Japan's July 2027 Local-Government IT Procurement Rule: JC-STAR, ISMAP and the 'China Ban' Reports

Hello, this is Ryuta Hamamoto from TIMEWELL.

On April 17, 2026, Nikkei ran the headline "Local governments' IT equipment to exclude Chinese products," and three days later Kyodo News reported that Japan would "effectively exclude" Chinese IT from local-government procurement¹². When I published the first version of this article on April 24, I leaned on those reports and wrote that Chinese-made products would effectively disappear from local-government procurement.

Since then, the policy has turned into documents. On June 26, Japan's Ministry of Internal Affairs and Communications (MIC) promulgated an ordinance amending the Regulation for Enforcement of the Local Autonomy Act, and on July 31 it sent local governments a procurement handbook³⁴⁵. Reading the originals, I found several things in my first version that needed fixing. There are three registration schemes, not two. The rule is "registered products as a rule," not "certified products only," and unregistered equipment still has a path. No country or company is named anywhere. And the start date is July 1, 2027, not a vague "summer 2027."

This update rebuilds the article from the ordinance, the Director-General's notice and the handbook, and keeps news coverage and government statements in separate boxes. If you sell hardware, cloud services or maintenance into Japanese local government, directly or through a systems integrator, treat this as a map of what you will be asked for. If you want a quick read on your own export-control and counterparty-screening setup, try our free export-control readiness check.

Question	Answer as of October 4, 2026
Legal basis	Amended Regulation for Enforcement of the Local Autonomy Act (MIC Ordinance No. 80 of 2026, promulgated June 26). In force July 1, 2027
What should be bought, as a rule	Products registered under JC-STAR, ISMAP (including ISMAP-LIU) or the Digital Marketplace
Is unregistered equipment banned?	No. It can be bought if the local government confirms adequate supply-chain risk measures
Are countries or companies named?	No. The test looks at the legal environment where suppliers' headquarters sit and at outside instructions
What about systems already running?	Systems in place and outsourcing already under way when the rule takes effect stay under the previous rules
"De facto China ban"?	That was how April news reports characterized it. In May, MIC was reported as saying it would not restrict equipment by country of manufacture or certification scheme

---

What was actually decided: three documents

The rule sits in three documents. The first is the ordinance promulgated on June 26, 2026 (MIC Ordinance No. 80 of 2026)³. An amendment to the Local Autonomy Act promulgated in June 2024 obliged local governments to take the measures needed to use information systems properly. The ordinance spells out what those measures are. The new Article 16-3 lists eight items, from governance and information-asset classification to physical, personnel and technical controls, outsourcing and cloud use, and evaluation and review.

The second is a notice issued the same day by MIC's Director-General for Local Administration (Sogyosa No. 42)⁴. It fixes the effective date at July 1, 2027, and an annex sets out what supply-chain risk measures mean in practice. The third is the July 31 handbook (notice Sogyosa No. 54), which gives procurement staff ready-to-use selection criteria and sample specification language⁵⁶. Both the notice and the handbook are framed as "technical advice" under Article 245-4(1) of the Local Autonomy Act; the binding piece is the ordinance itself.

Item	What the documents say
Effective date	July 1, 2027
Who is covered	Prefectures and municipalities, with notice to special-purpose associations, regional unions and local incorporated administrative agencies. Bodies that are not connected to networks affecting important national or local systems and do not hold large volumes of personal data, and public safety commissions, are carved out
Assets in scope	Communication lines and routers, servers, PCs, mobile devices, multifunction printers, operating systems, software, drones, network cameras, cloud services, storage media such as USB drives, design documents and more
The rule	Depending on the asset's classification, buy products registered under the government evaluation and registration schemes
If not registered	Buy products for which the local government can judge that adequate supply-chain risk measures are in place
Transition	Systems in place and outsourcing under way at the effective date stay under the previous rules. Procurement before that date should follow the same intent as far as possible

The three schemes are worth knowing by name. JC-STAR is a security labeling scheme for IoT products run by IPA (the Information-technology Promotion Agency) under the Ministry of Economy, Trade and Industry; the handbook's sample specification asks for a label at STAR-1 or higher. ISMAP is the government's security assessment program for cloud services, operated jointly by the National Cybersecurity Office, the Digital Agency, MIC and METI, and it includes ISMAP-LIU for low-impact SaaS. The third, which I left out of the first version, is the Digital Marketplace (DMP): a catalog launched in fiscal 2024 where vendors that have signed a framework agreement with the Digital Agency register software and services⁴⁶. For more on ISMAP itself, see our ISMAP and SCS explainer.

The handbook also spells out the route for unregistered equipment, including product categories JC-STAR does not cover, such as PCs and smartphones. Four checks apply. Manufacturing and development must be controlled so that unauthorized changes cannot be made. Equipment must not be bought if concerns cannot be dispelled that the legal environment where the manufacturer's, supplier's or maintainer's headquarters sits (including the headquarters of anyone holding a direct or indirect voting majority), or instructions from outside parties, could lead to malicious functions or data theft. Security should be assessable through third-party certification or audits based on standards such as ISO/IEC 15408. And where transparency is needed, the vendor should produce and provide an SBOM (software bill of materials)⁶.

On process, the contractor submits a list of candidate equipment in advance, and if the local government cannot dispel a concern, the two sides work out an alternative. For procurements handling information at local-government confidentiality level 2 or higher, bidders submit a confirmation letter and the local government returns an acceptance letter; the sample language even says acceptance is deemed given if the local government does not respond within the set period⁶. For cloud, the notice says local governments may decline to use a service if the laws of the country where the data center sits create a risk that data could be forcibly disclosed to foreign law enforcement without proper, transparent procedures⁴. It also points to award methods that weigh factors beyond price.

If I had to pick the heaviest item for vendors, it would be the equipment list and the confirmation letter. You need answers not only about your own product, but about component sources, maintenance subcontractors and their parent companies. We put the questions worth asking your own supply chain into a Supply-Chain Due Diligence Self-Check Sheet (free; registration with your company name and work email required).

---

Who called it a "de facto China ban"?

The phrase came from the April coverage. Kyodo reported that MIC had decided to require local governments to buy only products certified under government evaluation schemes, and added that because no Chinese products were among them, Chinese products would effectively be excluded². Nikkei's headline said much the same¹. Those were the news organizations' characterizations. The government documents do not use that language.

Read in order, the government side is consistent. The working group report MIC published on April 20 recommended folding supply-chain risk measures into the ordinance, without naming any country⁷. On May 7, Nikkei xTECH reported that some coverage describing a de facto restriction on Chinese products had triggered a wave of inquiries to MIC, and that MIC denied it, saying it would not restrict equipment by country of manufacture or by certification scheme⁸. Nikkei followed up on May 29 with the headline "Legal force for local cybersecurity: no exclusion of Chinese products, but stricter selection"⁹. The June notice and the July handbook name no country or company either. Neither does the central government's 2018 procurement agreement¹⁰.

There is a gap in tone between "we will not restrict by certification scheme" in May and "registered products as a rule" in June. My reading is that the two fit together: registration is the default entry point, and unregistered products can still be bought if the local government can verify the controls. What April's reports called "certified products only" became, once written down, a default plus a verification route.

What about JC-STAR itself? I counted IPA's product list as updated on October 1, 2026: 355 registrations from 145 companies, all at STAR-1¹¹. In the categories local governments are most likely to buy, there are 88 communication devices such as routers and switches, 42 security devices such as network cameras, and 6 office devices such as multifunction printers. The list has no column for nationality, and it includes overseas vendors and Japanese subsidiaries of foreign companies. The published rules contain no clause excluding companies from any particular country, though the application form asks for the headquarters location of the applicant, the manufacturer and their parent companies. I cover that in detail in JC-STAR and Chinese products: what the label list shows.

So what happens in actual procurement? Because the handbook uses the legal environment at a supplier's headquarters as a starting point for checking concerns, the amount of documentation a vendor is asked for may well depend on where it is headquartered. But that is a product-by-product judgment by each local government, which is different in kind from a blanket ban. Whether a product carries a JC-STAR label or appears on the ISMAP list is a regulatory status, not a judgment about the company behind it. Japanese or foreign, any vendor offering unregistered equipment will be asked whether it can produce the evidence the verification route requires.

---

Why local governments?

Japan's central ministries have handled supply-chain risk in procurement of important systems and equipment since an interministerial agreement of December 10, 2018¹⁰. A similar agreement on drones used by government bodies followed in September 2020¹². Local governments were already asked to manage these risks under MIC's information security policy guidelines, but the details were not set in law.

The notice gives its reasoning plainly. National and local government systems are interconnected, so an incident exploiting a supply-chain weakness at a local government is highly likely to spill over into central government, and local governments therefore need to move in step with the center⁴. The working group report adds that awareness of supply-chain risk is still developing at the local level, and that many local governments lack the setup to assess risk with current intelligence and manage procurement accordingly⁷.

From the local side, the picture is messier. More than 1,700 municipalities run their own tenders, with very different budgets and staffing. According to the working group report, large water utilities run by local governments already fall under the critical infrastructure regime of the Economic Security Promotion Act, which requires notification and review before key equipment is installed⁷. So within one local government, the water utility might go through national review while network gear in city hall is bought department by department. I read the ordinance as an attempt to even out that patchwork through legal detail.

Real incidents added pressure. At a July 3 press conference, then-Minister Yoshimasa Hayashi said that after malware was detected on USB drives held by the Ground Self-Defense Force, MIC had sent local governments a notice on June 26 about proper handling and procurement of USB drives, and planned a survey of their use during July¹³. On August 4 he sent a letter to every governor and mayor asking leaders to secure budgets and staff for cybersecurity themselves¹⁴. MIC also plans a general helpdesk that will take questions on supply-chain risk, and a vulnerability scanning system (an attack surface management platform) that all local governments can use, to be built during fiscal 2026⁴¹⁴.

---

The timeline since 2018

In the first version I called this the Takaichi administration's certified-products policy. The ordinance was promulgated in the name of MIC Minister Hayashi in the Takaichi cabinet, so it is true that it was decided under this administration³. But the amendment that put the obligation on local governments was promulgated in June 2024, under the Kishida cabinet⁴, and the central-government agreement dates to 2018. The documents read less like a signature initiative of one administration and more like a steady administrative effort to bring local governments in line with rules the central government has followed for years.

Date	Event
Dec 2018	Interministerial agreement on supply-chain risk in central-government IT procurement10
Sep 2020	Interministerial agreement on drone procurement by government bodies12
May 2022	Economic Security Promotion Act enacted
May 2024	Pre-review regime for critical infrastructure goes live
Jun 2024	Local Autonomy Act amendment promulgated, obliging local governments to use information systems properly4
Mar 2025	JC-STAR begins accepting STAR-1 applications11
Apr 2026	News reports (17th and 20th), working group report published (20th), public comment on the draft ordinance (24th to May 25, nine comments)715
Jun 2026	Ordinance promulgated and Director-General's notice issued (26th)34
Jul 2026	Procurement handbook issued (31st)5
Jul 2027	Ordinance takes effect (1st)

When I wrote the first version in late April, the same week also brought a government order to halt the planned Makino Milling acquisition (April 22) and Lower House passage of the National Security Information Council bill (April 23; enacted May 27). The local-government story was widely covered as part of that run of news, but MIC's documents do not link it to either. Lined up together they look like one push; in substance, each sits on its own statute and process.

The public comments included calls for clearer rules on foreign companies and overseas clouds, and worries about the burden on small municipalities. MIC answered that the ordinance simply details the measures required under the Local Autonomy Act, and that further clarification would be considered going forward¹⁵.

---

What changed since the April version

My first version was built on news reports, so a fair amount has shifted now that the documents are out. Here are the main corrections.

Point	First version (April 24)	Now (October 4)
Procurement approach	Certified products only (JC-STAR, ISMAP)	Registered products as a rule, across three schemes: JC-STAR, ISMAP (including ISMAP-LIU) and the DMP. Unregistered equipment allowed after local verification
Equipment in scope	PCs, tablets, communications gear, servers, cloud	Information assets broadly. JC-STAR does not cover PCs or smartphones
Ordinance	Revision planned for June 2026	Promulgated June 26 (MIC Ordinance No. 80 of 2026)
Start	Summer 2027	In force July 1, 2027
Existing equipment	Switch to certified products at renewal	Systems and outsourcing in place at the effective date stay under previous rules; earlier procurement should follow the intent as far as possible
Chinese products	Stated as effectively excluded	Presented as the press characterization. No country named in the documents; MIC reportedly said it would not restrict by country of manufacture
Who decided	The Takaichi administration	An MIC ordinance based on the 2024 Local Autonomy Act amendment, promulgated by a minister in the Takaichi cabinet
Critical infrastructure sectors	14	15 today, with healthcare to be added under an amendment promulgated in June 2026
China's measures on Japanese entities	A 40-entity list in February	Two rounds, February and June, 80 entities in total

The biggest change is the move from "certified only" to "default plus verification route." Under my original reading, unregistered products would have been shut out of tenders across the board. The handbook does not say that. Without registration, a product can still qualify if the vendor can show manufacturing controls, dispel concerns tied to headquarters location, and provide third-party certification and an SBOM. The flip side is that vendors offering unregistered products carry more of the explanatory burden.

The sector count was simply wrong in my first version. There are currently 15: electricity, gas, oil, water, railways, trucking, international shipping, port transport, aviation, airports, telecommunications, broadcasting, postal services, finance and credit cards. An amendment to the Economic Security Promotion Act promulgated on June 17, 2026 adds healthcare¹⁶. China's measures also needed updating. China's Ministry of Commerce placed 40 Japanese entities on its Export Control Control List and Watch List on February 24, and another 40 on June 29 (MOFCOM Announcements No. 11, 12, 27 and 28 of 2026)¹⁷. The full list is in Japanese companies on China's export control lists. Listing is a regulatory designation, not a verdict on those companies. No official statement ties the two countries' measures together as cause and effect, so I simply record them side by side.

---

What reaches private companies: three kinds of requests

The ordinance binds local governments, but much of what the handbook asks for reaches contractors through specifications.

First, companies that supply hardware, cloud or maintenance to local governments. The sample language asks for proof of a JC-STAR label (STAR-1 or higher), proof of listing on ISMAP or ISMAP-LIU, and proof of registration on the DMP. Add the advance equipment list and, for confidentiality level 2 and above, the confirmation letter. For unregistered equipment, expect questions about quality assurance in manufacturing, access controls in production environments, headquarters details, third-party certification and SBOMs. Subcontractors and maintenance contractors are in scope, so systems integrators need to know who sits under them.

Second, critical infrastructure operators and the companies that equip them. Designated operators in the 15 sectors already notify the government and undergo review before installing key equipment or outsourcing its maintenance. I explain the regime in Japan's critical infrastructure pre-review system. Once healthcare is added, the same logic will reach companies supplying hospitals and health-data platforms.

Third, companies that receive questionnaires from overseas customers. U.S. customers sometimes send questionnaires about how you screen counterparties and where your components come from, and records prepared for Japanese local governments can help answer them. In the United States, since March 2026, new models of foreign-produced consumer routers can no longer obtain FCC equipment authorization unless they fall under exceptions such as conditional approval. I compare the U.S. and Japanese approaches, including the fact that Japan bans neither purchase nor use, in home routers under U.S. and Japanese rules. For how the U.S. debate spread to consumer devices, see the U.S. campaign on connected devices.

"We don't sell to cities" is not a safe answer. If a local government or infrastructure operator sits further down your customer chain, you may be asked to help with the confirmation letter or equipment list. In my view, the hard part is less the request itself than the fact that the answers are scattered across the company. Component sources sit with procurement, manufacturing controls with quality assurance, and contracts with parents and subcontractors with legal, so one confirmation letter can mean a tour of three departments.

---

Open issues

Few people argue with the direction, but implementation still raises questions.

Cost and staffing come first. Replacing equipment and rewriting specifications weighs most on small municipalities with thin budgets and few specialists. Public comments raised the worry that a uniform standard might be read as applying regardless of risk¹⁵. MIC points to the helpdesk, the shared vulnerability scanning system and local fiscal support, but the helpdesk details are still "to be notified"⁴¹⁴.

JC-STAR's coverage and depth have limits. PCs and smartphones are out of scope, and all 355 registrations so far are STAR-1. STAR-1 and STAR-2 are vendor self-declarations, and IPA itself says a label marks a minimum baseline rather than a guarantee of security¹¹. STAR-3 and STAR-4, meant for important systems at government bodies, local governments and critical infrastructure, rely on third-party evaluation; so far, STAR-3 requirements have been published for communication devices and network cameras, and the rules for approving evaluation bodies are being put in place. On July 31, IPA posted a notice that applications had surged and reviews were taking longer than usual¹¹. How many products are registered by July 2027 will shape how heavy procurement feels on the ground.

Transparency of the yardstick is another issue. Each local government decides whether a concern "cannot be dispelled," so the same product could get different answers in different places. Whether MIC's helpdesk works as a pre-check will matter for consistency. And if registration starts to act as a de facto entry ticket, competition will feel it. How non-price factors are scored in tenders is something to watch in upcoming notices.

---

What global vendors and procurement teams should do

What to prioritize depends on where you sit.

If you supply local governments or critical infrastructure, directly or through an integrator, list the JC-STAR, ISMAP and DMP status of every product you propose. For anything unregistered, check how much you can show on manufacturing controls, headquarters and parent details, third-party certification and SBOMs. The rule takes effect on July 1, 2027, but the notice asks for the same care in procurement before then, so the language may show up in specifications from next fiscal year.

If your Japan business touches U.S. or European customers, keep records ready on the equipment, components and cloud services you use and on how you screen counterparties. The handbook's "headquarters" includes the headquarters of any parent holding a voting majority, which looks a lot like the ownership checks export compliance teams already run.

If you are just starting, I think the realistic first step is to move four things out of people's heads and into records: counterparty screening, export classification, deemed-export controls and access control for technical data.

Our AI export-control agent TRAFEED is built for that record-keeping. It acts as a first-pass analyst: it screens counterparties against U.S., Japanese, EU, Chinese and Taiwanese lists, surfaces a risk view in about five seconds, and keeps the basis for each decision and the approval trail on file. It also drafts a first-pass Japanese export classification from product specs. Your export control officer makes the final call. It does not look up JC-STAR status, but keeping explainable records about counterparties and supply chains is the same muscle these procurement rules exercise.

If you are reviewing supplier-screening workflows, the TRAFEED product catalog (PDF) has the overview.

---

Summary

• From July 1, 2027, the amended Regulation for Enforcement of the Local Autonomy Act (MIC Ordinance No. 80 of 2026) makes registered products the default for local-government IT and cloud procurement
• The schemes are JC-STAR (STAR-1 or higher), ISMAP (including ISMAP-LIU) and the Digital Marketplace; PCs and smartphones are outside JC-STAR
• Unregistered equipment can still be bought if the local government can verify manufacturing controls, concerns tied to headquarters location, third-party certification and SBOMs
• "De facto China ban" was the April press characterization; the documents name no country or company, and MIC was reported as saying it would not restrict by country of manufacture
• Systems and outsourcing in place when the rule takes effect stay under the previous rules, but earlier procurement is asked to follow the intent

Read only the headlines and this looks like a clash between countries. Read the documents and it is a quieter, more procedural ask: every time you buy, check who built it, who maintains it, and whose laws that company answers to. Vendors that can hand over the equipment list and the confirmation letter without scrambling will be the easier ones to buy from.

For TRAFEED details or a demo, see the product page. To talk through your own situation, book a consultation.

---

References

Footnotes

1. Local governments' IT equipment to exclude Chinese products; only government-certified products allowed — Nikkei — April 17, 2026 (news report, Japanese) ↩ ↩²

2. Local governments to effectively exclude Chinese IT; MIC ordinance revision, operations from next summer — Kyodo News via Akita Sakigake Shimpo — April 20, 2026 (news report, Japanese) ↩ ↩²

3. Results of public comment on the draft ordinance amending the Regulation for Enforcement of the Local Autonomy Act (promulgation) — MIC — June 26, 2026. Ordinance text: Annex 2 (MIC Ordinance No. 80 of 2026) (Japanese) ↩ ↩² ↩³ ↩⁴

4. Notice on the promulgation of the ordinance amending the Regulation for Enforcement of the Local Autonomy Act (Sogyosa No. 42) — MIC Director-General for Local Administration — June 26, 2026 (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

5. Notice on the handbook for selection criteria and specifications for supply-chain risk measures in local-government equipment procurement (Sogyosa No. 54) — MIC — July 31, 2026 (Japanese) ↩ ↩² ↩³

6. Handbook for selection criteria and specifications for supply-chain risk measures in local-government equipment procurement — MIC — July 2026 (Japanese) ↩ ↩² ↩³ ↩⁴

7. Publication of the working group report on support and effectiveness of local-government cybersecurity — MIC — April 20, 2026. Report: PDF (Japanese) ↩ ↩² ↩³ ↩⁴

8. MIC makes cybersecurity measures mandatory for local governments; no exclusion of Chinese products, but stricter selection — Nikkei xTECH — May 7, 2026 (news report, Japanese) ↩

9. Legal force for local cybersecurity: no exclusion of Chinese products, but stricter selection — Nikkei — May 29, 2026 (news report, Japanese) ↩

10. Interministerial agreement on procurement policy and procedures for IT procurement by the national government (December 10, 2018; partially revised July 6, 2021) — reproduced by the Fire and Disaster Management Agency (Japanese) ↩ ↩² ↩³

11. JC-STAR (Labeling Scheme based on Japan Cyber-Security Technical Assessment Requirements) — IPA (accessed October 4, 2026); List of products with conformance labels — IPA — updated October 1, 2026 (Japanese) ↩ ↩² ↩³ ↩⁴

12. Policy on procurement of unmanned aircraft by government bodies (interministerial agreement, September 14, 2020) — reproduced by the Fire and Disaster Management Agency (Japanese) ↩ ↩²

13. Press conference by Minister Hayashi — MIC — July 3, 2026 (Japanese) ↩

14. Press conference by Minister Hayashi (ministerial letter on local-government cybersecurity) — MIC — August 4, 2026 (Japanese) ↩ ↩² ↩³

15. Comments received on the draft ordinance and MIC's responses — MIC — June 26, 2026 (Japanese) ↩ ↩² ↩³

16. Regime for ensuring stable provision of critical infrastructure services — Cabinet Office (accessed October 4, 2026) (Japanese) ↩

17. MOFCOM Announcement No. 11 of 2026 — Ministry of Commerce of the People's Republic of China — February 24, 2026; MOFCOM Announcement No. 27 of 2026 — June 29, 2026 (Chinese) ↩