On 22 October 2026, Japan's Ministry of Internal Affairs and Communications (MIC) held the first meeting of a new study group on data protection and security in telecom services in the era of frontier AI. It is reviewing how carriers should protect communications data and share responsibility with outsourced vendors. The stated concern is that the current framework mostly reacts after incidents. This is not a net neutrality proceeding, and Japan has none live this month. It is still the nearest MIC carrier-obligations process, and it shows how Japan regulates carriers: through a short set of general duties, not a dedicated neutrality code.
The case for tighter, prescriptive carrier rules
The strongest argument for a harder rulebook is that reactive supervision fails exactly when harm is hardest to undo. Communications data is intimate and cannot be un-leaked. Carriers increasingly outsource customer-facing and data-handling work, so accountability can thin out down the vendor chain. A regulator that acts only after an incident lets users bear the cost of the learning. Frontier AI raises the stakes, because models can mine large volumes of traffic metadata and support text. Prescriptive, ex-ante duties would give vendors and carriers clear targets.
What the Act already says
Japan's baseline is already unusually compact and speech-protective. The Telecommunications Business Act (Act No. 86 of 1984) states in Article 3 that communications handled by a carrier "must not be censored." Article 4(1) says their secrecy "must not be violated," and Article 4(2) extends the duty to anyone engaged in the telecommunications business, including after they leave office. Article 6, titled Fairness in Use, provides that a carrier "must not engage in unfair and discriminatory treatment with regard to the provision of telecommunications services" (Japanese Law Translation).
Enforcement runs through Article 29. The Minister may order a carrier to improve its operations where there is a hindrance to ensuring secrecy of communications, or where the carrier treats certain persons in an unfair and discriminatory manner. The Act therefore treats data protection and non-discrimination as sibling duties under one remedial power.
Net neutrality by guideline, not by statute
Japan has never enacted a standalone net neutrality law. Scholar Toshiya Jitsuzumi, writing in the Journal of Law and Information System in 2020, noted that there is still no definition of net neutrality in the official documents. He argued that Japan needs its own version of the concept grounded in the Act's purpose, and described some existing applications as inconsistent with the Act's articles (J-STAGE).
What Japan did instead was apply the existing duties to specific commercial practices. In January 2020 MIC opened a public comment period on draft guidelines for applying the Act to zero-rating services, running from 17 January to 15 February. It received 22 opinions, weighed them alongside a working-group meeting on 16 March 2020, and announced on 27 March 2020 that it would formulate the final guidelines (MIC). The method matters. MIC did not ban zero-rating or fix a neutrality definition. It asked how the existing non-discrimination duty applies to a given offer, and it left room for pro-consumer pricing innovation.
Why the study group should follow the same method
The pro-innovation reading is that the new group should extend this approach to data security. Three principles follow.
- Make responsibility follow control. Carriers already carry the secrecy duty under Article 4. Clarifying that a carrier cannot contract away that duty to a vendor is sound, and it needs guidance on what oversight is expected, not a new licensing layer.
- Regulate outcomes, not model architecture. Rules should say what must be protected, such as communications content, metadata and access logs. They should not dictate which AI tools carriers may use. Prescribing technology freezes today's assumptions into law.
- Keep neutrality and security separate. Security obligations must not become a back door for traffic management that favours some services. Article 6 still applies, and any security-driven filtering should be tested against it.
This restraint is consistent with MIC's wider direction. Its 26 May 2026 revision of directives and guidelines under the amended Telecommunications Business Act (Act No. 46 of 2025) covers consumer protection, competition promotion, NTT fair-competition measures and FTTH wholesale. The revisions took effect on 27 May 2026, and the materials are published in Japanese (MIC). That is a regime that updates through guidelines under a stable statute.
Risks to watch
The weakness of a light-touch model is predictability. Guidelines can drift, and a generic non-discrimination clause gives carriers limited advance notice. The remedy is transparency. MIC should publish worked examples in the way it did for zero-rating, and it should keep public comment open, so carriers and civil society can test its reading before enforcement.
The opposite error is a heavy compliance regime that raises costs for smaller carriers and MVNOs, which depend on wholesale access and cannot absorb audit burdens the way incumbents can. Proportionality means scaling duties to the sensitivity of the data and the carrier's role.
Bottom line
Japan has kept communications free of censorship, protected their secrecy, and policed unfair discrimination through three short articles and a flexible ministerial order power. The October study group is a chance to modernise the security side of that bargain without importing a prescriptive neutrality or AI-compliance code. If it keeps outcome-based duties, clear vendor accountability and published examples, Japan can protect users from reactive failure while keeping its competitive, innovation-friendly carrier market.