Japan's AI Act carries no penalties. Singapore has no AI Act. Neither one lets you off.
Neither country chose the European route, and the mistake almost everyone makes is to read that as nothing to comply with. What both have done instead is tie AI to the law they already had about personal information — which binds, carries penalties, and started applying to your AI the day you switched it on.
Japan legislated first and deliberately left the teeth out. Its AI Act sets national policy, asks businesses to co-operate with government guidance, and leaves enforcement to the laws that already existed. Government can investigate a bad case and say publicly what it found, which for a professional firm is the penalty that actually matters.
Singapore did not legislate at all, and then published the most detailed account anywhere of how its binding personal data law applies to AI. Advisory in form. An instruction manual in substance.
What actually governs AI in Japan and Singapore.
No summaries of summaries. Each of these was read at the publisher's own site, and the obligation is stated as the thing you have to do rather than the clause it comes from.
Japan
The Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology, now fully in force, alongside the Act on the Protection of Personal Information, which is the one with penalties.
Co-operate with national AI policy and with the guidance the ministries issue, and handle personal information lawfully in everything your AI touches. The AI Act sets no fine; government can investigate a harmful case and publish what it found.
Japan led the Hiroshima AI Process and runs a reporting framework through which companies publish how they are meeting the international code of conduct. Voluntary, visible, and increasingly a question on a Japanese partner's due diligence form.
Singapore
The Personal Data Protection Act. There is no AI-specific statute.
Have a lawful basis for the personal data that trains and runs your AI, be able to say who is accountable for it along the supply chain, manage what the system gets wrong, and tell people where AI is involved in something that affects them.
The Personal Data Protection Commission published its Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, following earlier guidelines on AI recommendation and decision systems. Advisory in form, and an account of how a binding law will be applied.
Nothing here lands on a date. That is the difficult part.
Neither country has set you a deadline, and that is harder rather than easier. There is no phase-in, no grace period and no moment when somebody tells you it has started: the duties sit inside personal information law you are already under, and a regulator looking at you next month is applying rules that applied last month.
Japan makes the point sharply. Its AI Act cannot fine you. The personal information law behind it can, and so can the reputational cost of being the case the government writes up.
Elsewhere the calendar does the arguing for us. If your business also touches the UK, the EU, the US, Canada or the Gulf, those lines have hard dates on them — and most businesses we see are on more than one.
Does this apply to you?
Most firms read a page like this and conclude it is about somebody bigger. These are the three things that decide it, and the first one catches almost everybody.
- You use generative AI on anything containing customer or staff information.
- You are in somebody's supply chain and cannot yet say who is accountable for the AI in it.
- You are bidding for work, or courting a Japanese partner, where alignment with a published AI framework is a question on the form.
What we would do about it.
We build AI compliance frameworks — the policy, the register of where AI touches your business, the record that shows a regulator you thought about it before something went wrong. Fixed price, plain English, written for a business owner rather than a lawyer.
We sell fixed-price frameworks off the shelf for the UK, the EU, the US and Canada. Far East is not one of them yet, so this starts as a conversation rather than a checkout: tell us where your people and your customers are, and we will tell you honestly which of these obligations reaches you and what it takes to meet them. If the answer is that you are covered by a framework we already build, we will say so.
Find out where you stand in Far East.
A free call, no pitch deck. We will tell you which of the obligations above reach your business and which do not — including if the answer is none of them.