EU AI Act for Japanese Companies: How Article 2 Reaches You

A Tokyo SaaS company whose AI credit-scoring model is used by a lender in Frankfurt is bound by the EU AI Act — even though Japan's own AI law is deliberately light-touch and imposes no equivalent obligations. This is the disconnect Japanese companies most often miss. The EU AI Act is not Japanese law and never becomes Japanese law; there is no Japanese application date. But Article 2 of Regulation (EU) 2024/1689 gives the Act deliberate extraterritorial reach, and it catches Japanese providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union. Japan's innovation-first stance at home does not lighten the EU obligations abroad.

---

Japan is a third country: the Act never becomes Japanese law

Japan is not an EU Member State and not part of the European Economic Area (EEA). There is no transposition route, no EEA incorporation, by which the EU AI Act enters Japanese law. So for a Japanese company the only question that matters is the extraterritorial one: does your activity bring you within Article 2?

Japan's AI Promotion Act is light-touch — it is not an EU-style risk regime

Japan enacted the Act on the Promotion of Research and Development and Utilization of AI-Related Technologies (the "AI Promotion Act") in May 2025, with most provisions in effect from June 2025. It is a deliberately "innovation-first," principles-based framework: it sets out the state's role and broad principles, promotes voluntary risk mitigation, and relies on existing sector law — it does not create binding, EU-style high-risk classifications, conformity assessments, or turnover-based fines. Japan's approach is reinforced by non-binding METI guidance (the AI Guidelines for Business, issued with the Ministry of Internal Affairs and Communications and updated in 2025). The practical effect for compliance teams: complying with Japan's framework does not, by itself, satisfy any EU AI Act obligation.

Japan's framework and the EU AI Act run in parallel

A Japanese company selling AI into the EU faces both regimes at once. Japan's soft-law model imposes principles and voluntary measures at home; the EU AI Act imposes binding, role-based duties on the EU market. None of Japan's framework discharges the EU AI Act, and the EU AI Act does not discharge Japan's framework — treat the Japanese side as a matter for separate Japanese counsel.

---

Article 2: the two limbs that catch Japanese companies

Article 2 sets the Regulation's scope, and it is written to reach beyond EU borders so that non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. A Japanese company that sells, licenses, or otherwise makes its AI product available to customers in Germany, France, or Ireland is caught — incorporation in Tokyo and servers in Osaka change nothing.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. The test is where the effect lands, not where the company or server sits. A Japanese company whose model scores, ranks, or generates content about people in the EU is caught on this limb even with no EU customer contract.

The authorised-representative obligation (Article 22)

A Japanese provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22. This is a designated in-Union point of contact and accountability — structurally similar to the EU-representative requirement Japanese firms may already meet under the GDPR, but a separate appointment under a separate statute.

---

Timeline: the EU dates apply to in-scope Japanese companies

There is no separate Japanese date. A Japanese company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

Under the Digital Omnibus, stand-alone Annex III high-risk obligations were moved from 2 August 2026 to 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2027 to 2 August 2028. The Omnibus is law: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. Both dates are now in the statute — plan against 2 December 2027 and 2 August 2028.

What did not move

The co-legislators adopted fixed dates instead of the Commission's November 2025 "stop the clock" proposal. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51–55 since 2 August 2025. For Japanese foundation-model and GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope Japanese companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any Japanese transposition, an in-scope Japanese provider or deployer faces the same role-based duties as an EU company. There is no Japan-lite version. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. A Japanese company that fine-tunes a base model into a new high-risk purpose, or rebrands a high-risk EU tool, can inherit the full provider stack without realising it.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or Japanese revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); up to €15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to €7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. Separately, GPAI model providers are fined by the Commission under Article 101 (up to €15 million or 3%), not under Article 99. The contrast with Japan's own regime is stark: where Japan's AI Promotion Act carries no turnover-based fines, the EU market exposes the same company to the Article 99 ceilings.

---

Worked example: a Tokyo fintech selling AI credit-scoring into the EU

Kintsugi K.K. is a roughly 150-employee Tokyo fintech with around ¥3.2 billion in annual revenue. It sells an AI model that scores the creditworthiness of loan applicants, and two of its customers are lenders in Germany and Ireland.

Why Kintsugi is in scope now

As a provider placing the system on the EU market, Kintsugi is in scope under Article 2(1)(a) today — no EU office is required, and the absence of a European entity is irrelevant. Its tool is high-risk under Annex III point 5(b) (creditworthiness assessment and credit scoring of natural persons), which triggers the full provider stack under Articles 9–15. Even where Kintsugi has no direct EU contract, Article 2(1)(c) can catch it where the model's output is used to score applicants in the Union.

Kintsugi's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Because this is a creditworthiness system, Kintsugi's EU lender-deployers owe an Article 27 Fundamental Rights Impact Assessment — build the documentation to support theirs.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier; as an SME, Kintsugi benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of revenue is the operative ceiling, not the €15 million figure.
• Keep Japanese obligations — the AI Promotion Act's principles, the METI AI Guidelines for Business, the Act on the Protection of Personal Information — running in parallel; the EU file does not discharge them, and vice versa.

---

What Japanese companies should do now

Map your EU exposure, not your Japanese status

Do not start from "what does Japan's AI law require?" — its light-touch framework imposes far less than the EU regime, and that gap does not reduce your EU exposure by a single obligation. Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, fine-tune, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your Japanese obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: the Commission guidance and harmonised standards that will shape how the EU high-risk requirements are met (the Article 6 classification guidelines are still in draft, and no harmonised standard is yet cited in the Official Journal), and any tightening of Japan's own framework beyond its current light-touch model — which may add Japanese obligations but will not displace the EU AI Act's extraterritorial reach.

---

How Confir helps Japanese companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to give a Japanese company an EU-market compliance file that stands on its own, separate from whatever Japanese obligations apply. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

Related guides

• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act for US companies: Article 2 reach
• EU AI Act scope explained (Article 2)
• EU AI Act high-risk classification (Article 6)
• EU AI Act deadlines and application dates