Japan's Digital Agency Begins Phased Rollout of AI Agent Environments for About 180,000 Government Staff, With a "Gennai Standard" Setting Duties for Users, Administrators, and Developers

Japan's Digital Agency announced on October 20, 2026 that it is starting to offer AI agent environments in Government AI Gennai. Agent Chat is being introduced in phases from that day, and Gennai Kobo is targeted for around December. The Gennai Standard, released alongside, sets out obligations for users, administrators, and developers.

Digital-Agency Gennai AI-agents AI-governance Japan public-sector security

On October 20, 2026, Japan’s Digital Agency said it would start providing two kinds of AI agent environments to roughly 180,000 government employees through Government AI Gennai, its generative AI platform for civil servants¹. “Agent Chat,” which lets staff build and run AI agents with little effort, is being rolled out to ministries and agencies in phases starting that day. “Gennai Kobo” (roughly, “Gennai Workshop”), an environment for building more advanced agents, is targeted for introduction by around December 2026 (Reiwa 8).

The agency also published the “Government AI Gennai Standard on Governance, Security, and Safety” (the Gennai Standard), which lays out the basic thinking and the rules to follow when using AI agents. The standard assigns duties and obligations separately to “users,” “administrators,” and “developers,” and the agency says it was drawn up with the cooperation of Japan’s AI Safety Institute (AISI)¹. The Digital Agency says it believes the standard can also serve as a model case for local governments and private companies considering AI agent environments. For anyone responsible for handing agents to employees inside a company, it reads as a template for writing such rules.

A Simple Chat and a Coding-Agent-Style Workshop

The two environments are separated by how much freedom they give and how high the bar for access is. Agent Chat is a full-featured chat available from Gennai’s web interface; from a single screen, staff can draft documents, analyze data, run code, and use or create skills². Gennai Kobo is a development environment assigned to each user, where the agent can chain file operations, command execution, and web retrieval across many steps. It is meant for staff who need exhaustive research or who want to build working prototypes themselves.

The agency says that, according to its own survey, rolling out an environment equivalent to an AI coding agent — one that autonomously generates and edits code, handles files, and runs commands from natural-language instructions — as a shared government platform that ordinary staff, not only specialists, can use day to day at the scale of about 180,000 people would be a world first¹.

What Users Must Do: No Unchecked Copying, No Unapproved AI

Chapter 2 of the Gennai Standard sets out obligations for users (government employees)². On human review, it says staff should not copy AI output into administrative materials or official documents without checking it, should confirm or approve before important steps when the AI runs several operations in a row, and should themselves decide whether high-impact operations such as updating or deleting files go ahead.

On prompt injection, the standard gives examples of techniques to watch for, including instructions hidden in white or tiny text, instructions disguised as a “system message,” and attacks split across multiple documents that combine into an improper action. The risk of text arriving from outside and steering an agent step by step was also illustrated in the self-replicating prompt injection that OpenAI reported in September.

Using generative AI services the organization has not approved — so-called shadow AI — is prohibited. The standard gives concrete examples, such as pasting a work email into a personal-account AI service to get a draft reply. Users are also responsible for “token management”: with usage-based billing in mind, they should not pick an overly powerful model for the difficulty of the task.

Administrators: Controls That Don’t Depend on Individual Care

For practitioners in companies, Chapter 3, written for administrators, and the descriptions of functional restrictions are likely to be particularly easy to apply. Administrators include each ministry’s Chief AI Officer (CAIO) and information system managers, and each ministry decides exactly who fills the role². Administrators are responsible for organizational controls that do not rely solely on the care of individual users, and for business that affects people’s rights and interests — such as licensing and permits, benefits, adverse administrative actions, and hiring — they must appropriately restrict the use of Agent Chat.

Gennai Kobo is a step stricter. It is unavailable by default; administrators grant access based on applications from staff who have been confirmed to meet a certain level, for example through a literacy check.

Some of these controls are built into the system rather than left to users’ discipline. Among the measures the standard lists as of October 2026 are the following:

Agent Chat can overwrite or delete only files the AI generated; original files that users upload cannot be altered by the AI
Gennai Kobo blocks outbound data transmission (POST/PUT and the like) at the system level, while GET requests needed for web search are logged with destination, volume, and time
Inputs, outputs, and external communications in Gennai Kobo are recorded in a format protected against tampering

Gennai Kobo also checks input text with a guardrail product and asks the user before sending when personal information or credentials such as API keys appear to be present, though the standard itself notes that this is not a complete safeguard. Placing an inspection layer before content reaches the model has something in common with Claude Enterprise’s inference hooks.

Developer Controls, and What Is Still Under Consideration

Chapter 4 covers Digital Agency staff who develop and operate Gennai, along with contractors². The default in production is “zero-touch operation,” in which people do not directly access user data, and changes to production require review by another developer and approval by an authorized official. Security-relevant logs must be structured so that no one, developers included, can alter or delete them, and that immutability is to be enforced by technical means rather than by operating discipline alone.

Some pieces are not settled yet. A “tenant administrator function” that would let each ministry’s administrators suspend users or configure which models are available is still at the stage of being considered². Until then, the standard says the Digital Agency will handle suspensions after receiving reports from administrators. A function that would make AI usage records mandatory for high-risk work, and a review process for “Gennai Library,” where skills created by staff are shared across ministries, are likewise described as under consideration or to be developed. Not every management function is in place at launch — worth keeping in mind for any organization using the standard as a reference.

From In-House Use in May 2025 to Open Source

Gennai is a generative AI environment the Digital Agency built in-house for its own staff in May 2025, offering apps such as tools for searching past Diet answers and researching laws and regulations³. The agency published it as open-source software on April 24, 2026, and on May 28 began a large-scale trial covering about 180,000 employees across all ministries. It says the trial is intended to lead to full adoption from fiscal 2027 onward.

On the policy side, this sits on the path laid by the AI Promotion Act and the AI Basic Plan (approved by the cabinet on December 23, 2025). The Gennai Standard cites the Second AI Basic Plan and the “Priority Policy Program for Realizing a Digital Society,” both approved by the cabinet in July 2026, as the background to its drafting².

Agent Chat and Gennai Kobo are scheduled to be released as “Gennai OSS Ver.2.0,” which anyone may use, modify, and redistribute, around February 2027 (Reiwa 9)¹. The standard is explicit, however, that using the open-source code does not by itself produce a safe environment: the adopting organization must put access management, log management, user training, and similar measures in place on its own responsibility². For a company handing Claude Cowork or Claude Code to its employees, the more useful reference is probably not the code but this division of who is allowed to do what, and what the system itself stops.