LEGAL UPDATE | No. 35
Legal analysis as of October 8, 2026 | Corrected October 20, 2026
SAKURA Law Office | Managing Partner Kenshiro Michishita
The European Union's Artificial Intelligence Act entered into force on 1 August 2024 and has since moved into application in stages. By 2026, the practical question for companies is no longer whether the AI Act will matter, but which obligations already apply, which obligations began to be enforced from 2 August 2026, and which obligations were rescheduled by Regulation (EU) 2026/1744, the Digital Omnibus on AI. The legal timetable is now more complex than the frequently repeated statement that the AI Act "fully applies from August 2026." That shorthand is no longer adequate for corporate compliance. [1] [2]
From 2 August 2026, Article 50 transparency obligations became applicable and the Commission’s enforcement powers concerning GPAI became fully operational. This did not mean that every previously applicable provision had been unenforceable before that date. Providers of interactive AI systems must address disclosure when individuals interact directly with AI; providers of systems generating synthetic audio, image, video or text must address machine-readable marking; and deployers may face disclosure obligations for deepfakes, emotion-recognition or biometric-categorisation tools and certain AI-generated text on matters of public interest. In parallel, the Commission's enforcement powers in relation to general-purpose AI models became fully operational. These obligations sit alongside rules that had already become applicable in 2025, including prohibited AI practices, AI literacy and the general-purpose AI model regime. [1] [2]
At the same time, the Digital Omnibus on AI, which entered into force on 27 July 2026, materially changed the implementation timetable for high-risk AI. The principal requirements for AI systems classified as high-risk under Article 6(2) and Annex III now apply from 2 December 2027, while the corresponding requirements for high-risk systems under Article 6(1) and Annex I apply from 2 August 2028. Separate transitional rules also matter: providers of general-purpose AI models placed on the market before 2 August 2025 have until 2 August 2027 to comply, and providers of synthetic-content-generating AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). A reliable implementation plan must therefore distinguish several legal clocks rather than work from a single "AI Act deadline." [2]
For Japanese companies, this is not merely an EU subsidiary issue. The AI Act expressly reaches certain providers established outside the Union when they place AI systems or general-purpose AI models on the EU market, and it may also apply to third-country providers or deployers where the output produced by an AI system is used in the Union. A Japanese group can therefore fall within the Act even when development, servers and contracting entities remain in Japan. This Update examines the AI Act from the perspective of how a Japanese company should actually organize compliance: identify EU touchpoints, classify legal roles system by system, determine which obligations are already live, operationalize Article 50 in product and communications workflows, manage the GPAI supply chain through contract, prepare early for high-risk AI, and build a governance record that the board and General Counsel can defend to regulators, customers, investors and transaction counterparties. [1]
Executive Summary
First, 2 August 2026 should not be described as a single date on which every AI Act obligation became fully applicable. Prohibited-practice rules and AI literacy had already entered into application in February 2025; the GPAI regime began applying in August 2025; Article 50 transparency obligations began applying on 2 August 2026; certain newly added prohibited practices apply from 2 December 2026; the principal Annex III high-risk requirements now apply from 2 December 2027; and the principal Annex I product-related high-risk requirements apply from 2 August 2028. Transition rules for legacy GPAI models and pre-August-2026 synthetic-content systems must also be separately mapped. [1] [2]
Second, the Act can apply directly to Japanese companies. A company should not classify itself once and for all as a "provider" or "deployer." The correct unit of analysis is the relevant AI system, model, use case and contractual chain. A Japanese company may be a provider when offering its own AI service to EU customers, a deployer when an EU subsidiary uses a third-party tool internally, a downstream provider when it integrates a GPAI model into its own product, and in some circumstances may become a provider under Article 25 after placing an existing system on the market under its own name, making a substantial modification or changing the intended purpose so that the system becomes high-risk. [1]
Third, the obligations already in force require operational implementation rather than a policy document alone. Article 50 affects product interfaces, chatbot disclosures, content credentials, deepfake labels, public-interest communications and editorial workflows. GPAI obligations affect technical documentation, downstream information, copyright policy, training-content summaries, systemic-risk controls and, for many non-EU providers, the appointment of an EU authorised representative. AI literacy is now framed as an obligation to take measures supporting the development of literacy appropriate to staff knowledge, experience, training, use context and affected persons, rather than as a requirement to guarantee a prescribed competence level for every individual. [4] [8] [9]
Fourth, the postponement of the main high-risk AI requirements is not a reason to postpone preparation. High-risk compliance depends on system architecture, data governance, logging, human oversight, technical documentation, evaluation, cybersecurity, vendor information and contractual access that cannot credibly be bolted on shortly before the legal deadline. For Japanese groups, 2026 should be used to identify future high-risk candidates, renegotiate supplier rights, create an AI inventory, embed change-management triggers and connect EU AI Act compliance with GDPR, employment law, copyright, cybersecurity, product regulation and existing governance systems.
1. 2 August 2026 is not "full application": reading the AI Act timetable after the Digital Omnibus
The AI Act has always been structured around phased application. The Regulation entered into force on 1 August 2024. Chapter I and Chapter II, including the general framework and most prohibited AI practices, began applying on 2 February 2025. Article 4 on AI literacy also entered into application at that stage. On 2 August 2025, the rules for providers of general-purpose AI models, the Union governance framework and relevant penalty provisions entered into application. Companies active in AI therefore had legal obligations well before August 2026, particularly where they developed or supplied GPAI models or used AI in prohibited contexts. [1] [2]
The general application date of 2 August 2026 brought Article 50 transparency obligations and the Article 101 fine framework for GPAI providers into an important operational phase. It does not mean that previously applicable prohibitions first became regulated on that date. Interactive-system notices, machine-readable identification of generated content and disclosure of deepfakes must be implemented by identifying the responsible operator and the relevant functionality. Compliance with provisions already applicable and preparation for future requirements belong in one implementation programme but must remain distinct legal workstreams. [1] [2]
The Digital Omnibus on AI altered the timeline for the core requirements applicable to high-risk systems. Under the current Article 113, Sections 1, 2 and 3 of Chapter III, other than Article 6(5), apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III. These include use cases in areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and administration of justice. For AI systems classified as high-risk under Article 6(1) and Annex I because they are tied to specified Union product-safety legislation, the relevant provisions apply from 2 August 2028. Human-resources AI and AI embedded in regulated products must therefore be managed against different timelines. The Article 2(2) restriction for Annex I Section B products must also be applied: Chapter III duties do not directly apply in an identical manner to every product listed in Annex I. The Omnibus moved Machinery Regulation (EU) 2023/1230 into Section B. Product integration, safety functions, conformity-assessment requirements and the relevant sectoral legislation must therefore be checked before assigning a deadline. [2]
Other transition provisions are equally important. Providers of GPAI models placed on the market before 2 August 2025 must take the necessary steps to comply by 2 August 2027. Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026. In addition, the Omnibus introduced new prohibited practices concerning certain non-consensual sexually explicit or intimate content and child sexual abuse material that apply from 2 December 2026. A defensible implementation roadmap should therefore be built system by system and obligation by obligation, not around a single enterprise-wide deadline. [1] [2]
2. Extraterritorial application to Japanese companies: map the EU nexus and classify roles system by system
The first question for a Japanese company is whether the AI Act applies at all. Article 2(1)(a) covers providers that place AI systems on the Union market or put AI systems into service in the Union, as well as providers placing GPAI models on the Union market, irrespective of whether those providers are established or located in the Union or in a third country. Article 2(1)(c) also extends the Regulation to providers and deployers established or located in a third country where the output produced by the AI system is used in the Union. Keeping development teams, cloud infrastructure or the contracting entity in Japan does not therefore eliminate EU AI Act exposure. [1]
In practice, legal role classification should be performed for each AI system and model rather than at the company level. A Japanese company offering an AI service under its own brand to EU customers may be a provider. An EU group company using a third-party AI tool in its own operations may be a deployer. A Japanese company that develops and places a GPAI model on the EU market may be a GPAI provider and, if established outside the Union, will in principle need an EU authorised representative. A business that integrates another provider's GPAI model into its own AI application may be a downstream provider and must obtain enough information about capabilities and limitations to meet its own obligations.
Role allocation can also change during the lifecycle of a system. Article 25 can cause a distributor, importer, deployer or other third party to be treated as the provider of a high-risk system where, for example, it places the system on the market under its own name or trademark, makes a substantial modification, or changes the intended purpose of a system not previously classified as high-risk in a manner that causes it to become high-risk. This is particularly relevant to white-label services, major fine-tuning or customization, and internal repurposing of AI into recruitment, employee evaluation or other sensitive use cases. Contractual labels cannot override the factual allocation of responsibilities under the Regulation. [1] [2]
The most useful first compliance artifact is therefore not an abstract AI policy but an AI inventory combined with a role-and-jurisdiction map. For each system, the company should record the developer, brand owner, model supplier, contractual seller, customer location, EU market route, deployer, output-use geography, intended purpose, affected persons, data flows, product integration, modifications and downstream distribution. That record should identify the applicable role or roles - provider, deployer, importer, distributor, downstream provider, product manufacturer or authorised representative - and the relevant application dates. Without this inventory, Article 50, GPAI, high-risk classification and enforcement exposure cannot be analyzed coherently.
3. Prohibited practices, AI literacy and GPAI are already live: waiting for 2027 is not a compliance strategy
The revised high-risk timetable has created a misleading impression that AI Act compliance can largely be deferred. It cannot. Most prohibited practices in Article 5 have applied since February 2025 and are backed by the Act's highest administrative-fine tier. For corporate users, one especially important rule prohibits certain biometric-data-based emotion-recognition AI in workplaces and educational institutions, subject to limited medical or safety exceptions. Other prohibitions address manipulative or deceptive techniques that materially distort behaviour and cause significant harm, certain forms of exploitation of vulnerability, social scoring and indiscriminate scraping of facial images to create or expand facial-recognition databases. A company introducing AI in an EU business should therefore screen for prohibited use before debating whether the system is merely "high-risk." [1]
AI literacy is also already a legal requirement, although the Digital Omnibus changed its formulation. Article 4 now requires providers and deployers to take measures to support the development of AI literacy among staff and other persons operating or using AI systems on their behalf, taking into account technical knowledge, experience, education and training, the context of use and the persons affected. The amended text expressly states that companies are not required to guarantee a specific literacy level for each individual. The practical result is neither a rigid certification mandate nor permission to run one generic training session and stop. Recruitment teams, developers, marketing staff, customer-service teams, senior management and legal or risk functions use AI differently and should receive governance appropriate to their actual role and risk. [2]
The GPAI model regime has applied since 2 August 2025. Providers must maintain technical documentation, provide information and documentation to downstream AI-system providers, implement a policy to comply with Union copyright and related-rights law, and publish a sufficiently detailed summary of content used for training using the required template. Providers of GPAI models with systemic risk face additional duties relating to model evaluation, adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting and cybersecurity. From 2 August 2026, the Commission's enforcement powers apply fully to GPAI providers. The Commission has also stated that providers of GPAI models placed on the market before 2 August 2025 have a transition period until 2 August 2027. For qualifying free and open-source models, Article 53(2) provides a limited exception to specified technical-documentation and downstream-information duties. It does not generally remove the copyright-policy and training-summary duties, and the exception does not apply to models presenting systemic risk. [1] [10]
A company that merely uses a third-party generative AI service does not thereby become the provider of the underlying GPAI model. The harder cases arise where the company modifies the model materially, places an AI system on the market under its own identity, integrates a third-party model into a customer-facing product, or repurposes an existing system into a regulated use. Legal review should therefore follow the actual AI value chain, not the marketing name of the service. The boundary between internal use, downstream integration and market provision determines who must document the system, who must disclose limitations, who must label generated content and who may be directly answerable to the AI Office.
4. Article 50 from 2 August 2026: implement transparency through product design, communications and content workflows
Article 50 is among the most immediately operational parts of the AI Act for ordinary businesses. For AI systems intended to interact directly with natural persons, providers must design and develop the system so that the person is informed that they are interacting with AI, unless this is obvious from the circumstances to a reasonably well-informed, observant and circumspect person. The information must be provided in a clear and distinguishable manner no later than the first interaction or exposure. Customer-service chatbots, voice bots, AI concierges and agentic interfaces should therefore be reviewed at the user-experience level; a generic clause hidden in terms of service may not address the design obligation. [4] [8]
Article 50(2) separately addresses AI systems that generate synthetic audio, image, video or text. Providers must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the characteristics and limitations of different types of content and implementation costs. The Regulation includes exceptions, including where an AI system performs a standard editing-assistance function or does not substantially alter input data or its semantics. For businesses supplying content-generation functionality, the relevant questions therefore include content credentials, metadata, provenance signals and other technical marking mechanisms at the product-design stage. [4]
The Digital Omnibus added an important transitional rule. Providers of systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026. This does not postpone Article 50 as a whole. A company should distinguish the provider-side machine-readable marking obligation in Article 50(2) from the deployer-side disclosure duties concerning deepfakes, emotion-recognition and biometric-categorisation tools, and certain AI-generated or manipulated text on matters of public interest. [2]
Deployer-side obligations can be especially important for corporate communications. Deepfakes generally require disclosure that the content has been artificially generated or manipulated. Text generated or manipulated by AI and published for the purpose of informing the public on matters of public interest can also require disclosure, subject to an exception where the content has undergone human review or editorial control and a natural or legal person bears editorial responsibility for publication. Press releases, investor communications, policy commentary, public safety information and corporate media content should therefore have a documented review and editorial-approval process rather than a formalistic human "check" added at the end. Article 50(3) separately requires deployers of emotion-recognition or biometric-categorisation systems to inform exposed individuals and comply with applicable data-protection law. Notice does not legalise a use prohibited under Article 5. The tailored disclosure rule for evidently artistic, creative, satirical, fictional or analogous deepfake works must also be considered separately. [4]
The Commission published final Article 50 transparency guidelines on 20 July 2026, alongside the Code of Practice on Transparency of AI-Generated Content and related adequacy assessment. The Code is voluntary, but the Commission explains that adherence can provide a practical compliance pathway for marking and labelling AI-generated content; non-signatories must demonstrate alternative, equivalently adequate means. For Japanese companies, Article 50 should be implemented across legal, product, UX, communications, IR, marketing and content-production functions. The issue is not merely whether AI was used, but who is the provider or deployer, what type of content or interaction is involved, which exception applies, and what evidence is retained to show why the adopted design was reasonable. [8] [9]
5. GPAI and the AI supply chain: contracts must connect model providers, downstream providers and enterprise users
Generative AI products are rarely delivered by a single entity that controls the model, API, application layer, training or retrieval data, cloud infrastructure, customer interface and distribution. A GPAI provider may sit upstream from one or more downstream providers, system integrators, distributors, enterprise deployers and product manufacturers. The AI Act assumes that compliance information must move through that chain. Article 53 therefore requires GPAI providers to prepare and provide information and documentation that enables downstream providers to understand capabilities and limitations and to comply with their own obligations. [1] [10]
AI contracting should accordingly go beyond the conventional SaaS package of fees, service levels, confidentiality, intellectual property and limitation of liability. Depending on role and use case, agreements should address model versioning, intended and excluded uses, known limitations, evaluation information, access to logs or technical information, Article 50 marking capabilities, incident notification, cooperation with regulatory requests, subcontractor or sub-provider changes, migration support on termination, and the provider's approach to the GPAI Code of Practice. Where a system may later become high-risk, the customer should assess whether the contract will provide the information, technical access and assistance needed for future regulatory compliance rather than assuming that such cooperation will be available when the deadline approaches.
Copyright is also a core GPAI governance issue. Article 53 requires a policy to comply with Union copyright and related-rights law, including identification of and compliance with reservations of rights under Article 4(3) of Directive (EU) 2019/790, and requires a public summary of content used for training. These rules do not create a single universal answer to whether any particular training use is lawful. They do, however, increase the importance of traceability: model developers should be able to identify acquisition channels, licences, rights-reservation handling, dataset-provider obligations, crawler configuration and documentation of training sources. Those records can become relevant not only to regulatory supervision but also to customer diligence, investment and M&A. [1] [13]
Third-country GPAI providers generally must appoint an authorised representative established in the Union before placing the model on the Union market. The written mandate is not a nominal agency appointment: it must empower the representative to verify that documentation exists and obligations have been fulfilled, keep relevant documentation available to the AI Office and national authorities, respond to reasoned information requests and cooperate with supervisory action. The Act includes an exception for qualifying free and open-source GPAI models, but not where the model presents systemic risk. Japanese providers should distinguish this statutory representative function from ordinary distributors, sales agents or resellers and allocate responsibilities accordingly. [5]
6. High-risk AI has been postponed, not abandoned: use 2026 to design classification, evidence and contractual access
The postponement gives preparation time, not permission to omit classification. Annex III identifies specified use cases involving biometrics, infrastructure, education, employment, essential services, law enforcement, migration, justice and democratic processes. Article 6(1), by contrast, requires examination of whether the AI is a listed product or its safety component and whether the product is subject to the required third-party conformity assessment. The Omnibus also clarifies the distinction between non-safety assistance or efficiency functions and safety components. Section A products such as relevant medical devices must be distinguished from Section B products, now including the Machinery Regulation, because Article 2(2) limits the direct application of the Act to the latter. A manufacturing AI portfolio cannot be assigned one undifferentiated “2028 compliance” rule. [1] [2]
Article 6(3) permits certain Annex III systems not to be treated as high-risk where they do not pose a significant risk of harm, including through material influence on decisions, and meet the specified conditions such as a narrow procedural task. The exception is unavailable where an Annex III system performs profiling of natural persons. Providers relying on the exception remain subject to the relevant documentation and registration requirements. Labels such as “recruitment support” or “human final decision” are therefore insufficient. Intended purpose, the output’s actual influence, the substance of human review and the data must be examined. Administrative guidance assists classification; it does not replace the statutory conditions. [2] [3]
For providers, the high-risk regime is built around substantive controls: risk management, data and data governance, technical documentation, record-keeping, transparency and information for deployers, human oversight, accuracy, robustness and cybersecurity, quality management and conformity assessment. Deployers have their own operational duties. None of these can be created credibly through legal drafting after a system is complete. Dataset provenance, model-change history, testing metrics, logs, human override, escalation, monitoring and shutdown procedures must be built into development and procurement architecture. [1]
The practical response for Japanese companies is to identify "future high-risk candidates" during 2026 and incorporate likely regulatory needs into contract renewals, system redesigns and product roadmaps. If a key vendor will not provide technical documentation, evaluation results, logs, incident information or regulatory cooperation, replacing the system shortly before December 2027 may be impracticable. The postponed deadline should therefore be used to reduce lock-in, negotiate information rights and technical access, assign responsibility for modifications, and create evidence that can support conformity assessment and regulatory engagement when the relevant provisions become applicable.
7. What boards and General Counsel should build: one governance system connecting inventory, contracts, change control and evidence
Effective EU AI Act compliance starts with an enterprise AI inventory that can be maintained over time. Each entry should capture the model and system, business owner, developer and supplier, EU nexus, role classification, intended purpose, affected persons, data categories, output use, content-generation functionality, prohibited-practice screening, GPAI dependencies, potential high-risk status, relevant contractual rights and application date. New development, procurement and deployment should pass through a review gate based on defined risk thresholds. The inventory should also trigger re-review when the model version, use case, customer population, geography, data flow or product integration changes.
This change-management discipline matters because AI systems are not static. A low-risk internal drafting tool may later be connected to personal data, external users or automated decision-making. A general-purpose model may become a customer-facing service through integration. Retrieval-augmented generation, agentic functionality, fine-tuning or use in employment decisions may materially alter the legal analysis. Governance should therefore be designed as a lifecycle process rather than an approval obtained once at procurement.
The AI Act also does not displace GDPR, ePrivacy rules, consumer law, product-safety regulation, employment law, copyright, trade-secret law or Member State requirements. An employment AI project may require analysis of high-risk classification, data-protection lawful basis, DPIA, discrimination risk and labor-relations rules at the same time. Generative-AI marketing may implicate Article 50, GDPR, advertising regulation, copyright and personality rights. For multinational groups, the sensible architecture is not a stand-alone EU AI Act manual but an integrated control framework that connects AI-specific classification and evidence to existing privacy, security, product, HR and compliance systems. [1] [12]
Penalty ceilings must be read by category. Article 99 provides ceilings of EUR 35 million or 7% of preceding-year worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for specified operator obligations including Article 50; for undertakings the higher figure generally applies. Article 99(6), however, uses the lower ceiling for SMEs, including start-ups. The new paragraph 6a uses the lower ceiling for SMCs in relation to paragraphs 4 and 5. The Commission’s separate Article 101 framework for GPAI providers permits fines up to the higher of 3% of worldwide annual turnover or EUR 15 million where the relevant intentional-or-negligent infringement requirements are satisfied. These are ceilings rather than automatic tariffs: nature, gravity, duration, proportionality, cooperation and remedial conduct require individual assessment. [2] [6] [7]
For boards and General Counsel, the objective should therefore be broader than avoiding an obvious violation. The company should be able to explain why it reached a particular scope determination, role classification, prohibited-practice conclusion, Article 50 design choice, GPAI contracting position or high-risk classification; who approved that decision; what information was available; and what change would require reassessment. Those records are valuable not only in regulatory proceedings but also in enterprise procurement, customer due diligence, cybersecurity incidents, audits, financing, M&A and disputes. The mature form of AI governance is a continuously updated system of legal roles, technical controls, contracts and evidence that changes as the company's AI products and uses change.
Frequently Asked Questions
Q1. Can the EU AI Act apply to a company headquartered only in Japan?
Yes. A provider established in a third country can be directly in scope when it places an AI system or GPAI model on the Union market. A third-country provider or deployer may also be in scope where the output produced by the AI system is used in the Union. The analysis therefore depends on market access, customers, group operations, output use and the specific AI supply chain, not merely on whether the company has an EU-incorporated subsidiary. [1]
Q2. Does ordinary employee use of ChatGPT or another generative AI service automatically violate the AI Act?
No. Ordinary use does not by itself constitute a violation. Depending on the facts, however, an EU deployer may need to address AI literacy and other obligations, and use in recruitment, employee management or other sensitive decision-making can raise prohibited-practice or future high-risk issues. A company should distinguish general productivity use from AI that influences decisions about individuals.
Q3. Did all high-risk AI rules become applicable on 2 August 2026?
No. Following the Digital Omnibus, the principal requirements for Article 6(2)/Annex III high-risk systems apply from 2 December 2027, while the corresponding requirements for Article 6(1)/Annex I systems apply from 2 August 2028. Other parts of the Act - including prohibited practices, AI literacy, GPAI obligations and Article 50 transparency rules - follow different timelines and are already applicable in relevant circumstances. Product-related AI must also be assessed against the Article 2(2) restriction for Annex I Section B; the same direct obligations do not apply to every listed product, including machinery. [2]
Q4. Must every chatbot display the words 'I am AI'?
Not necessarily in that exact wording. Where an AI system is intended to interact directly with natural persons, the provider must generally ensure that users are informed that they are interacting with AI unless this is obvious from the circumstances to a reasonably well-informed, observant and circumspect person. The design, timing and prominence of the information should be assessed against Article 50 and the Commission's transparency guidelines. [4] [8]
Q5. Must every AI-generated image or video carry a visible label?
Article 50 contains different obligations for providers and deployers. Providers of systems generating synthetic content must address machine-readable marking, while deployers have disclosure duties for deepfakes and certain other content. There are exceptions and transitional rules. In particular, qualifying synthetic-content systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). That transition concerns the provider-side marking duty, not a blanket deferral of deployer-side deepfake disclosure. [2] [4]
Q6. Must a press release or article drafted with generative AI always disclose that AI was used?
Not in every case. For AI-generated or manipulated text published to inform the public on matters of public interest, a deployer-side disclosure obligation can arise. The Regulation includes an exception where the content has undergone human review or editorial control and a natural or legal person bears editorial responsibility for publication. Companies should therefore maintain a genuine editorial process and evidence of responsibility rather than rely on a nominal human review. [4]
Q7. Is one generic AI-literacy training session for all employees sufficient?
Not necessarily. Article 4 requires measures supporting the development of AI literacy while taking account of technical knowledge, experience, education and training, the context of use and the persons affected. The amended provision does not require a company to guarantee a specific competence level for each individual, but differentiated training and operational rules may be appropriate for developers, HR teams, marketers, ordinary users, managers and legal or risk personnel. [2]
Q8. If we integrate an external GPAI model into our service, do we become the provider of that model?
Not automatically. The original model provider may remain the GPAI provider, while your company may become a downstream provider or provider of the resulting AI system. Different obligations can therefore apply at different layers. Article 25 may also cause a party to be treated as a provider of a high-risk system if it places the system on the market under its own name, makes a substantial modification or changes its intended purpose in a way that makes the system high-risk. [1] [2]
Q9. Does a non-EU provider of a GPAI model need an EU authorised representative?
In principle, yes, before placing the model on the Union market. Article 54 contains an exception for qualifying free and open-source GPAI models, but not for GPAI models with systemic risk. The representative's mandate must cover substantive regulatory tasks, including documentation, information requests and cooperation with the AI Office; it should not be confused with an ordinary commercial distributor. [5]
Q10. Since high-risk requirements were postponed, can we wait until 2027 to change our vendor contracts?
That is generally risky. Future compliance may depend on technical documentation, evaluation results, logs, incident information, change notifications and regulatory cooperation held by upstream suppliers. If those rights are not secured during current procurement and renewal cycles, changing providers or obtaining the necessary information shortly before the applicable deadline may be difficult. [1] [2]
Q11. What is the first internal document a Japanese company should create for EU AI Act compliance?
An AI inventory combined with a role, jurisdiction and application-date map is the best starting point. For each system, identify who provides and deploys it, the EU nexus, intended purpose, underlying model, output use, affected persons, synthetic-content functionality, GPAI dependencies and potential future high-risk classification. The inventory can then be connected to prohibited-practice screening, Article 50, AI literacy, vendor contracting, data protection, copyright and incident-response controls.
About the Legal Update Series
SAKURA Law Office and Managing Partner Kenshiro Michishita publish the Legal Update series on legal issues material to corporate decision-making, including corporate and M&A matters, private equity, corporate governance, cross-border transactions and disputes, financial regulation and capital markets, AI and technology, data protection, Web3 and digital assets, employment, crisis management and investigations. The series is based on statutes, cases, regulatory materials and other primary sources and is intended to translate legal developments into practical questions for management, boards, General Counsel and transaction teams.
Related Japanese generative-AI governance topics are addressed in editions 1–8 of this series. Information about the author and practice areas is available through the professional profile and SAKURA Law Office website listed below.
How SAKURA Law Office Can Assist
SAKURA Law Office advises Japanese and international companies on EU AI Act scoping and extraterritorial-application analysis, classification of provider, deployer, downstream provider and other roles, design of AI inventories, prohibited-practice reviews, implementation of Article 50 transparency obligations in products and content workflows, AI-literacy measures, GPAI model supply and use agreements, arrangements with EU authorised representatives, AI vendor due diligence and roadmaps for future high-risk AI compliance.
For businesses supplying AI products or services into Europe, terms of use, SaaS and API agreements, model licences, data agreements, cloud contracts and distribution arrangements should be reviewed together with regulatory information duties, technical access, change management, incident notification, cooperation with authorities, intellectual property, confidentiality and allocation of liability. In M&A and investment transactions, AI inventories, EU market exposure, GPAI dependencies, training-data governance, Article 50 implementation, potential high-risk systems and regulatory history can also form part of legal due diligence and may need to be reflected in representations, indemnities, conditions precedent and integration planning.
For internal enterprise use, group AI policies, generative-AI rules, procurement standards, review of recruitment and HR systems, governance of AI-generated communications, treatment of personal data, trade secrets and copyright, and AI incident response should be connected to existing information-security, privacy and compliance structures. Because the EU AI Act and its implementing materials continue to evolve, effective governance should also include a change process that triggers legal re-evaluation when relevant technology, use, model, supplier or regulatory guidance changes.
Contact
SAKURA Law Office
Ark Hills South Tower 4F, 1-4-5 Roppongi, Minato-ku, Tokyo 106-0032, Japan
Managing Partner Kenshiro Michishita
Official website | Kenshiro Michishita — Profile | Contact form
Principal References
The numbered references in the text correspond to the materials below. Statutes, exchange rules, judgments, administrative guidance and practical recommendations have different legal status.
4. European Commission AI Act Service Desk | Article 50 (transparency obligations)
5. European Commission AI Act Service Desk | Article 54 (authorised representatives of GPAI providers)
7. European Commission AI Act Service Desk | Article 101 (fines for GPAI providers)
9. European Commission | Code of Practice on Transparency of AI-generated Content (voluntary code)
10. European Commission | Guidelines and official information for providers of GPAI models
11. European Commission | General-Purpose AI Code of Practice (voluntary code)
12. EUR-Lex | Regulation (EU) 2016/679 (GDPR)
Disclaimer
This publication is based on the EU AI Act, Regulation (EU) 2026/1744 (Digital Omnibus on AI), European Commission and AI Office guidance, Codes of Practice and other public primary materials available as of October 8, 2026. It is intended to provide general information on issues that may be relevant to Japanese companies and does not constitute legal advice or a legal conclusion concerning any particular AI system, model, company, transaction or deployment.
Application of the AI Act depends on specific facts, including the intended purpose of an AI system, the legal role of each provider, deployer or other operator, the manner in which the system or model is placed on the EU market, where outputs are used, relevant product legislation and effects on individuals. Commission guidelines and voluntary Codes of Practice also differ in legal status and evidentiary effect. This publication seeks to distinguish the Regulation itself from administrative guidance and voluntary instruments, but any specific matter should be reviewed against the latest operative legislation and official materials.
The AI Act does not replace the GDPR, ePrivacy rules, consumer law, product-safety regulation, copyright law, employment law or other Union and Member State laws. AI development, supply and use should therefore be assessed under the full set of laws relevant to the system's functions, data, contractual chain, users and target markets. In particular, high-risk AI rules scheduled for 2027 and 2028 may continue to be supplemented by guidance, standards, common specifications and other implementation measures, and companies should monitor further official developments.