Skip to content

Weekday Japan business intelligence for finance professionals.

Join the list
Tokyo Brief東 京 ブ リ ー フJapan's day, wrapped and delivered by morning.

Policy Watch

METI draft would make cyberattack reporting a condition for drone supply-plan certification

A METI draft would require drone suppliers seeking supply-plan certification to report actual or suspected cyberattacks through the ministry, and would recommend a ★4 supply-chain security rating, with comments open until November 3.

By Tokyo Brief DeskOct 5, 20263 min read
Drone flight controller, motor and battery on a tray beside an abstract supplier-network diagram with a single security checkpoint

The Ministry of Economy, Trade and Industry has put a revised drone supply-security policy out for public comment, and the changes that matter to suppliers sit in cybersecurity and supply-chain cooperation rather than in funding. Comments are open from October 5 until 23:59 on November 3. The draft amends the policy METI issued on March 13, 2026 under Article 8(1) of the Economic Security Promotion Act.

A new reporting duty

The policy lists conditions that a supply plan must meet to be certified. The draft adds a fifth item to the implementation-structure conditions: whatever the scope of the initiative, a company that has been hit by a cyberattack, or may have been, must promptly report the incident through METI to the National Cybersecurity Office in the Cabinet Secretariat. The comparison table marks this item as newly established.

Security ratings, as recommendations

The cybersecurity chapter is rewritten. METI would recommend that certified suppliers obtain ★4 under the supply-chain security evaluation scheme, which the draft says is scheduled to start operating in March 2027. It would also recommend that they use IoT products carrying a JC-STAR label, with ★3 products for routers and other communications equipment and network cameras.

The same list asks certified suppliers to push the same standards down the chain. Direct suppliers of materials and parts would be encouraged to obtain ★3 or ★4, with the certified company judging which fits each supplier, and to use JC-STAR-labelled devices. The draft frames all four points as recommendations. The earlier text pointed instead to METI and IPA management guidelines and small-business guidelines, and named the Cabinet Cybersecurity Center as the coordination partner.

Disruption powers and public-sector demand

Another new passage covers disruption. Where a business closure threatens drone supply, METI would investigate the impact under Article 9-2 of the Act and may urge the operator to submit a supply plan. Where a certified company is likely to struggle to follow its plan and METI sees special need, it would ask raw-material suppliers and others to cooperate under Article 11-2. The text adds that this must not impose undue burdens on private firms.

Two further sections are new. One calls on METI, companies, financial institutions and investors to cooperate more closely. The other brings public-sector demand (disaster response, law enforcement, defence) into the support scheme and says certified parts makers are expected to supply aircraft makers for both civil and public demand.

What is not new

The contractor-security clause is unchanged in substance: firms must sign confidentiality agreements with trading partners that hold core technology, require equivalent safeguards and review compliance periodically. The comparison table shows only that one statute on late payment to small contractors is now cited by its full title. The two-step loan route via Japan Finance Corporation, NEDO's role as support body and the 2030 targets appear in the draft text but not in the comparison table. Those targets are a domestic mass-production base of about 80,000 drones by 2030 and, as a condition for certification, the capacity to build at least 10,000 drones a year by then.

The draft leaves the effective date blank. Pending applications and existing certifications would continue under the earlier rules. METI's Next-Generation Air Mobility Policy Office is the contact.