Japan Finalizes Implementing Regulations for Revised FEFTA Foreign Investment Screening Regime (Part 2 of 2)

Changes to Prior Notification Requirements for Information and Communications Technology (ICT) Investments

On September 16, 2026, Japan’s Ministry of Finance (MOF) announced the promulgation of the cabinet order, ministerial order and public notices implementing amendments to the Foreign Exchange and Foreign Trade Act (FEFTA) promulgated in June 2026.

Our previous client alert covered the amendments when the implementing regulations were still draft proposals open for public comment. The implementing regulations were finalized and promulgated on September 16, 2026. MOF also published responses to public comments (“Public Comment Responses”).

This Part 2 alert focuses on the finalized changes affecting prior notification requirements for ICT investments.

The amended FEFTA and its implementing regulations generally take effect on January 4, 2027. However, many provisions, including the new indirect investment rules and prior notification requirements based on the revised designated sectors and specified technologies, are subject to a 30-day transitional period and will apply to investments made on or after February 3, 2027.¹

Recap Summary of Part 1

Part 1 covers:

1. Indirect investments, including foreign-to-foreign M&A through Direct Holding Entities (50% or more of voting rights; for high-risk investors, 1% or more of a listed company or any percentage of an unlisted company);
   
   
2. The statutory framework for mitigation measures;
   
   
3. Domestic investors under foreign government control or influence;
   
   
4. Post-investment intervention powers for high-risk investors in non-designated sectors (10% or more, applying from January 4, 2027 with no transitional period); and
   
   
5. Interagency review and the Japan Foreign Investment Committee (JFIC).
   
   

Part 2 Key Takeaways

• Current ICT sector designations will be significantly streamlined. Software and information processing services, previously designated broadly as requiring prior notification, will be covered by an enumerated list of products and services for which screening is considered necessary on national security grounds.
• One of the key areas is AI. Its coverage to prior notification regime will focus on AI infrastructure software, in-house machine-learning models (including foundation and specialized models), and AI support tools such as retrieval-augmented generation (RAG) and training-data tools. User-interface or API-layer applications that merely enable the use of third-party AI are, in principle, outside the prior notification regime. To this end, MOF has indicated that it will consider publishing concrete examples of products and services subject to the designated sectors. We expect and hope that MOF will publish Q&A with concrete examples before the February 3, 2027 application date. Until then, investors should document their analysis and consider pre-filing consultation with MOF or the relevant ministries where the scope is unclear.
• Screening will also consider whether a target company holds specified sensitive technologies, in addition to its business sector. A company holding certain export-controlled technologies may be subject to stringent prior notification screening comparable to that applicable to core sectors, even if its business otherwise falls outside the designated sectors. Technology investments will therefore require a more detailed assessment of the target’s products, services, data, AI technologies and export-controlled technologies, rather than relying solely on classifications under the Japan Standard Industrial Classification.

For purposes of this alert, “Amended Act,” “Amended Cabinet Order” and “Amended Ministerial Order” mean, respectively, FEFTA as amended, the Cabinet Order on Inward Direct Investment, etc. as amended, and the Order on Inward Direct Investment, etc. as amended. References to the “Sector Designation Notice” mean the public notice designating business sectors under Article 3(4) of the Amended Ministerial Order, and references to “the MOF Material” mean the overview material on the amendments published by MOF on September 16, 2026.

Implementing Regulations and Their Impact on ICT Investments

1. Narrower Notification Requirements for General Software and SaaS Businesses

The revision of designated ICT activities is likely to have the most direct effect on ordinary foreign investments, particularly investments in startups and technology companies.

Previously, software businesses, other than certain activities such as gaming software, and information processing services were broadly designated. As a result, investments in general SaaS businesses and software startups often required an assessment of prior notification requirements even where their activities were not particularly sensitive from a national security perspective.

The amendments focus ICT sector designations on activities for which screening is considered necessary from a cybersecurity or other national security perspective. MOF has explained that designated software and information processing services will be limited to an enumerated list covering activities relating to critical infrastructure and goods under the Economic Security Promotion Act, and activities involving the handling of large volumes of personal information or technical information protected as corporate trade secrets. Other activities will be treated as non-designated, unless another designation applies.²

Specifically, the broad entries for software and information processing and provision services within the information and communications category in Appendix 2 to the Sector Designation Notice, have been deleted and replaced by the enumerated activities in Items 12–30 of Appendix 1 to the Sector Designation Notice. Activities falling within core sectors generally retain their existing treatment, given the continuing need for screening from a cybersecurity and related perspectives.

Accordingly, prior notification is expected to become unnecessary in a substantially greater number of investments in general business SaaS providers and application developers that do not conduct any enumerated or other designated activity, and do not hold the specified important technologies discussed below. The assessment must nevertheless consider the actual products and services, rather than the labels used to describe the business.

Two categories are particularly relevant in practice: software and information processing services specifically designed to handle the personal information of one million or more individuals,³ and certain AI and advanced robotics technologies.⁴

For the one-million-individual threshold, MOF confirmed that its interpretation under the Bank of Japan's FEFTA Q&A published in November 2025 remains unchanged. The rationale for this threshold is not limited to sensitive personal information: large-scale leaks could be used to control or influence individuals’ behavior and could impair national security. Software or services not designed or developed for the handling of personal information of one million or more individuals do not fall within this category solely because they are technically capable of processing information at that scale.⁵ If handling personal information at that scale later becomes concrete, prior notification seeking consent to a change of business purpose would be required.⁶

Public Comment Responses ⁷ clarify that designation for AI and advanced robotics technologies is directed at business establishments holding AI technologies, broadly in three categories:

1. (Programs that make the use of GPUs and other hardware required for AI development more efficient by implementing control and basic functions, including AI-specific hardware control, virtualization and operating systems, but only where the hardware is evidently intended principally for AI development;⁸
   
   
2. Programs that realize machine-learning algorithms created through research and development, including foundation models and specialized or individual models; ⁹ and
   
   
3. AI support tools created through research and development that directly affect and enhance machine-learning outputs, including RAG and other common AI support functions, improve the efficiency of shaping, classifying and processing training data input into machine-learning algorithms, or directly streamline or promote others’ research and development on machine-learning algorithms.¹⁰

By contrast, developing or modifying a user interface or similar program so that others can use AI technology not developed in-house is, in principle, outside designated sectors. MOF indicated that programs that merely call a third party’s machine-learning algorithm, including through an API, are generally outside designated sectors, because they enable use of AI technology the business did not develop, although this should be determined case by case based on the facts. Although the commenter referred to METI’s Innovation Box tax regime guidelines and proposed express exclusion language in the notice, MOF did not amend the notice text. The clarification therefore rests on the Public Comment Responses.

In practice, applications built on third-party foundation models (including “wrapper” applications) should in principle be outside designated sectors, but businesses that fine-tune or develop their own models, build proprietary RAG or data-preparation tools, or develop AI infrastructure software should carefully assess whether they fall into a designated sector. The boundary, including in cases involving significant fine-tuning or proprietary orchestration, remains fact-specific.¹¹

MOF further responded that it would consider publishing concrete examples of products and services subject to the designated sectors. We expect and hope that MOF will publish Q&A with concrete examples before the February 3, 2027 application date. Until then, investors should document their analysis and consider pre-filing informal consultation with MOF or the relevant ministries where the scope is unclear.

2. Other Measures to Reduce Procedural Burdens

Alongside the narrower designation of software and information processing services, the amendments streamline other prior notification requirements. In principle, the reappointment of an officer or equivalent person whose initial appointment was subject to prior notification will not require a fresh notification if there are no prescribed changes to matters such as the foreign investor’s characteristics, the designated activities of the issuer and its subsidiaries, the officer’s nationality and concurrent positions, or the investor’s policy on involvement in management.¹²

Notification requirements will also be streamlined for certain transactions that are, in substance, internal group reorganizations involving a Japanese company’s wholly owned overseas subsidiary, and for certain passive increases in existing shareholders’ voting rights percentages from share repurchases.¹³

At the same time, the information required at the initial filing stage will be expanded. Information requested through questionnaires after acceptance of a notification will instead need to be submitted as supporting documentation with the filing.

This includes the businesses and principal counterparties of the investor and target; officers’ nationalities and dates of birth; foreign government investments and subsidies; and, for funds, the general partner, assets under management, principal investments and investment decision-making process. The investor’s assessment of the target will also be required.¹⁴

3. A New Focus on Technologies Held by the Target

While narrowing ICT sector designations, the amendments introduce an additional basis for prior notification that focuses on the technologies held by a company, to ensure that companies holding important technologies remain within the screening regime.¹⁵

A new joint public notice, No. 4 of 2026, issued by the Cabinet Office and the relevant ministries (the “Joint Public Notice”), designates certain technologies relating to the design, manufacture or use of items covered by entries 1–15 of the Appended Table to the Foreign Exchange Order, as well as “important controlled technologies” relating to entry 16 of that table. Please refer to the Joint Public Notice for details but note they are “list controls” reflecting international export control regimes such as weapons-related items, advanced technologies or sensitive technologies.

The Public Comment Responses clarify that the new notice concerning “technologies or information” designates only technologies, and no information has been designated. Whether an entity “holds” a technology is assessed substantively, including by reference to its actual use in the entity’s business or research and development, rather than merely the formal existence of a license.¹⁶ MOF also decided not to separately designate corporations “holding” those technologies (e.g., licensees of those technologies) and deleted that provision from the final notice.

Practical Implications for Due Diligence

For M&A, venture investments and other transactions to be completed on or after February 3, 2027, investors should assess the target and its subsidiaries beyond their traditional sector classifications.

Due diligence should address:

• Specific uses of their software and services
• Scale of personal information handled
• Whether the target develops its own machine-learning models or AI support tools, including RAG or training-data tools, versus merely using third-party AI through an API or user interface
• Holding of sensitive technologies or important controlled technologies under the Foreign Exchange Order