Reading Japan's Technology Leakage Guidance, Second Edition (Part 2 of 2)

Hello, this is Ryuta Hamamoto from TIMEWELL. This is Part 2 of a walkthrough of METI's Technology Leakage Prevention Guidance, Second Edition, following the original.

Part 2 covers Chapter 4 on joint research, Chapter 5 on supplier and customer coordination, and the reference section on the research security procedure. After that, based on the original, I give my own suggestion for the order in which a small company might begin. Chapters 0 to 3 (aims, common measures, overseas sites, leakage through people) are in Part 1. Because the joint research and coordination chapters also rely on measures for people, reading Chapter 3 in Part 1 first makes the connections easier to see.

Each factual statement carries a footnote with the chapter, section, and page. The page numbers match both the position in the PDF and the number printed at the bottom right of each slide.

Chapter 4: leakage through joint research

Chapter 4 is about stopping your technology from leaking through research partners and participants when you do joint research with other companies or universities. The document opens by saying that innovation depends on bringing in outside knowledge and that, from the viewpoint of economic security too, stronger international joint research is needed. It then says joint research assumes technology is shared with other organizations and other countries, so leakage risk is high, and that appropriate management according to theme, content, and partner is important.¹

Partners differ. Large and small companies differ in scale and structure; companies and universities or national research institutes differ in governance, research purposes, and the people involved; foreign companies and universities follow different laws and customs. Cooperating firms such as equipment and materials makers and testing institutions may also need to be considered.¹

Where the risks are in joint research

The document lists the leakage that can occur at each phase. In the preparation phase: choosing a sensitive theme, choosing an untrustworthy partner, and careless exchanges during preliminary talks. In the execution phase: improper removal by the partner's insiders, use outside the purpose by the partner, a third party stealing the partner's information, changes in the partner's capital structure or a worsening of its finances, and unintended use arising from unclear handling of intellectual property. After execution: security weaknesses, secondary leaks from the partner's subcontractors, monopolized or improper use of results, unexpected publication of results, and the partner's inadequate disposal of information.¹

It matters that this can happen without ill will. "Leakage through the partner's carelessness" and "accidental or negligent leakage by either side" are listed separately, so joint research measures read as designed for the case where even a well-meaning partner can leak, not as a way to suspect them.

From the case studies

There are four cases. I summarize them within the facts given, without company or country names.²

The first concerns preliminary talks. After signing an NDA and holding preliminary talks, a company showed a prototype, and the partner's technical lead took photos without permission. A few months after talks were broken off, the partner used what it learned from the photos to file for a patent and obtained several. The company that showed the prototype sued for transfer of the patents and for damages for breach of confidentiality.

The second concerns joint research commissioned to a university. Data on technology that could be subject to export control was freely viewable by several students, who actually viewed it. The professor also took the data abroad and provided it. A university staff member's report exposed this, the professor's PC was seized on return, and the professor was convicted of violating export control law, among other things. The original refers to parts on deciding who takes part in joint research, partner due diligence, specifying members and handling methods, and monitoring clauses.

The third concerns a comprehensive joint development at a domestic plant. An engineer working at the partner's Japanese subsidiary copied research data without permission and later moved to a competitor in a third country, which used the data. Management noticed the competitor's sudden progress, investigated, and found it.

The fourth concerns the end of joint research. A food manufacturer provided a researcher at a university with samples containing cells with a special effect, under an NDA that covered return and disposal after the contract ended. After the company withdrew, the university agreed to dispose of the information. Years later the university filed a patent on a microbe with a similar effect and developed several related products. The manufacturer had an outside lab analyze it, concluded it was identical, and sued the university on suspicion that the researcher kept and misused the information.

In all four cases a contract existed and did not prevent the leak. What decided each was operation outside the contract: preliminary talks, handling of students at the contractor, working side by side at a site, and disposal after the end.

The planning stage

Planning covers the research team, the theme, and the partner.

First, build a risk management process into internal workflow. The document asks for a rule covering a series of steps: do due diligence from three angles (country, counterparty, and individuals involved), assess the risk, take steps to reduce the chance of leakage, and follow up on operation and feed it back into internal review. It also gives as an example involving a department separate from the research unit in due diligence, as a check and balance.³

On your own research team, check the suitability of people who will take part, as needed. Example items include internal information management record, resident or specified-category status, any duty under a contract with a foreign government or under foreign law to cooperate with information gathering, and records of misconduct or convictions. For every item, the conditions for suitability checks covered in Chapter 3 in Part 1 apply.³

For theme selection, evaluate the sensitivity of the theme in the four areas that appeared in Chapter 1 (core technology, technology important to security, technology important to economic security, and technology you want to acquire), weigh the loss from leakage against the value joint research creates, and decide whether to proceed, whether to revise the theme, and what mitigation to use. With a new partner you can start with a safe theme on peripheral technology and later move to more important technology as trust grows. The document also says "do not shrink back excessively." Even in fields important to economic security, joint research with a company that has technology you lack may carry limited leakage risk, and after due diligence and mitigation you should aim for innovation.⁴

Partner due diligence has three angles.

On the country angle, check the other country's legal system and customs. Examples are whether that country's export control law applies when moving results to Japan or a third country, whether rules such as first-filing obligations restrict patents, whether laws impose a duty to cooperate with a foreign government's information gathering, and whether the government can compel access to information held by private companies. Joint research with countries subject to UN Security Council or U.S. sanctions needs prior confirmation from a legal compliance view. When staff travel to the site to check progress, also check security conditions, whether any espionage-related law is applied in an opaque way, and whether other companies have suffered leaks from devices travelers carried.⁵

On the organization angle, check sanctions list entries, past violations and information incidents, information management rules and training plans, and relationships with entities that carry a duty to cooperate with a foreign government's information gathering. For companies, items are shareholder structure (including potential shares), officers, founding date, track record and finances, intellectual property, and past incidents. Thresholds help to measure the strength of a relationship, such as holding 50 percent or more of voting rights, holding one third or more of the officer positions, or holding a golden share. Unlike M&A due diligence, the purpose is only to prevent leakage of your technical information, so adjust the items to the sensitivity of the technology provided and the partner's traits, such as listed or unlisted, domestic or overseas. The document also says it is not appropriate to judge only on whether a leak occurred; what matters is whether the partner responded firmly and put recurrence prevention in place.⁶

For universities, check whether governance works as an organization. The document cautions that faculties and laboratories are often more independent than company departments, so taking only "the university" as the object of due diligence can lead to missed risks or overestimating risk. Set the object as the whole university, a faculty, and a laboratory in combination as needed. METI's Handbook for Protecting Confidential Information at Universities and industry-academia guidelines are also given as references.⁶ The system on the university and research institution side is summarized in our article on research integrity and security.

On the individual angle, even when an organization is not judged high risk, the people who actually handle your information are the participating researchers, so with the partner's cooperation also do due diligence on individuals as needed. For items you cannot confirm directly from the partner's people, such as whether they carry a duty to cooperate with a foreign government, one option is to require confirmation and representations and warranties from the partner in the contract. The document also notes that convictions are sensitive personal information under the Act on the Protection of Personal Information and require the person's consent.⁷ For the same issues from the side of those receiving international students, see our article on admitting international students and research security.

The contract stage

There are eleven items at the contract stage, the largest part of the chapter.

First, sign an NDA early and disclose in stages. Before giving any information, sign a contract with clauses banning use outside the purpose, disclosure to third parties, subcontracting, and copying, covering handling of provided materials and samples, and requiring return and destruction. Make confidentiality survive the end of the contract until information becomes outdated. The conditions for protection as a trade secret are set out in our article on the Unfair Competition Prevention Act and trade secret protection. Before the NDA, do not provide sensitive information and limit yourself to public information; file your own patent first if needed. Do not disclose sensitive information before due diligence on the partner is finished, and even afterward disclose in stages rather than all at once. Using digital rights management tools so the other side can no longer view the information later is also listed.⁸

Second, use your own contract template. If you sign the partner's draft as is, it tends to favor them, so prepare your own template and decide in advance what you will not concede. Add clauses such as representations and warranties or bans on poaching staff according to the partner's risk.⁸

Third to fifth are the purpose and scope of the research, the participating members and how information is handled, and the scope of information provided and ownership of intellectual property. State purpose and theme concretely but, because defining them too narrowly could leave information outside the scope of confidentiality and non-compete duties, leave some breadth, and decide with relevant departments and outside experts. Name participating members in the contract or research plan, and state that no one not listed may handle information. For joint research with universities, students are usually not employed by the university and not covered by its work rules, so the options are to ask for a pledge covering confidentiality, damages, and ownership of results, to keep students who do not submit one out, or to have the university employ them as research assistants under an employment contract. Pledges may also be requested from non-participants in the same lab. For intellectual property, distinguish technology held before the contract (background IP) from technology created in the research (foreground IP) so they do not get mixed, and state ownership and use rights for results. To stop the partner patenting or using it alone, or sharing with third parties without permission, sole ownership by your company or joint ownership is preferable.⁹

Sixth are confidentiality and non-compete duties. Joint research contracts need NDA-like clauses plus confidentiality that continues after the end. For non-compete, an example is prohibiting named participants from joining competitors' research for a reasonable period after the project. Here the document repeatedly cautions to keep in mind the Japan Fair Trade Commission's guidelines on joint R&D. Restrictions to prevent diversion of provided technology are generally unlikely to be a problem, but restricting research broadly beyond what is necessary may be an unfair trade practice. If the relationship between your economic security measures and the antimonopoly law is unclear, consider consulting the Fair Trade Commission.¹⁰

Seventh to ninth are monitoring, termination grounds, and publication of results. Put audit and monitoring clauses in the contract, separating matters best confirmed in person (where information is stored, the state of loaned items and samples) from those confirmed in writing (access rights and logs, changes in participants, sharing with third parties, publication plans). If the partner does not correct problems, be able to terminate. Make mergers, business transfers, changes in control, a worsening of finances, large research grant applications abroad, and addition to sanctions lists matters for prior approval or notice, or grounds for termination. For joint research with universities, publication in papers or at conferences can unintentionally reveal technology, so in the contract agree that provided information is not written in published patent documents, set a non-disclosure period, and require prior written approval before publication and a period for that. It is also recommended to hold a results review before the end and organize documents such as destruction certificates, access-deletion logs, and third-party sharing records.¹¹

Tenth and eleventh are return after the end, and preparing for disputes. Return is the rule, and where it is difficult, require deletion and destruction and ask for a certificate. Manage loaned equipment and samples by serial number. State that damages can be claimed for breach and that an injunction can be sought if leakage is feared. Choose Japanese law or neutral international rules as governing law; because litigation can make technical information public in court records, a private arbitration clause is also useful, with a Japanese institution or, if foreign, a neutral third-country one. Expert review of the clauses by a lawyer is also recommended.¹² How a company decides who sets and who watches these contracts is covered in our article on organizational setup for leakage prevention.

The execution stage

The starting point for the execution stage is that contract measures alone are not enough. The document says that with contract measures only it is hard to reduce the risk of a partner removing samples or misusing information.¹³

Seven items follow. First, create a research plan or laboratory rules that put in writing the management and use policy for data systems and for facilities handling samples, and handling procedures, and have each researcher sign them. Examples are attaching removal-detection tags or GPS trackers to samples and dedicated equipment, and asking the partner to use your loaned devices or cloud with software that leaves an access history, such as electronic watermarks.

Second, ask the partner to strengthen information management and monitor it. Offer training and simple tests for the partner's research members and explain that joint research may stop if the setup is inadequate and that damages may be claimed if technology leaks. Where on-site checks are hard, confirm by written report.

Third, access and physical security. If information is stored on the partner's servers or participants' devices, your control no longer reaches it, so share on a platform where you hold administrative rights, narrow who has access, set view, edit, and download rights in detail, show especially sensitive data only on dedicated viewing terminals, and monitor access logs constantly to block anything abnormal. For research using samples or dedicated equipment, ask the partner for separate facilities, entry logs, or, if possible, conduct the research in your own secure environment.

Fourth, subcontractors and cloud. If the partner outsources part of the work to a third party, make that prohibited in principle or require prior written approval; if approving, do due diligence on the subcontractor too. Impose the same duties on the subcontractor, require reports and audits, and confirm that materials and data are returned and deleted, including by subcontractors, at the end.

Fifth, strong security measures and limits on external tools. Consider strong measures for PCs and networks handling key research data, encrypting especially sensitive data and keeping it on closed networks or offline. Ask joint researchers for multifactor authentication as needed. Evaluate the safety of tools provided by external vendors; if risk is high, do not use them in highly confidential research, and if you do, limit data use by contract and keep a negative list of tools of concern.

Sixth, assign security staff and strengthen cyber defense. For joint research with especially important technical information, it is effective to assign security staff per project. Examples are sharing links that have an expiry date and password, regular vulnerability scans and backups, and phishing drills.

Seventh, a plan for when leakage occurs. Administrators check access and transmission logs for suspicious downloads or bulk sending, and both sides prepare an incident response plan that sets the reporting line and first steps when leakage is suspected.

The mechanisms that support this from the people side overlap with Chapter 3 in Part 1 (training, access rights, devices, detection of behavior). The whole picture of leakage through people is also organized in our article on leakage through people.

The ending stage

Even after the research ends, there remain risks of monopolized or improper use of results and of intellectual property disputes. The document gives two tasks.¹⁴

The first is monitoring and record keeping after the end. Keep in regular contact, for example through results meetings, regularly check the partner's patent filings, papers, and press releases for improper use, and when results with unclear ownership arise, discuss promptly and reach agreement. Keep records such as lab notebooks and experimental data in normal times in case of litigation.

The second is return and disposal of technical information and samples. After requiring return and destruction in the contract, ask for it at the end. When disposal is requested, ask for a destruction certificate, close the information-sharing platform or remove the access given to the partner. Set a deadline for return of samples, and confirm and record their condition on return in order to check whether prohibited reverse engineering occurred.

After Chapter 4, check these points in your own company.

1. Before joint research, does a department other than the research unit look at the sensitivity of the theme and the partner's due diligence?
2. If the partner is a university, have we covered not only the university as a whole but the faculty, the laboratory, and the students involved, through contract and pledges?
3. At the end, is there a procedure to collect destruction certificates, access-deletion logs, and sample return records?

Chapter 5: leakage through supplier and customer coordination

Chapter 5 is about preventing technology from leaking in everyday business, when specifications and processes are adjusted with business partners. The scope has two parts: inside the supply chain (suppliers and customers) and outside it (equipment makers and system companies).¹⁵

The document positions suriawase, the mutual adjustment among parties involved in procuring each part to maximize product performance and quality, as a strength of Japanese manufacturing. It points out that partners are no longer limited to long-standing companies and have spread worldwide, and that in some countries, in return for market access, there is a push to raise the ratio of local procurement, which can lead Japanese companies to add local firms as partners. Diversifying partners cannot be avoided, but because coordination involves sharing various technical information including trade secrets, the risk is high. It names as concerns that a partner could use information shared during coordination to improve its own technology or widen its range of parts.¹⁵

From the case studies

There are three cases, summarized anonymously within the facts given.¹⁶

The first concerns a raw material maker (a supplier). When ordering from the only domestic source of a raw material, the company told it more than necessary about the development policy of its new product. The supplier inferred the new product's performance and manufacturing method and, when selling its raw material, showed that information to several of the company's competitors to expand its sales. By the time the company noticed, competitors had launched similar products, and with no clear evidence to prove a leak, it could not pursue legal responsibility.

The second concerns samples provided to a customer. With licensing in view, a company signed an NDA and sent samples, which came back far past the return date, damaged or partly missing. It judged they had been deliberately destroyed for reverse engineering, strengthened cooperation with government agencies, and reviewed its information security and IP strategy.

The third concerns an equipment maker. A battery maker shared core process data and know-how with an electrode equipment maker under an NDA and asked it to customize equipment. After delivery, the equipment maker used the data and know-how for other purposes, filed its own patent, and sold to competitors. Because the patent publication ended the advantage the know-how had given, barriers to competitors fell sharply.

All three began with giving out too much in ordinary ordering or specification talks, with no ill will required. In the second and third, the contract existed, but control of return and misuse could not keep up.

Before starting a transaction

There are two items before a transaction begins.

In counterparty risk assessment, assess from the viewpoint of technology leakage in addition to the usual credit check. For a new counterparty, besides business, finances, and officers, confirm if possible the character of the top person, reputation in the industry, track record with other companies, and the state of any litigation over technology handling. The document lists five viewpoints: business (if similar business exists and you hold the advantage, they may acquire the technology), finances (risk of being acquired by a competitor or improper acquisition for short-term gain), the top person's character and awareness, officers (if any officer has a duty to cooperate with a foreign government's intelligence activity), and reputation and litigation. If risk is high, avoid or revise the transaction. Unlike M&A due diligence, however, the aim is preventing leakage, so adjust items to the importance of the technology and the counterparty's traits. It also suggests that supply chain strategy consider whether technology will be provided and how important it is, along with lead time and cost.¹⁷

In limiting what you provide before a transaction, the document says it is not rare that staff carelessly explain or show important technical information in sales talks or equipment evaluation. Provide only after signing an NDA, define internally what may be provided and tell the people who attend the talks. Consider code names for proper nouns and black-boxing unneeded parts. Disclose in stages as trust develops.¹⁷

When signing contracts

There are two items.¹⁸

The first is confidentiality duties and handling of information. Coordination is rarely contracted each time and is more often governed by a basic transaction agreement, such as a basic sales agreement or a basic processing contract. Regardless of the contract's name, if technical information may be exchanged for mutual adjustment, the document asks for confidentiality duties in the basic agreement: a ban on use outside the purpose, on provision to third parties, on copying, and return and destruction. When providing important information, also sign an individual NDA, and when sharing information you manage as trade secrets, make the NDA specify the trade secrets to show your intent to keep them secret. This is because whether secrecy management exists is judged per legal entity (per unit of management). To prepare for the partner subcontracting, include clauses that let you know the subcontractors, such as prior approval or notice.

The second is grounds for termination to prepare for capital changes. A partner's worsening finances, bankruptcy, or change in capital structure raises leakage risk, so make mergers, business transfers, and share transfers that change control matters for prior approval or notice, and be able to terminate if an entity of concern would become a new shareholder and gain access to technical information. Terminating alone does not reduce risk, so provide for the return and destruction of data and samples, and carry them out.

Contract review is a part not to leave to legal alone. If frontline staff who understand the technology read through which clauses protect which information, gaps are found.

Inside and outside the supply chain

Inside the supply chain, narrow what you provide both upstream (suppliers) and downstream (customers).¹⁹

With suppliers, your product development policy or technical information may be inferred from procurement exchanges. Keep what you provide to the minimum necessary and do not say how the raw material or material will be used. Decide the range by risk, taking into account the supplier's other customers (whether competitors from other countries are among them) and its size. The original adds that the supplier receiving the information also benefits, since holding more than necessary creates leakage risk and management cost.

With customers, who are often in a stronger position, try to provide as little as possible even when asked for information. When you must provide more, select the information, work on how you explain and express it, keep know-how and manufacturing conditions secret, and code proper nouns. To prevent reverse engineering, consider black-boxing parts that contain core technology. Collect samples without fail. If a customer asks for a process audit, consider beforehand whether to allow it and agree on the specifics. Do not leave it to sales staff; organize internally the content and granularity of technical information to provide. In coordination with overseas entities, apply strict access control to the staff of your local subsidiary, such as limiting it to those seconded from head office.

From both suppliers and customers, you may be asked, against the background of a foreign government's request, to disclose technology or supply chain information. The document says to check the reasonableness of the demand, not simply comply if it seems unreasonable, and to consider consulting METI.

Outside the supply chain, with equipment makers and system companies, technical information provided in specification talks and orders can also leak unintentionally. The measures are, besides confidentiality clauses in the contract, limiting what you provide and spreading procurement. Examples are buying parts from several sources so no single party can tell what each part is for, doing equipment modification and customization yourself as far as possible, and restoring catalog specifications before sending equipment for repair or maintenance. For manufacturing outsourcing that includes customization, ask for staged provision, a request to build an information security setup together with on-site monitoring, and reliable disposal of information after equipment delivery. Where especially important core technology is embodied in equipment or its customization, the document also mentions considering making it in house, in light of cost.²⁰

It also recommends checking partners' information management. Confirm whether an information manager is appointed, whether rules exist, whether training is conducted, and how leaks are handled, and ask them to build the structure. One approach is to encourage partners to obtain third-party certification, with TICS (Technology Information Management Certification) as an example. TICS is covered in more detail in our article on the certification scheme and preparing for it. When outsourcing disposal of technical information to a recycling company, decide whether to outsource at all, and keeping disposal records and being present can help. When using consultants, narrow the information provided after weighing necessity.²⁰

After Chapter 5, check these points in your own company.

1. Do our basic transaction agreements include a ban on use outside the purpose, provision to third parties, and copying, and return and destruction?
2. Do sales staff know, from an internal summary, how much technical information they may discuss with customers and suppliers?
3. Do we look at new counterparties from the viewpoint of technology leakage, not only credit?
4. Do we keep return deadlines for samples and prototypes and a record of their condition on return?

Reference: correspondence with the research security procedure

Finally, a reference section covers the procedure for research security. It was compiled in December 2025 by the Cabinet Office's expert panel on research security and research integrity. It applies to research and development programs designated by the ministry in charge, after consulting the funding agency, as needing especially strict prevention of leakage from an economic security viewpoint, among competitive research funds whose results are meant to be published and that may include technology on the list of important technology areas (called specified R&D programs).²¹

When a company applies as lead institution or collaborating institution to a specified R&D program, it must carry out the risk management the procedure requires. Because the procedure was written with universities and research institutions in mind, a company that is a research institution should consult the guidance as needed. The document adds that, because the guidance also covers overseas expansion and goes beyond the minimum and desirable measures of the procedure, a company subject to the procedure need not follow everything in the guidance.²¹

The risk management the procedure requires runs from routine activities (collecting information declared by researchers, setting up an information management structure, and collecting information about data management), to preparations at application, to risk confirmation and assessment by the application deadline, risk mitigation, and follow-up after the research starts. In the risk assessment, the lead institution has the principal investigator and participants declare 13 items, such as education, research and employment history, funding history, paper authorship, patent filings, and participation in foreign talent programs, and does due diligence. For collaborating institutions and supporters it also checks purpose, track record, finances and capital structure, and listing status. In a column on the right, the document shows which chapter and section of the guidance (Chapters 1, 3, and 4) each item corresponds to. For example, information researchers declare about ties to foreign institutions often amounts to side jobs for company employees, so it points to the side jobs item in Chapter 3.²¹

For companies not involved in research covered by the procedure, this reference section can be read as a model for drafting the due diligence items for joint research. You can set the guidance's Chapter 4 for companies against the procedure for universities and see how each handles the same items.

Stumbling blocks and common misunderstandings

From the above, here are the points where practice tends to stumble, following the original.

One misunderstanding is that following the guidance means complying with law. The document states that it does not explain duties under the Foreign Exchange and Foreign Trade Act or the requirements for trade secret protection. Compliance must be checked separately.

Another is that signing an NDA is enough. The original's cases (preliminary talks for joint research, coordination with equipment makers, and after joint research ends) were not prevented by a contract. The document itself, in the Chapter 2 covered in Part 1, says to keep in mind that contracts are not always observed and to pay attention to implementation as well as content.

Another is that one round of due diligence on the partner is enough. Because the partner's shareholders, finances, and structure change after the contract, the original's approach is to fix prior approval, notice, and termination grounds and confirm through monitoring.

Another is that asking for return or destruction is enough. The original's standard for disposal goes as far as certificates, presence, and on-site checks.

Another is that universities and public bodies are trustworthy and need no checks. Universities are highly independent by laboratory and students are often not employees, so you need to look at faculties, laboratories, and the handling of students.

And the last is that you must do everything. The original says no perfect measure exists, and that small and medium-sized companies in particular cannot do all of it, so they should reliably carry out what they can.

A suggested order for a small company

What follows is my own arrangement based on the original. The original does not provide a priority table. Because it says at the start to reliably carry out the measures that can be done, and puts identification of important technology at the base of Chapter 1, I suggest this order.

First, decide what to protect. Following Chapter 1, confirm the source of your competitiveness and write down where and in what form core technology exists. Second, manage that technology as a trade secret: classify secret information and narrow the people with access. These steps can be started without buying new equipment and form a base that works for every route.

Third, set procedures that fit the flow of people. Review of access rights and return of loaned items when someone gives notice, confidentiality pledges, and rules for devices and generative AI. Chapter 3 has many items that even a small company can operate.

Fourth, narrow what goes out. Decide the scope of information to give business partners and joint research partners, sign the NDA first, and verify return and destruction at the end. This is what Chapters 4 and 5 have in common.

Fifth, do investigation of counterparties in proportion to risk. Limit it to new counterparties and those to whom you give important technology. Finally, explain to management and set a contact point. The original also allows a small company to give the role to an existing person as an additional duty rather than create a new department.

Where to consult

The original repeatedly points to places to consult: METI when unsure about another country's systems or when asked for unreasonable disclosure; trade associations and public bodies for investigations small companies cannot do alone; lawyers and other experts for checking contracts and systems; and the Fair Trade Commission when the relationship to the antimonopoly law is unclear.

As a supplement, I add public support from sources other than the original. According to a newsletter from the Information-technology Promotion Agency, Japan (IPA), METI began a program on May 22, 2026 to dispatch experts free of charge to businesses aiming for TICS certification. IPA also reports that INPIT's intellectual property strategy experts offer free consultation on building a confidential information management system.²² Availability changes, so confirm with each agency's latest notice before relying on it.

Closing: the original asks for continuity, not perfection

Having read the 182-page original through, what stayed with me most was the statement in Chapter 0 that "no perfect countermeasure against technology leakage exists." That is why the document assumes it will be revised continuously with new cases, not set once and finished.

TIMEWELL's TRAFEED is an AI agent for export classification and counterparty screening. Where it overlaps with the due diligence in Chapter 4 and the counterparty risk assessment in Chapter 5 is in checking counterparties and keeping the basis for the judgment on record. The final determination is made by your own export control officer, and the AI's role is to assemble the material. See the TRAFEED service page, or reach us through a consultation.

Chapters 0 to 3 (aims, common measures, overseas sites, leakage through people) are in Part 1.

References

Footnotes

1. Ministry of Economy, Trade and Industry, Trade and Economic Security Bureau, Technology Survey and Leakage Prevention Office, "Technology Leakage Prevention Guidance, Second Edition" (published April 2026), Chapter 4 on leakage through joint research: scope p. 103, basic understanding pp. 104-105, overall picture of risk pp. 106-107. The original gives no public URL, so none is shown here. In Japanese. ↩ ↩² ↩³

2. Same document, Chapter 4, Section 0 "Leakage cases," cases 1 to 4, pp. 109-112. ↩

3. Same document, Chapter 4, Section 1 "Matters to address at the planning stage," item 1 introducing a risk management process, pp. 114-115; item 2 deciding officers and employees who take part in joint research, pp. 116-117. ↩ ↩²

4. Same document, Chapter 4, Section 1, item 3 risk assessment and theme selection based on the importance of the technology, pp. 118-119. ↩

5. Same document, Chapter 4, Section 1, item 4 thorough partner due diligence (country angle), pp. 120-121. ↩

6. Same document, Chapter 4, Section 1, item 5 thorough partner due diligence (organization angle), pp. 122-125. ↩ ↩²

7. Same document, Chapter 4, Section 1, item 6 thorough partner due diligence (individual angle), p. 127. ↩

8. Same document, Chapter 4, Section 2 "Matters to address when concluding contracts," item 1 early NDA and staged disclosure, p. 130; item 2 using your own contract template, p. 131. ↩ ↩²

9. Same document, Chapter 4, Section 2, item 3 defining purpose and theme, p. 132; item 4 clarifying members and handling of information, p. 133; item 5 clarifying scope of information and ownership of intellectual property, p. 134. ↩

10. Same document, Chapter 4, Section 2, item 6 confidentiality and non-compete duties, pp. 135-137. The passages quoting the joint R&D guidelines are from the excerpts in the original. ↩

11. Same document, Chapter 4, Section 2, item 7 monitoring clauses p. 138; item 8 grounds for termination p. 139; item 9 non-disclosure scope and prior approval of publication p. 140. ↩

12. Same document, Chapter 4, Section 2, item 10 return or deletion after the end and verification p. 141; item 11 preparing for foreign litigation and legal system risk p. 142. ↩

13. Same document, Chapter 4, Section 3 "Matters to address at the execution stage," items 1 to 7, pp. 144-150. ↩

14. Same document, Chapter 4, Section 4 "Matters to address at the end of research," items 1 and 2, pp. 152-153. ↩

15. Same document, Chapter 5 on leakage through supplier and customer coordination: scope p. 155, basic understanding p. 156, overall picture of risk and countermeasures pp. 157-158. ↩ ↩²

16. Same document, Chapter 5, Section 0 "Leakage cases," cases 1 to 3, pp. 160-162. ↩

17. Same document, Chapter 5, Section 1 "Matters to address before a transaction," item 1 counterparty risk assessment p. 164; item 2 limiting information provided before a transaction p. 165. ↩ ↩²

18. Same document, Chapter 5, Section 2 "Matters to address when concluding contracts," item 1 confidentiality duties and handling of information p. 167; item 2 grounds for termination for capital changes p. 168. ↩

19. Same document, Chapter 5, Section 3 "Matters to address inside the supply chain," items 1 and 2, pp. 170-171. ↩

20. Same document, Chapter 5, Section 4 "Matters to address outside the supply chain," item 1 limiting information to equipment makers p. 173; item 2 checking information management p. 174 (including the note on the Technology Information Management Certification). ↩ ↩²

21. Same document, (Reference) Procedure for research security, pp. 175-182. The timing of the procedure's compilation is from the description on p. 175. ↩ ↩² ↩³

22. Information-technology Promotion Agency, Japan (IPA), "Trade Secret Tips" newsletter, June 17, 2026 (introduction of TICS expert dispatch and INPIT support). https://www.ipa.go.jp/security/economics/mailmag/tradesec_mailmag_20260617.html Supplement not found in the original PDF (checked 2026-11-06). In Japanese. ↩