Vetting a Dev Vendor with Japan's AI Guidelines: 8 Questions
Summary: Japan's AI Guidelines for Business (Ver. 1.2, published March 31, 2026 by the Ministry of Internal Affairs and Communications and METI) are not a certification, but they make a good frame for questioning a vendor. This article turns them into 8 questions, describes what a good answer looks like, and gives VAON's own answers.
Contents
- What are the AI Guidelines for Business, and are they legally binding?
- Which role does a development vendor play in the Guidelines?
- Which 8 questions should you ask a vendor, and what does a good answer look like?
- How does VAON answer these 8 questions?
- How do you use this table in a vendor meeting?
- When is this question list not a good fit?
- FAQ
1. What are the AI Guidelines for Business, and are they legally binding?
The AI Guidelines for Business (AI事業者ガイドライン) are published jointly by the Ministry of Internal Affairs and Communications (MIC) and the Ministry of Economy, Trade and Industry (METI), and they are not legally binding. The document itself calls them "non-binding soft law". The latest version at the time of writing is Ver. 1.2, published March 31, 2026. Before it came Ver. 1.1 (March 28, 2025) and Ver. 1.0 (April 19, 2024).
That decides how you can use them. A vendor cannot be "Guidelines-certified", because no certification scheme comes with the document. What you can use is the frame: ten common principles (human-centricity, safety, fairness, privacy, security, transparency, accountability, education and literacy, fair competition, innovation) plus a section on building AI governance. So when a vendor says "we comply with the Guidelines", ask which part, and where the evidence is.
Our article on AI governance, ISO standards and the EU AI Act compares the Guidelines with international frameworks. This one goes the other way: it uses the Guidelines as a question list for choosing a vendor.
2. Which role does a development vendor play in the Guidelines?
The Guidelines define three roles: AI Developer (builds models and AI systems), AI Provider (embeds AI in applications, products or processes and supplies it to users), and AI Business User (a company using AI in its operations). A vendor building a system with AI features for you usually falls under AI Provider, and you are the AI Business User. The document's own footnote notes that real cases vary and one party can hold several roles.
| Role | What it does | Example when outsourcing |
|---|---|---|
| AI Developer | Builds models and AI systems | A company that makes a language model |
| AI Provider | Embeds AI in a service, integrates it with existing systems, supports operation | A vendor building a chatbot or AI-enabled system for you |
| AI Business User | Uses AI in business operations | The company placing the order |
A different case matters too: a vendor that does not put AI in your product but uses AI to write code. They are then a user of AI tools, and what you care about is how they control AI-generated code. The Guidelines carry a footnote on exactly this: when using code-generating AI, attention to the safety and security of the generated code is important. This topic continues in our pillar article on 12 pre-outsourcing checks and in who is liable when AI-written code has a defect.
3. Which 8 questions should you ask a vendor, and what does a good answer look like?
The eight questions below stick to what can be checked through documents and processes, not promises. The last column points to the matching part of Ver. 1.2.
| # | Question | A good answer | A warning sign | Reference |
|---|---|---|---|---|
| 1 | Who is accountable for AI use in my project? | A named person with a title, who takes part in the project | "The whole team is" | Accountability: naming the responsible person |
| 2 | How does the contract divide responsibility when AI makes a mistake? | A clear clause, including my side's part | The contract only mentions "quality" in general | Accountability: allocating responsibility between parties by contract |
| 3 | Which AI tools do you use, for what, and do you tell me when that changes? | Kinds of tools and stages listed, with a commitment to notify | "We use AI to be faster" | Transparency |
| 4 | Do my code and data enter AI tools, and who permits it? | Only with my permission; if not given, states what does not run | No policy, or "it's fine" | Privacy, security |
| 5 | Who reads AI-written code before release? | A second person, test scenarios, a checklist | "The AI already checked it" | Safety: human control |
| 6 | How is AI-generated code checked for security? | Automated gates (secret scan, dependency scan, static analysis) plus a human reader | Only "we care about security" | Security; the footnote on AI-generated code |
| 7 | Can I see the review and test records? | Yes, kept per change | Records are "internal" and not shown | Traceability; documentation |
| 8 | When a mistake is found, what is the process? | A defined process, with periodic reports that cover risks | No process, handled ad hoc | Accountability: responding to stakeholders |
Questions 1 and 2 are the ones most often skipped. People ask about technology and rarely ask "who is accountable" or "where is it written in the contract". In the Guidelines, those two sit in the accountability section.
4. How does VAON answer these 8 questions?
VAON answers from processes that are running today, and we do not claim to "comply" with the Guidelines. One by one:
- Accountability. CEO Dang Van Luan attends the 60-minute first meeting with every customer. CTO Doan Minh Hoang and a Tech Lead take part in every project. Each project has a single point of contact agreed from the start.
- Responsibility in the contract. Requirements are fixed in writing before building. Specific warranty terms and liability limits are discussed project by project; there is no standard figure to publish.
- Disclosure of AI use. Engineers use Claude Code and GitHub Copilot daily to re-read code, generate tests and sync documentation. A person checks before release.
- Data. No customer code or data goes into AI tools without permission. Where a customer has not permitted it, the AI review step does not run; only the automated gates and a human reader remain.
- Who re-reads. Every change goes through seven steps, including challenge by a second person, cross-check and team lead approval. The main branch is locked, so nothing merges without review.
- Security for AI code. On every pull request in every project: secret scan, dependency scan, static analysis (SAST). Engineers verify package names the AI suggests before installing. AI reviews the changed part and a person reads the result; AI supplements people, it does not replace them, and it raises false alarms. The process references NIST SSDF (SP 800-218) and the May 18, 2026 advisory to software vendors from NCO and METI. It is not formal compliance with any framework.
- Records. Review and test records are kept on every project and customers can see them.
- Handling mistakes. A weekly report covers progress, risks and decisions needed from the customer. Out-of-scope work goes through a change request: VAON quotes cost and schedule impact in writing, and the customer approves before work starts.
On certification: VAON does not hold ISO 27001 certification. Our information security rules are built on the ISO 27001 framework, set up by our CEO from his experience taking a 120-person company through that certification. We are ready to present our process and sign commitments on the customer's template.
"Who checks the code AI writes?" was one of the three questions customers asked us most in 2026, together with "can we ask before we have a spec?" and "who actually does the work, and do you swap people?".
5. How do you use this table in a vendor meeting?
Ask all eight questions of each vendor on your shortlist, then rate each answer on three levels: evidence shown, explanation without evidence, or no answer. Do not score how fluent the answer sounds. Score whether they can produce a document, a record or a contract clause.
Two more things to do. First, ask to see a real sample review record (with other customers' details removed) instead of listening to a description. Second, write the answers into the contract or an appendix, because what is said in a meeting binds nobody.
If you are comparing vendors in Vietnam, see also how to choose a development company in Vietnam, which covers capability and team-size questions separately.
6. When is this question list not a good fit?
This list does not replace technical and legal due diligence. The Guidelines are a voluntary frame; they do not assess code quality or any engineer's competence. Eight questions also leave gaps: nothing on price, schedule or industry experience.
Two more plain points. First, this article draws on the main text of Ver. 1.2 and its checklist; it is not a full reading of the appendix. Second, for a very small, low-risk project, all eight may be heavy. Start with questions 3, 4 and 5. And if a vendor refuses even those, that is information too.
7. FAQ
Are the AI Guidelines for Business mandatory for companies in Japan? No. They are non-binding soft law that encourages voluntary action. That does not mean you need not ask: other laws, such as the personal information protection law, apply separately, and the Guidelines give you a ready list of questions to put to a vendor before you sign anything.
Which is the latest version of the Guidelines? According to the page of the Ministry of Internal Affairs and Communications, the latest is Ver. 1.2, published March 31, 2026. Earlier: Ver. 1.1 (March 28, 2025) and Ver. 1.0 (April 19, 2024). Check the official page before relying on this, because the document is updated periodically and the 2026 revision shows the version can change within a year.
Is a vendor saying "we comply with the Guidelines" enough? No. No certification comes with the document, so the sentence only means something with specifics: which part, through which process, with what evidence. Ask using the table in section 3 and request real records.
Does VAON hold ISO 27001 certification? No. VAON's information security rules are built on the ISO 27001 framework, set up by the CEO from his experience taking a 120-person company through that certification. VAON is ready to present its process and sign commitments on the customer's template.
Which question should I start with if time is short? Start with question 4 (does data enter AI tools), question 5 (who re-reads code) and question 7 (can I see the records). These three show the difference between a vendor with a real process and one with only words, and each can be answered with a document rather than an opinion.
Building a vendor shortlist? Bring this 8-question table to a free 60-minute consultation with VAON's CEO. No documents needed, no obligation. Book a free 60-minute consultation
Sources
- MIC, "AI事業者ガイドライン" official page (read Oct 17, 2026): https://www.soumu.go.jp/main_sosiki/kenkyu/ai_network/02ryutsu20_04000019.html
- AI Guidelines for Business Ver. 1.2, main text, March 31, 2026 (Japanese): https://www.soumu.go.jp/main_content/001064279.pdf
- AI Guidelines for Business Ver. 1.2, Appendix 7 checklist (Japanese): https://www.soumu.go.jp/main_content/001064289.pdf
Author: Đặng Văn Luân, Founder & CEO, VAON. HEDSPI graduate (Hanoi University of Science and Technology). Worked at FPT Software, spent five years at Digital Plus in Tokyo on a system with 10 million users, then eight years as COO of a 120-person IT outsourcing company, building its ISO 9001 and ISO 27001 management system. 15 years in the industry.
