NAVEX Releases Survey Report "The State of Risk & Compliance in Japan 2026"

Planned AI Use for Misconduct Monitoring and Internal Investigations Nearly Doubles in One Year

Highlighting Japan-specific challenges, including third-party management and preparedness for regulatory changes, as well as opportunities to strengthen governance

NAVEX (headquarters: Oregon, USA; CEO: Arpan Sheth), a global leader in software for governance, risk and compliance (GRC), has released “The State of Risk & Compliance in Japan 2026”, the Japan edition of its survey report based on responses from approximately 1,200 corporate executives worldwide, including senior executives in Japan.  

The report finds that corporate compliance frameworks in Japan have reached a level of maturity broadly in line with global standards. At the same time, it identifies challenges specific to Japan, including third-party risk management, practical board-level involvement; and preparedness for the amended Whistleblower Protection Act taking effect in December 2026. The report also examines emerging trends and the outlook for the development of governance frameworks, including the further advancement of self-directed governance driven by internal audits and a strong appetite to use AI to improve operational efficiency.  

Key findings from the report include: 

Only 3% of companies that experienced multiple issues are compliant with the amended Whistleblower Protection Act, highlighting a clear gap in preparedness

The 2025 amendment to the Whistleblower Protection Act (*) has highlighted significant differences in the level of preparedness among companies. The amendment requires companies to further strengthen their internal frameworks through measures including the introduction of criminal penalties for adverse treatment of whistleblowers and prohibitions on obstructing whistleblowing or attempting to identify whistleblowers. While 68% of companies that had not experienced any compliance issues over the past two years responded that they were already compliant with the amended requirements, only 3% of companies that had experienced two or more issues had achieved compliance in advance.  

At the same time, the survey found that the primary driver of compliance investment and program enhancement among Japanese companies is not an external factor such as “regulatory changes,” as is commonly seen in Europe, but rather the “results of internal audits or risk assessments,” cited by 56% of respondents.  

Although organizational structures, including divisional structures, may make it more difficult for companies to respond quickly to regulatory changes, the fact that internal audit findings serve as a stronger driver of action than external regulatory pressure suggests that a compliance culture is taking root across many Japanese companies. By using the enforcement of the amended Act this December as further momentum and integrating and deepening measures across their organizations, companies have the potential to build more resilient governance frameworks.

Third party-related risk experience exceeds the global average; practical board involvement continues to lag

In Japan, 26% of respondents reported that their organizations had experienced an ethics or compliance issue involving a third party, such as a supplier or other external party, within the past two years. This was higher than the global average of 18%. At the same time, only 36% said that their organizations actively encourage the reporting of misconduct by third parties, while the adoption of AI in third-party risk management also remains limited at 13%.  Since companies’ reputations and business standing can be significantly and adversely affected by third parties, companies with mature compliance programs tend to have active reporting programs with their third-party suppliers and partners.  

In addition to these challenges in third-party risk management, Japan also tends to fall below the global average in terms of practical board-level involvement in compliance. Only 40% of respondents said that their boards regularly receive dashboards showing the operational status of compliance programs, compared with a global average of 54%. 33% said that their boards review key risks and emerging risk trends, compared with 42% globally.  

Compared with global standards, Japanese management may appear somewhat less proactive in relation to accountability. This may partly reflect Japanese business practices that place a strong emphasis on long-term relationships and trust, potentially reducing the frequency of regular due diligence and audits.However, by adopting a more practical approach to risk management and deepening their active involvement, boards can be expected to further enhance both the value and effectiveness of their organizations’ overall compliance frameworks. 

While 80% expect compliance budgets to remain broadly unchanged, planned AI use for misconduct monitoring and investigation support is set to nearly double over the next year

When asked about future budgets for advancing compliance initiatives, 80% of respondents in Japan said they expected spending to remain flat or change only slightly, highlighting a cautious preference for maintaining current investment levels. However, as 42% identified the advancement of technology and analytics capabilities as necessary to significantly improve their ethics and compliance programs, maintaining budgets at current levels may also hinder further progress.  

At the same time, respondents in Japan reported positive plans to expand the use of AI in compliance operations. Over the next 12 months, planned AI adoption is expected to nearly double in practical areas such as monitoring and surveillance for potential misconduct, rising from 28% to 50%, and investigation support, increasing from 27% to 46%.  

Although investing in technology without a clear understanding of an organization’s specific challenges may result in the misallocation of resources, aligning emerging technologies with clearly defined priorities can enable companies to build more efficient and resilient governance frameworks. 

Comment from Naoaki Mitsuya, Country Manager of NAVEX Japan

This survey shows that corporate compliance frameworks in Japan have reached a level of maturity broadly in line with global standards. At the same time, it highlights opportunities to further enhance their effectiveness in areas including third-party management, board engagement and preparedness for legislative changes. Japanese companies already have a strong foundation in the form of a self-directed ethical culture driven by internal audits and risk assessments. Going forward, senior management and boards will need to demonstrate stronger leadership in risk management and strategically align emerging technologies such as AI, for which there is strong adoption appetite, with their organizations’ priority challenges. 

Download the report here: https://www.navex.com/ja-jp/northstar/the-state-of-risk-and-compliance-in-japan/

*Note: The amended Act will take effect on December 1, 2026. 

Survey Methodology

About NAVEX 

NAVEX is trusted by 13,000 organizations worldwide, including 75% of Fortune 100 and 500 companies. The NAVEX One platform provides a 360-degree view of risk across enterprises, enabling stronger compliance and governance. 
Learn more: [NAVEX Blog] | [LinkedIn] | [Facebook] | [YouTube] 

Company Overview 

NAVEX Global, Inc. (Headquarters) 

Headquarters: 5885 Meadows Road, Suite 500, Lake Oswego, OR 97035, United States 
Representative: CEO Arpan Sheth 
Website: https://www.navex.com/ja-jp/ 

NAVEX Japan G.K. (Japan Office) 

Address: 14F Tokyo Square Garden, 3-1-1 Kyobashi, Chuo-ku, Tokyo 
Established: January 2026 
Representative: Country Manager Naoaki Mitsuya 
Business Scope: Sales, implementation support, and customer success for NAVEX products in the Japanese market