G7 Hiroshima Process on AI Governance

· About G7 Hiroshima Process on AI Governance

Key Takeaways

  • The G7 Hiroshima AI Process is a non-binding, voluntary international governance framework for advanced AI systems, adopted by the G7 in December 2023 and aimed at safe, secure, and trustworthy AI development.[2][4][8]
  • It applies primarily to organizations developing advanced AI systems, especially those that choose to commit to the Hiroshima AI Process International Code of Conduct; it does not create a direct statutory compliance regime with mandatory penalties.[1][8][11]
  • The operational Reporting Framework was launched on 7 February 2025 as a voluntary transparency mechanism, and a revised Reporting Framework 2.0 was published in 2026 with broader participation and updated questionnaire structure.[1][3][8]
  • The framework’s central compliance expectation is to publish information on risk management, safety testing, incident response, cybersecurity, content provenance, and lifecycle governance in a standardized public report.[1][11]
  • Because the Hiroshima AI Process is voluntary, there are no treaty-style fines or criminal sanctions under the framework itself; consequences are reputational, market-based, and potentially contractual or regulatory if separate laws require related disclosures.[1][2][11]
  • The process is still evolving in 2025–2026 through the OECD-hosted reporting mechanism and Friends Group action plans, so organizations should treat implementation details as current policy guidance rather than settled law.[1][3][5][15]

What It Is

The Hiroshima AI Process is the G7’s multilateral policy framework for international governance of advanced AI, first launched under Japan’s G7 presidency in May 2023 and formalized in the Hiroshima AI Process Comprehensive Policy Framework in December 2023.[2][4][6] It combines the International Guiding Principles for All AI Actors and the International Code of Conduct for Organizations Developing Advanced AI Systems, with the stated goal of promoting safe, secure, and trustworthy AI while reducing fragmentation across jurisdictions.[2][4][13]

The framework is not an EU-style regulation or a binding treaty. It is coordinated through G7 ministerial and leader-level statements, with operational support from Japan’s Ministry of Internal Affairs and Communications, Japan’s Ministry of Foreign Affairs, and the OECD-hosted transparency mechanism.[1][2][8]

Key dates are clear in the official record: the process was launched in May 2023; the comprehensive policy framework was agreed in December 2023; the voluntary reporting mechanism opened on 7 February 2025; and an updated reporting version was publicized in 2026.[1][2][4][8] Official updates in 2026 also show the Friends Group expanding implementation work, including an Action Plan 2026 announced after the March 2026 in-person meeting.[5][15]

Who Must Comply

The Hiroshima AI Process does not impose universal legal compliance thresholds in the way a statute would. The practical audience is AI developers and organizations developing advanced AI systems that voluntarily choose to align with the Code of Conduct and submit a report through the OECD reporting framework.[1][8][11]

The framework’s reach is effectively extraterritorial by design because it is meant for organizations operating across G7 and non-G7 jurisdictions, but only if they opt in to the reporting and transparency mechanism.[1][3] Public materials also indicate participation from companies outside Japan and across multiple countries, which confirms that the system is intended for global use rather than only G7-headquartered firms.[1][3][11]

There are no formal exemption clauses in the framework comparable to a statute, because participation is voluntary.[1][2] In practice, smaller developers, downstream deployers, and research groups may fall outside the reporting focus unless they are developing advanced AI systems and decide to participate.[1][11]

Core Requirements

  1. Risk management and governance: Organizations are expected to describe how they identify, assess, and mitigate systemic and model-specific risks across the AI lifecycle, including governance structures and accountability controls.[1][11]
  1. Safety testing and evaluation: Reports should explain pre-deployment and ongoing testing, red-teaming, capability evaluation, and monitoring processes used to identify harmful behavior or unsafe emergent behavior.[1][11]
  1. Incident reporting and response: Organizations should disclose mechanisms for logging, escalating, and responding to serious incidents, vulnerabilities, misuse, or unexpected harmful outputs.[1][11]
  1. Cybersecurity and misuse prevention: The framework expects measures to secure models, training data, weights, and deployment environments, and to address insider risk, unauthorized access, and model theft.[1][11]
  1. Content provenance and user transparency: Participants are expected to explain steps to identify AI-generated content, disclose system limitations, and support traceability or provenance mechanisms where appropriate.[1][11]
  1. Respect for intellectual property and data rights: The policy framework emphasizes safeguarding IP rights and lawful data use, which means organizations should describe training-data governance and rights-management controls.[2][4][13]
  1. Public reporting through the OECD mechanism: The core operational obligation is to complete the standardized questionnaire and publish the response publicly through the OECD-hosted reporting platform.[1][3][8]

Deadlines and Penalties

| milestone | date | what applies | |---|---|---| | Hiroshima AI Process launched | May 2023 | G7 begins work on international governance for advanced AI.[2][4][6] | | Comprehensive Policy Framework endorsed | 2 December 2023 | G7 endorses the guiding principles and code of conduct.[2][4][6] | | Reporting Framework launched | 7 February 2025 | Voluntary OECD reporting tool goes live.[1][8][11] | | First public responses published | April 2025 | Initial company reports are posted publicly.[1][11] | | Reporting Framework 2.0 public launch | 28 May 2026 | Updated version of the questionnaire and reporting approach is introduced.[3] | | Action Plan 2026 announced | March 2026 | Friends Group members outline further implementation steps.[5][15] |

There are no statutory fines, administrative penalties, or criminal sanctions attached to the Hiroshima AI Process itself because it is a voluntary policy framework rather than a binding law.[1][2][8] The principal consequences of non-participation or poor-quality participation are reputational harm, loss of stakeholder trust, and possible indirect effects where other regimes, procurement rules, or contractual obligations reference similar transparency expectations.[1][3][11]

How to Comply

  1. Map scope and accountability: Identify which business units develop or materially modify advanced AI systems, then assign executive ownership, legal review, and technical control responsibility consistent with ISO 27001 governance practices.
  1. Build a unified AI risk register: Use NIST CSF 2.0 concepts for identify, protect, detect, respond, and recover to structure model, data, and deployment risks across the lifecycle.
  1. Document model development controls: Maintain evidence of dataset provenance, testing protocols, safety evaluations, approval gates, and post-deployment monitoring in a format that can be turned into a public Hiroshima AI Process report.
  1. Strengthen incident and vulnerability handling: Align security operations, abuse reporting, and red-team escalation with the framework’s expectations for cybersecurity and misuse prevention, and with ISO 27001 incident management controls.
  1. Prepare public disclosures carefully: Draft responses that are accurate but do not disclose trade secrets unnecessarily; align legal review with IP, privacy, and security teams before publication.
  1. Implement AI management system discipline: Use ISO 42001 to formalize AI policy, roles, impact assessment, supplier oversight, and continuous improvement, especially where multiple models or vendors are involved.
  1. Test transparency claims before filing: Verify that statements about safety testing, provenance, and risk mitigation can be supported by records, logs, and technical evidence.
  1. Review alignment with other regimes: Reconcile Hiroshima AI Process reporting with EU AI Act obligations, sectoral rules, and internal ethics commitments so one disclosure set does not conflict with another.

Related Regulations

EU AI Act: The EU AI Act is binding and risk-based, while the Hiroshima AI Process is voluntary; the two overlap on transparency, testing, and governance, but the EU regime can impose direct legal obligations and penalties.[3][11]

OECD AI Principles: The Hiroshima AI Process builds on the OECD’s broader AI principles and operationalizes them for advanced AI systems, making the two complementary rather than conflicting.[2][4]

Council of Europe Framework Convention on AI: This convention is legally oriented and rights-focused, so it may impose stricter public-law duties than the Hiroshima process, especially for human rights and democratic safeguards.[4]

NIST AI Risk Management Framework: NIST AI RMF is a practical management standard, not a law; it maps well to the Hiroshima process because both emphasize risk governance, measurement, monitoring, and accountability.[1][11]

ISO/IEC 42001: ISO 42001 provides a certifiable management-system structure that supports the documentation and continual improvement expected by the Hiroshima reporting framework.[1][11]

FAQ

Does the Hiroshima AI Process apply to companies outside the G7?

Yes, in practice it can, because the reporting framework is intended for global participation and the published reports include organizations from multiple countries.[1][3] However, it applies only if a company voluntarily chooses to participate in the code-of-conduct reporting mechanism.[1][8]

Is the Hiroshima AI Process legally binding?

No. The framework is a political and policy instrument, not a statute or treaty with direct legal sanctions.[2][4][8] Its force comes from G7 coordination, public reporting, and market expectations rather than fines.[1][11]

What changed in 2025 and 2026?

The most important change was the launch of the Reporting Framework on 7 February 2025, which turned the code of conduct into a public transparency mechanism.[1][8] In 2026, the framework was updated and republished as Reporting Framework 2.0, with wider participation and an updated questionnaire.[1][3][5]

Are there penalties for not filing a report?

No penalties are set by the Hiroshima AI Process itself.[1][2] The practical downside is reputational: companies that do not participate may be seen as less transparent or less mature in AI governance, especially if competitors are publishing reports.[3][11]

What should a company collect before submitting a report?

A company should collect its AI governance policy, safety testing results, incident logs, cybersecurity controls, model documentation, and any content provenance or disclosure practices it uses.[1][11] It should also verify that public statements are consistent with legal review on privacy, intellectual property, and security.

Does the framework cover frontier-model providers only?

No. Early versions focused on organizations developing advanced AI systems, but the 2026 update broadened coverage across more of the AI value chain.[3] That said, participation remains voluntary and centered on organizations that choose to report.[1][11]

Sources

Put it into practice

More compliance guides