Japan's Gennai Standard: Rules for Government AI Agents

On 20 October 2026, Japan's Digital Agency opened two AI-agent environments inside Government AI Gennai, its in-house generative-AI platform, to about 180,000 government staff. The same day it published the Gennai Standard, a governance, security and safety rulebook covering three roles: users, administrators and developers. Its core model is clear: agents can run multi-step tasks, but a civil servant checks the result, approves important actions, keeps logs and bears final responsibility. The Agency presents the standard as a reference for local governments and companies considering AI agents. This article explains what it requires, what it does not yet prove and what private teams can learn from it.

Background and scope

The rollout follows the cabinet's Second AI Basic Plan, approved on 14 July 2026, which asks the government to lead by example and to build rules for AI agents. The Digital Agency's Priority Plan of 21 July 2026 calls for a FY2026 demonstration across all ministries to assess cost-effectiveness and performance against other commercial LLMs, with full-scale use considered from FY2027.

Two agent environments, one phased rollout

Agent Chat lets staff create and run agents through a conversational interface. The Agency began rolling it out to ministries on 20 October 2026.
Gennai Kobo is a more advanced environment for building agents, with a target of around December 2026. Under the standard, access requires a literacy check and confirmation by an administrator.
Gennai OSS Ver.2.0, which local governments and companies may use, modify and redistribute under a commercial-use licence, is targeted for around February 2027.

The Agency describes deploying an environment of this kind to roughly 180,000 staff as a world first. That is the Agency's own assessment, not an independent verification.

Three roles, three sets of duties

Users: the final decision stays human

Civil servants must understand the content, basis, limits and risks of AI output before acting on it. The presentation summarising the standard lists several rules: do not copy unverified output into official documents; keep human-in-the-loop checks for important processing; do not use unapproved generative-AI services, the so-called shadow AI; and do not use AI to infer beliefs a person has not expressed, predict their future behaviour or aggregate information about individuals from several sources.

Administrators: governance sits in each ministry

Each ministry has administrators, including its chief AI officer (CAIO), who handle internal governance, usage and cost monitoring, system restrictions and safe operation. The presentation also gives the control and recording of AI use in administrative procedures a section of its own.

Developers: separated duties and audit trails

The developers who run the platform are held to the same logic applied to production software: separated development and operating permissions, approved production changes, reviewed deployments and dataset changes, least privilege, tamper-resistant audit trails and a rapid response to vulnerabilities and security incidents.

Risk-based controls for agent use

The presentation's risk table makes the difference between the two environments explicit:

Area	Agent Chat	Gennai Kobo
Main risks named	Wrong decisions chaining through later steps; accidental deletion or overwriting of files; misleading output; improper handling of confidential data	Code errors, unintended actions and insecure apps; direct web access and runs of tens to hundreds of steps, which could leak information through supply-chain contamination
User duties	Do not over-trust output; limit scope; verify figures and sources; back up critical files before file operations; approve important decisions and external communications	Understand the level of autonomy; check actions and outputs before execution or publication; stop and report anomalies
Access condition	Warning pop-up that must be accepted before use	Literacy check and administrator confirmation

The presentation also says that work affecting citizens' rights should follow a risk-based approach, and that users must assess the risk level and escalate likely high-risk uses to the CAIO. The standard also contains data-classification rules (section 1-5) that this article does not discuss, because the review covered the presentation rather than the full standard text.

What private teams can take from it

The Gennai Standard is most useful as a checklist of decisions to make before an agent touches real work. SignorCrypto's reading:

Name an accountable person for each agent workflow. The principle in the standard is that whoever approves the output owns the outcome.
Classify tasks by risk, and require human approval for decisions with external effect and for outbound communications.
Scope the rights: limit file operations, network access and the length of autonomous runs, and require backups before destructive changes.
Log use and protect the logs, so that a chain of agent actions can be reconstructed.
Keep a way to suspend an agent quickly, and review the reusable procedures, called skills, that it runs before they spread between teams.

These are analytical recommendations drawn from a government rulebook. They are not legal advice and do not replace a risk assessment for your jurisdiction and sector.

Open questions and limits

Binding status. The Gennai Standard governs Government AI Gennai. It is not a statute and does not bind private companies.
Evidence of effect. No public data yet shows error rates, productivity gains or incident counts from the rollout. The FY2026 demonstration is meant to produce them.
Dates are targets. The December 2026 and February 2027 dates are official targets and may move.

FAQ

Does the Gennai Standard apply to companies?

No. It sets rules for Gennai users, administrators and developers. The Minister for Digital said at his 20 October 2026 press conference that it could serve as a reference for local governments and companies designing their own AI governance.

Why do the rules focus on approvals and logs?

Agents chain many steps, and the presentation warns that one wrong decision can propagate through later ones. Approval gates show where a human checked the work, and logs show how a chain of actions developed.

Sources

Next step

If your team is mapping which agent tasks it can delegate safely, Botchi (https://www.botchi.ai/) offers personal AI assistants and autonomous agents for business teams, a practical place to test agents on everyday team work before scaling them.