendors for reports or materials about products they supplied. Vendors "must endeavor" to comply with those requests, an effort duty rather than a hard order. Article 42 applies to vendors outside Japan that supply products into Japan.
The explainer also says a system can count as a specified critical computer even when a vendor, a group company or a cloud provider owns it, as long as the operator uses it in its business.
Does this apply to you?
- You are one of the designated operators. Reporting has applied since 1 October 2026, and asset notification for existing systems is due by 31 March 2027.
- You sell software, appliances or cloud services that a designated Japanese operator uses in critical systems. Your customer will ask you for product names and versions, and for prompt incident notification. You can also receive vulnerability information and requests from a Japanese ministry under Article 42, even if you are based abroad.
- You run monitoring, operations or hosting for such an operator. You may be the first to see an incident, which starts the operator's clock. Expect contract changes on notification.
- You sell only to non-designated Japanese companies. No new reporting duty. The Cabinet Office explainer encourages voluntary reports in some cases.
What to do now
- Now: if you serve designated operators, confirm who in your company receives incident notifications from them and who notifies them. Set an internal target well inside their 3 to 5 day window.
- By 30 November 2026: prepare an exact product and version list for each deployment at those customers, including firmware, middleware and appliance versions. They need it for their 31 March 2027 filing.
- By 31 December 2026: review your SLAs and terms with those customers. Add a defined notification time for security incidents that could affect their systems.
- By 31 March 2027: support the asset notification. Answer version questions quickly and keep the list current, since changes trigger further filings.
- Ongoing: designate a contact for vulnerability information or requests from Japanese ministries under Article 42, and decide in advance who can commit to remediation timelines.
Why it matters
The design is simple: the government learns what software runs in critical infrastructure, down to the version, and uses that to target alerts. The quality of that loop depends on accurate version data, which mostly comes from vendors.
For vendors, two things change. Customers will expect version-level inventories and fast incident notice as a contract term. And a government can now come directly to you about a flaw in your product used in Japanese infrastructure. Knowing which of your products and versions contain a vulnerable component, before anyone asks, is the preparation that pays off in both cases.
Try it yourself
For one product you sell into Japan, list every component and version in the build you shipped most recently. Then check whether you could tell a customer, within a day, which of their deployments run a version affected by a newly published CVE.
Click through it at your own pace, or open it full screen.
Quick check
How fast must a designated operator file a preliminary report for a ransomware incident?
Within 3 to 5 days of the day it became aware of the incident, according to the Cabinet Office explainer. A detailed report follows within 30 days.
When are asset notifications due for systems that were already in use on 1 October 2026?
By 31 March 2027, six months after the law took effect. Newly introduced systems are due within four months of introduction.
Can a Japanese ministry contact a vendor based outside Japan about a vulnerability?
Yes. Article 42 lets ministers provide vulnerability information and request measures from vendors, and it applies to overseas vendors supplying products into Japan. Vendors must endeavor to respond to requests for reports or materials.
Sources
- Cabinet Office: Enforcement of the Cyber Response Capability Enhancement Act (September 2026, PDF, Japanese)
- Cabinet Office: Explainer on asset notification and incident reporting (October 2026, PDF, Japanese)
- House of Councillors: Act No. 42 of 2025, full text (PDF, Japanese)
- Cabinet Office: Cyber security policy page (Japanese)
