What it is
Japan’s Ministry of Internal Affairs and Communications (MIC) published its Guidelines on Technical Measures for AI Security on 27 March 2026. The text came from the AI Security Subcommittee set up in September 2025 under MIC’s Cybersecurity Task Force. Public comment ran from 26 December 2025 to 29 January 2026 and drew 52 comments.
It is voluntary: a guide for each organization to choose reasonable measures for its own situation. It targets AI developers and providers as defined in the AI Guidelines for Business, covers LLM-based systems, and excludes AI agents for now. The Cabinet Office lists it among the ministry guidelines tied to the Article 13 guideline.
Threats covered
- Prompt injection, direct and indirect, including attempts to extract RAG data or system prompts, or to generate malicious SQL or commands.
- Denial of service: excess computation, runaway tool calls, API quota exhaustion.
- Data poisoning of training, fine-tuning, or RAG data.
- Tampered models and model extraction.
Measures recommended
- Developers: safety training so models prioritize system prompts.
- Providers: harden system prompts and keep no secrets in them; guardrails on inputs, external data, and outputs; least privilege for orchestrators and RAG components.
- Baseline: audit logs, rate limiting, provenance checks.
- Red teaming.
- Worked examples: an internal RAG chatbot and an external chatbot.
Where to find it
MIC’s press release of 27 March 2026 links the guideline PDF and the public comment results. We found no English version.
Reuse terms
We did not verify MIC’s website terms on a page we opened. Other ministries apply PDL1.0-based terms, but confirm MIC’s own terms before reproducing the guideline at length, and label any English summary as an unofficial translation.
Applying it to RAG systems
- Treat retrieved documents as untrusted input and screen them for injected instructions.
- Keep secrets out of system prompts.
- Apply least privilege to retrieval and tool access.
- Verify data provenance before indexing, to limit poisoning.
- Log queries and retrievals, and rate-limit to prevent abuse.
- Red-team the RAG pipeline with indirect injection tests.
Common mistakes
- Assuming guardrails on user input alone stop indirect injection through documents.
- Indexing unvetted external content.
- Applying the guideline to AI agents without noting that agents are out of scope for now.
- Quoting the guideline at length without checking MIC’s terms.
Checklist
- Retrieved content screened for injection
- No secrets in system prompts
- Least privilege on retrieval and tools
- Provenance checks on indexed data
- Audit logs and rate limits
- Red-team results recorded
How AskDona helps
AskDona checks your AI security policies and system design documents against the guideline’s measures and cites the measure and your document section for each gap.
Run a sample AI security guideline check
AskDona shows the evidence; your security team decides.
Editor’s note. This article is general information, not legal advice. The “conditions to check” rating comes from our source list and is a first-pass judgment, not a legal opinion.
FAQ
When was Japan’s AI security guideline published? 27 March 2026, by MIC.
Is it mandatory? No, it is voluntary.
Does it cover RAG? Yes. It addresses prompt injection and poisoning of RAG data and gives an internal RAG chatbot example.
Does it cover AI agents? Not yet; agents are excluded for now.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| MIC: Press release, 27 Mar 2026 | Publication, comment period, 52 comments |
| MIC: Guideline text (PDF) | Threats, measures, scope, voluntary nature |
| Cabinet Office: AI guideline page | Listed with the Article 13 guideline |