Japan's Digital Agency marked its fifth anniversary on September 1, 2026 with a five-year report. The headline number is My Number Card issuance of about 104.18 million at end-July 2026, up from 47.61 million when the agency was created in September 2021. Health-insurance-certificate registrations exceed 90 million, or 91% of cardholders. Few countries have moved a national digital credential this far this fast, and the way Japan did it is instructive.
What the numbers show
The report's own timeline shows steady compounding rather than a one-off spike: roughly 86 million cards in May 2023, 92 million in March 2024, 97 million in March 2025, and 104.18 million by July 2026. The card also became a working tool. Registration as a health insurance certificate is the clearest example, since a card that replaces a document people already carry gives them a concrete reason to use it.
The report adds three further pieces of infrastructure. The Corporate Base Registry, launched in March 2026, lets administrative bodies look up corporate registry information so businesses no longer need to attach registry certificates to administrative procedures. The Digital Agency has rolled out "Government AI GENAI" across ministries as, in its words, a first step toward a platform that lets officials use AI safely and securely. In July 2026 the government adopted a Priority Plan for a Digital Society, centred on upgrading the AX/DX foundations of national and local government.
The strongest case for caution
The best argument for scepticism is Japan's own recent history. In 2023, an analysis of the My Number problems recounts, an interim review found that about 20% of local governments had followed incorrect procedures when linking My Number to disability records. Of 55 million cards linked to bank accounts, roughly 130,000 had been tied to the wrong accounts. The Personal Information Protection Commission found that the agency's safety management needed systematic improvement because information was not adequately shared internally after errors were detected. Minister Kono Taro forfeited three months of cabinet salary in response. The same analysis cites government survey data showing that only 29% of digital-services users reported satisfaction.
This is the steelman for regulators and critics: a single identifier that touches tax, health, benefits and banking concentrates risk. A mislinked record is not a bug in a website. It is a person's medical or financial data attached to the wrong file. Rapid issuance growth also means little if usage is driven by deadlines and incentives rather than trust.
Why the growth still counts as a success
The response to that history is what makes the fifth-anniversary numbers credible. The Digital Agency did not retreat from the card. It fixed process failures, created a Corporate Planning Office to manage over 100 concurrent projects, and kept adding uses. Adoption continued to grow after the 2023 setbacks, which suggests people judged the card by whether it worked for them.
This is the proportionate model. Voluntary adoption, tied to real utility, gives citizens an exit and gives the agency a reason to earn trust continuously. It is far better than mandating a system on day one and discovering its flaws in production.
Where the risk is moving
The report's newer items deserve closer scrutiny than the card count. Three issues stand out.
- Concentration of oversight in one agency. Under Japanese law the Digital Agency administers the My Number Act, while the Personal Information Protection Commission supervises the Act on the Protection of Personal Information, as the PPC's own description of its roles states. Both cover administrative bodies. The PPC's independence is the safeguard here, so its monitoring capacity should grow in step with the agency's ambitions. A builder that also grades its own work is a familiar failure mode.
- Government AI without published rules. Rolling GENAI across ministries is sensible: officials using AI on secure government platforms is preferable to officials pasting drafts into consumer tools. But the report describes a deployment, not a public accountability framework. Citizens should be able to learn what data the system touches, what it is used for, and how errors are corrected.
- Registry interconnection. The Corporate Base Registry removes paperwork, which is a real gain for businesses. Every new data linkage, though, increases the cost of a misconfiguration, and 2023 showed that the failure point is often local-government procedure rather than central code.
The EFF's September 2026 essay on digital sovereignty offers a useful test even though it is not about Japan. It argues that people should be able to easily understand where their data lives and who has access to it. Applied to Japan, the test is whether a cardholder can readily see which agencies queried their records and why.
What good looks like for years six to ten
Japan has shown that a national digital identity can scale when it replaces a real document and stays voluntary. The next stage should keep that logic. First, publish access logs to individuals so a cardholder can see who has looked at their data. Second, give the PPC the resources and audit access to inspect government AI and registry deployments, with public findings. Third, treat the AX/DX upgrade of local governments as the main risk item, since that is where the 2023 errors originated. Fourth, publish outcome metrics such as error rates and satisfaction alongside issuance counts. Issuance shows reach. Error rates show whether the system deserves it.
The pro-innovation reading of Japan's experience is not that digital public infrastructure needs light regulation. It is that it needs credible, independent oversight so that citizens keep using it. The 104 million figure is an achievement. The test of the next five years is whether the trust behind it holds as the system grows.