Japan Active Cyber Defence Act face to European CRA and NIS 2: Different weapons against same cyberthreats

Defence has traditionally been a matter of national sovereignty that reflects each country’s specific and evolving geopolitical position. This is the case for Japan, which has recently adopted an active defence approach against cyberthreats with the new Japan Active Cyber Defence Act. It differs from its previously enacted, more passive law: the Japan Framework Act on Cyber Security, which remains in force (since January 2015).  

Indeed, whereas this predecessor only formulated guiding principles (free flow of information, rule of law, openness, autonomy and multi-stakeholder collaboration) without imposing obligations, the new Japanese regulation subjects relevant operators to enforceable obligations under strengthened public-private partnerships, and endows Japanese authorities with central role, including powers to neutralise attackers, in line with the evolution of the Cybersecurity Strategy as presented by the Japanese Diet.  

Beyond a Japanese scope, the Act is particularly interesting from a comparative perspective, as the Japan Active Cyber Defence Act, in force from 1 October 2026 (“Japan Cyber Act”), takes the form of a national security regulation with a partly military dimension, to protect essential infrastructure and critical software and hardware, whereas the EU approaches the protection from an internal market perspective, with the Cyber Resilience Act (EU 2024/2847, “CRA”) and the Network and Information Security Directive 2 (EU 2022/2555, “NIS 2”).  

Considering reference to the CRA and NIS 2 made in the Japan National Cyber Coordination Office guideline aiming to raise “Japan’s response capabilities in the field of cyber security to a level equivalent to or higher than that of major Western countries”, it is interesting to see not exhaustively but dynamically, how, faced with the same cyberthreats, the Japan Cyber Act adopts a different approach from NIS 2 and the CRA regarding the target scope (1) and the authorities’ sanctioning and intervention powers (2). 

Different target scope 

The two regimes differ in scope, both as to the operators (A) and incidents covered (B).  

A. Difference in the operators targeted 

Under the Japan Cyber Act, the “primary” scope (so called because these operators are subject to obligations coupled with sanctions), consists of critical infrastructure operators (“CIO”) in 15 critical sectors (including telecom, water, electricity, finance and transportation), exhaustively designated under the law (currently 258) (Art. 1).  

On the contrary, NIS 2 does not designate entities by name: its scope encompasses “essential” and “important” entities, which share the same critical infrastructure as the CIO, identified by reference to sectors of criticality and high criticality, combined with a size threshold (Art. 2, 3, Annexes I, II).  

In addition, under the Japan Cyber Act, the “secondary” scope, so called because these operators have best efforts obligations that are not coupled with sanctions (such as submitting reports or following the authorities’ instructions upon detection of a vulnerability), consists of IT vendors supplying critical IT hardware and software (Art. 42). Japan’s intent to encompass, beyond CIO, the manufacturers, importers and distributors of digital products, provided these are critical, creates a similarity with the CRA scope. 

The CRA covers economic operators, including manufacturers, importers and distributors of digital products on the EU market, but regardless of their criticality (Art. 3).  

B. Difference in the incidents targeted  

Under the Japan Cyber Act, from 1 October 2026, CIO must report to the authorities any infringement incidents involving their critical IT, or any risk event that could lead to such incidents, "promptly" upon becoming aware of them (Art. 5). If no (or inaccurate) report is made, the government can also order the operators to do so (Art. 6, 7, 9). Both the nature of the incidents to be reported and the reporting timeline differ from NIS 2 requirements. 

Indeed, NIS 2 requires staged reporting obligations of significant incidents impacting critical infrastructure, with different levels of precision: within 24 hours of becoming aware, then 72 hours, then 1 month (Art. 23). Yet to be short, NIS 2 does not require reporting for mere risks of incidents. 

In addition, under the Japan Cyber Act, CIO must notify the authorities, by March 2027, of the product names and other details of all the critical IT they have already installed noting that a notification must also be submitted for any newly installed critical IT systems (Art. 4). The CRA contains no equivalent asset-information obligation, as it is not linked to any concept of vulnerability or incident affecting digital products.  

Indeed, under the CRA, only actively exploited vulnerabilities or severe incidents affecting products with digital elements must be reported by manufacturers, with different levels of precision: within 24 hours of becoming aware (early warning), then 72 hours (notification), then 1 month (final report) (Art. 14).  

Different sanctions and intervention powers of the authorities  

Japanese authorities rely less on sanctions (A) but more on intervening in businesses (B).  

A. Difference in the financial sanctions  

Under the Japan Cyber Act, when CIO fail to report incidents, or files a false report, and persists in failing to (correctly) report despite a government order, a fine of up to JPY 2 million (approx. EUR 11,300) can be imposed, and same applies to missing or incorrect asset information (Art. 83, 84). The fines are modest compared to their EU counterparts. 

NIS 2 sets an administrative fine up to EUR 10 million for essential entities (EUR 7 million for important entities) or 2% of the entity's total worldwide annual turnover for essential entities (1.4% for important entities) (Art. 34), noted that individuals representing the entity can also be held personally liable and prohibited from functions (Art. 32).  

The CRA sets fines up to EUR 15 million or 2% of global annual turnover for failure to report, or up to EUR 5 million or 1% of global annual turnover for incorrect reporting (Art. 64), not to mention sanctions on products such as recall or prohibition from the market (Art. 54). 

Now, whereas NIS 2 and the CRA are essentially defensive and regulate corporate compliance, relying on dissuasive fines imposed on targets of cyberattacks (or their supply chains), the Japan Cyber Act is more offensive targeting the source of cyberthreats, and authorises greater government monitoring and active neutralisation of attackers. 

B. Difference in the intervention of the authorities  

Under the Japan Cyber Act, first, the government has a coordination power, as it establishes a Council on Information Sharing and Countermeasures to share information and prevent cyber damage, comprising administrative agencies on the one hand, and CIO and (critical) IT vendors on the other hand, with their consent (Art. 45). 

Second, the government may alert agencies, as well as CIO and IT vendors, to vulnerabilities in order to prevent or remedy cyberattacks (Art. 37 to 41). To do so, it relies on cross-referencing the asset and vulnerability information submitted by CIO by March 2027, but also on communication data, obtained with the mandatory cooperation of telecom service providers, under safeguard conditions, starting end of 2027 (Art. 17, 18).  

Third, the government may itself neutralise attackers in place of CIO when needed, with the Japanese military and police, making it an offensive approach. Indeed, the Japan Cyber Act proceeds by way of references to the Self-Defence Forces Act.  

By comparison, NIS 2 grants national authorities less intrusive powers. Indeed, they (including computer security incident response teams) are responsible for overseeing and enforcing compliance with NIS 2 obligations, conducting audits, and handling incident reports and coordinating responses (Art. 8, 10), including requesting data access, carrying out inspections and ordering remedies (Art. 32, 33) etc. However, the primary actors for the main reporting obligations remain the essential and important entities.  

Similarly, under the CRA, national authorities are responsible for setting up and carrying out conformity assessment procedures (Art. 36) and even have corrective powers (Art. 54). Yet, economic operators remain on the frontline of cybersecurity, as in addition to their reporting obligations, they must ensure security by design (Art. 27), carry out conformity assessments (Art. 32), provide technical documentation (Art. 13).  

As for EU authorities, the European Union Agency for Cybersecurity (ENISA) has a coordinating role, like the Japanese authorities. Under the CRA, it receives reports submitted by manufacturers (Art. 14), coordinates information sharing via a single reporting platform (Art. 16), operates EU vulnerability registries (Art. 15), publishes handbooks (Art. 26), etc. Likewise, under NIS 2, ENISA adopts reports (Art. 18) and drafts guidelines (Art. 3). However, on no occasion, does ENISA take an offensive stance. 

To conclude, for EU companies considering investments in Japanese critical sectors through CIO, or as suppliers of critical IT to Japan, compliance with the CRA and NIS 2 does not necessarily mean compliance with the Japan Cyber Act. They should therefore implement dedicated communication channels and protocols with the Japanese authorities, be ready to submit specific reports and for bolder governmental intervention. 

Same can be said for Japanese operators making digital products available on the EU market as, despite compliance with Japanese laws, they need to set a rigorous supply chain due diligence regardless of product criticality, be ready to face tighter reporting schedules, specific dialogue channels with the authorities, and higher exposure to fines. 

Disclaimer: This article has no vocation to advise in Japanese law ad is intended solely to provide a general comparative overview of European and Japanese legislations.