AI Utilization Guidelines
Japan · Guideline · The Conference toward AI Network Society
Our summary
This document provides practical reference and principles for AI users regarding the responsible utilization of artificial intelligence systems. It addresses how AI service providers, business users, and other stakeholders should voluntarily consider social, ethical, and legal matters when deploying networked AI systems. The guidelines aim to maximize AI benefits while managing risks and building public trust through transparent and accountable practices.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
10 sections
Jump to a chapter
1 Principle of proper utilization
AI service providers and business users must deploy systems in appropriate ways based on developer guidance and with full understanding of the AI's purpose, usage, nature and capabilities; providers must deliver timely updates and maintenance, alert end users to problems from discovery until update delivery, warn of risks to linked systems, and clarify responsibility for each operational state in actuator-operated systems with manual control options. Providers should verify user reliability before supplying AI with potential to harm lives, bodies or property, may record service logs to prevent misuse, and should proactively explain transition conditions and methods and provide training for manual transitions. Providers, business users and data providers must cooperate with stakeholders on preventive and remedial measures for AI accidents and damages from security breaches or privacy violations through information sharing and cause analysis, while consumer users are recommended to gain necessary skills for approving AI decisions, implement provider-offered measures for human decision effectiveness, clarify responsibility allocation, receive provider explanation and training, and cooperate similarly with provider guidance.
2 Principle of data quality
Providers, business users, and data sources must ensure quality of data used for AI training and other functions, and should establish accuracy benchmarks in advance; if performance falls below these benchmarks, retraining is required. All parties should inform consumers of risks from inaccurate or compromised data and consumer users should report security concerns.
3 Principle of collaboration
Providers must attend to interconnectivity and interoperability of AI while considering system characteristics and usage to advance benefits of AI networking. Providers and business users must comply with data format standards (including syntax and semantics) and connection protocols for AI collaboration; data providers must also comply with these data format standards. Providers, business users and data providers should analyze risks from interconnection or networking of AIs (such as loss of control), share risks with cooperating parties, organize countermeasures and provide information to consumer users; consumer users are recommended to watch for networking risks and heed provider preventive measures and countermeasures.
4 Principle of safety
Providers and business users deploying AI in contexts where it controls actuators or devices must implement precautions based on developer guidance to prevent harm to human life, bodies, or property, and should establish contingency procedures in advance. Consumer users should follow provider guidance on updates and safety measures to mitigate potential harm.
5 Principle of security
Providers and business users must implement proportionate security measures to protect the confidentiality, integrity and availability of AI systems, establish protocols for responding to breaches, and inform consumers of risks and countermeasures. All parties should monitor for vulnerabilities in trained models and consumers should report security concerns to responsible parties.
6 Principle of privacy
Providers and business users should protect end user and third-party privacy when using AI systems, take measures against privacy violations, and inform users about such measures. In collecting and processing personal data for AI learning, all parties must respect privacy while complying with relevant data protection law. Data providers and AI service providers must prevent unconsented sharing of personal data with third parties.
7 Principle of human dignity and individual autonomy
Providers and business users must respect human dignity and individual autonomy in AI use based on social context and should take measures considering risks that AI may manipulate consumer decisions or emotions or cause overdependence; where AI links to human brain or body, especially for human enhancement, providers and business users must ensure human dignity and autonomy are not violated per bioethics discussion and must provide information on AI functions and peripheral technologies. Business users must thoroughly examine potential harms to affected individuals, drawing on information from multiple sources including educational materials and developers. Consumer users should stay informed about how their data is used and inquire with service providers and business users about potential profiling activities by AI systems.
8 Principle of fairness
Providers and business users must address potential bias in AI systems to prevent unfair discrimination, paying attention to representativeness of training data and social biases within it. Providers should be aware of algorithmic bias that favors majority patterns over minorities and must apply human judgment to determine whether and how to use AI outputs while considering social context.
9 Principle of transparency
Providers and business users must record and preserve logs of AI inputs and outputs to verify system behavior and clarify causes of errors. For AI used in fields significantly impacting individual rights, providers should ensure decision explanations are understandable given the social context. Administrative bodies using AI must explain decision results while ensuring compliance with legal requirements and administrative transparency.
10 Principle of accountability
AI service providers and business users must disclose and notify consumers and affected third parties of AI usage policies and system characteristics when AI judgement directly affects them, though disclosure is not required if AI merely supports human analysis or generates non-binding drafts subject to human review; this accountability obligation applies across AI development, implementation, deployment and operation phases. The application of accountability principles requires providers and operators to fulfill responsibility, record logs, ensure explainability, and proactively notify users when their rights and interests may be seriously affected. Consumer users are recommended to seek accountability according to their ability and contact providers if they doubt AI decisions.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 13 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 3 of 4
- Bias and non-discrimination, not covered
Assurance and lifecycle 2 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 26 are shown.
1 2 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers should verify user reliability in advance for high-risk applications where AI use may harm human lives, bodies, or property, and may record input and output logs to prevent misuse.
- ObligationApplies to: ProviderDrafted by the Index
Providers should allow human intervention in AI operations to the extent necessary.
2 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers, business users, and data providers should ensure quality of data used for AI training and other functions, considering the characteristics and usage of the AI system.
- ObligationApplies to: ProviderDrafted by the Index
Providers, business users, and data providers should establish accuracy reference levels in advance based on the magnitude and frequency of potential rights infringement, available technology and maintenance costs, and retrain the AI if accuracy falls below these levels.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should inform consumers in advance of risks that AI security may become vulnerable through learning inaccurate or inappropriate data.
3 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should ensure interconnectivity and interoperability of networked AI systems are designed with consideration for their characteristics and usage to promote safe collaboration.
- ObligationApplies to: ProviderDrafted by the Index
Providers, business users, and data providers should comply with standardized data formats and protocols that include syntax and semantics to enable collaboration among AI systems and with other systems.
- ObligationApplies to: ProviderDrafted by the Index
Providers, business users, and data providers should analyze risks that may arise or intensify through AI networking, such as loss of control, share identified risks with cooperating parties, and organize preventive measures and countermeasures.
4 2 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should implement necessary precautions based on developer guidance to prevent harm to human life, bodies, or property through actuators or devices when deploying AI in such contexts.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should establish contingency procedures in advance to address situations where AI damages human life, bodies, or property through actuators or devices, and communicate these procedures to consumers.
5 5 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should implement reasonable security measures appropriate to the technology level to protect the confidentiality, integrity and availability of AI systems.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should establish protocols to respond to security breaches, considering the usage, characteristics and potential impact of the AI system.
- ObligationApplies to: ProviderDrafted by the Index
Providers should furnish end users with security services for AI systems and share information about past incidents and accidents.
- ObligationApplies to: ProviderDrafted by the Index
Providers should inform end users and third parties about security breach countermeasures and the risks of vulnerabilities in trained models.
- ObligationApplies to: DeployerDrafted by the Index
End users should implement security measures and report security concerns to providers, developers and data providers.
6 4 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should evaluate and put in place safeguards to prevent privacy harms affecting end users and third parties from AI use.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should share information about privacy safeguards with end users and third parties.
- ObligationApplies to: ProviderDrafted by the Index
Providers, business users and data providers should honour privacy protections when gathering, readying and supplying personal data for AI model training.
- ProhibitionApplies to: ProviderDrafted by the Index
Providers, business users and data providers must prevent sharing personal data with third parties without the permission of the individuals to whom it pertains.
9 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should record and keep logs of AI inputs and outputs to enable verification of how the system performs.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should ensure explanations of AI decisions are understandable, taking into account the social context, especially when the AI operates in fields that significantly impact individual rights.
- ObligationApplies to: Public authorityDrafted by the Index
Administrative bodies should explain the results of decisions made by AI while maintaining compliance with legal requirements and administrative transparency principles.
10 4 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should communicate information about AI system characteristics to stakeholders and fulfill accountability to parties affected by the AI.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should create and publish policies on AI use so that consumers and third parties understand when and how AI is being used.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should proactively notify consumers and third parties when their rights and interests may be seriously affected by AI decisions.
- ObligationApplies to: ProviderDrafted by the Index
Providers and business users should publish or notify stakeholders about AI usage not only before the system is deployed but also when AI behavior changes or when use is terminated.
Change history
No changes recorded since we began monitoring this policy.