Before You Put an AI Chat on Your Site or App, Check Japan's AI Guidelines for Business

Over the past year I have had more and more requests that start with "we want an AI chat for customer questions."

Technically, you can have something working in a few days. The hard part comes after it works. It quotes the wrong price. It states contract terms it has no business stating. A customer types their membership number and home address into the chat box. Most of these problems show up after launch.

Japan has a document that sets out what businesses are expected to do in exactly these situations. I design and build AI products, so here are the parts that matter for a chat. I am not a lawyer. For final decisions, read the original and talk to your counsel.

How the law and the guidelines fit together

Japan's AI Promotion Act was promulgated on June 4, 2025, and according to the Cabinet Office it took full effect on September 1 that year. What it asks of businesses is in Article 7: make an effort to use AI and cooperate with national and local government measures. It has no penalty provisions.

The concrete material that affects screen design is in the AI Guidelines for Business from the two ministries. The latest is version 1.2, published March 31, 2026. The guidelines describe themselves as non-binding soft law, so nobody gets fined for ignoring them. Still, clients' security questionnaires and internal approval processes sometimes ask whether you follow them.

A company with an AI chat is an "AI provider"

The guidelines sort businesses into three roles: AI developers, AI providers and AI business users. An AI provider is a business that builds an AI system into an application, product, existing system or business process and offers it as a service.

If you use an outside AI model to put a customer chat on your site or in your app, that is you. The customers using the chat are what the guidelines treat as users outside the business, the general public.

A footnote names UI/UX design as one of the AI provider's jobs. So from here on, this is a conversation about screens.

Turning the guidelines into screens

From Part 4, the section on AI providers, I picked five items that apply to a chat.

1. Tell people it is AI. After launch, providers are expected to share, in plain and accessible terms, the fact that AI is being used, how far it is used, and what counts as appropriate and inappropriate use. On screen, that means a short line at the start of the chat saying an AI is answering, what it can help with and what it cannot. I would also include not giving the bot a name or avatar that could pass for a human agent.

2. Tell people not to enter personal data. Providers are expected to explain what to keep in mind when entering personal information, and to warn people against entering it where they should not. One line right by the input box asking people not to type membership or card numbers changes how much of it you get. For the times people do it anyway, mask it before it reaches your logs.

3. Think about what happens when it is wrong. At the build stage, providers are expected to consider ways, such as guardrail technology, to keep risks like inappropriate output to a minimum. For topics where a wrong answer causes real harm, like prices, contracts, medical or legal questions, do not let the AI answer. Send people to the official page or to a person. Deciding which topics go that way is a business decision, and it comes before the technical one.

4. Say when you change it. When the system is updated, providers are expected to share what changed and why. Swapping the underlying AI model changes how the same question gets answered. Decide from day one that a model change gets a line on your updates page.

5. Have terms and a privacy policy. Providers are expected to write terms of service and make the privacy policy clear. Put both one tap away from the chat. I wrote in more detail about how to describe where customer input goes and how long it is kept in the piece on sending customer input to overseas AI APIs.

What continues after launch

The guidelines do not stop at launch. After release, providers are expected to check regularly that the service is used for appropriate purposes, deal with privacy violations when they find them, and keep up with new attack methods and fix vulnerabilities. They also ask providers to evaluate inputs and outputs regularly and watch for bias.

In practice, the thing that works best is setting aside time once a week to read a few dozen real conversations. Questions it could not answer, questions that went to a person, and conversations where the customer was angry. Read those three and you will see what to add to the FAQ and what the AI should never be answering.

At the first meeting

If you are thinking about adding an AI chat, tell me three things at the first meeting: what customers ask about most today, which topics would cause trouble if answered wrong, and the contact details and hours for handing a conversation to a person.

With those three, we can decide what the AI handles and what goes back to people before anyone designs a screen.