In April 2026 Japan’s Digital Agency published part of Gennai (源内), its AI platform for government staff, as open source. I reviewed the AI-apps half of that release. The foundations are sound. But the legal-answer app can cite the wrong law, neither template installs by following its own guide, and the project is not run as open source in any working sense.

This is a review of the published code, not of Gennai as it runs inside the ministries. For what staff say about using Gennai, see what the agency’s staff survey actually measured.

The short version

The foundations are good. Encryption, private networking and access design would pass a first architecture review.
The legal-answer app can cite the wrong law. It can quote a different law, an amendment not yet in force, or the right article number from the wrong law, and it labels each one as official text.
Neither template installs by following its own guide. Each ships with placeholder settings that stop the first install or lock everyone out.
What people type is kept by default. Questions, uploaded documents and AI answers go into logs, and nobody has decided how long they stay.
It is open source in name only. No outside contribution has ever been accepted, and two careful bug reports about the legal app have waited months for any reply.
Most of this is days of work, not months. The list at the end is ordered by effort.

What was released?

Gennai has two parts: a web app that staff use, and about 30 task-specific AI apps behind it. On April 24, 2026 the agency published part of both under the MIT licence, so that local governments and companies can reuse the code instead of building their own (announcement).

This review covers the AI-apps repository, genai-ai-api. It holds three apps, each on a different cloud provider approved for Japan’s Government Cloud.

App	Cloud	What it does
Legal answers	Google Cloud	Answers questions about Japanese law, quoting articles from the government’s e-Gov statute data
Document search	Amazon Web Services	Searches an organisation’s own documents and writes answers from what it finds
Self-hosted model	Microsoft Azure	Runs an open AI model on a rented GPU server, with a Japanese translation model as the example

The agency says the published code is part of what runs in central ministries today. It calls the legal app a reproducible implementation and the other two templates. That makes the legal app the one most likely to be copied as it stands.

What did the agency get right?

Publishing at all was the right call. Few governments put the code behind their staff AI tools in public, under a licence that lets anyone reuse it.

Security basics are in place. Data is encrypted with keys the deploying organisation controls, the Azure GPU server has no public address, and each service runs under its own identity.
Supply-chain care is configured. Automatic dependency updates are switched on, new package versions wait a week before they can be installed, code scanning runs, and there is a working security contact.
One bug report was handled well. In May an outside developer reported two faults in the legal app. The team confirmed them within five days, fixed them, and credited the reporter and an outside security adviser in the release notes.
The fix that came out of that work is done properly. It guards against the app being tricked into fetching addresses inside its own network.

Is it really open source?

On GitHub, outside developers propose changes as pull requests, and the maintainers review and merge them. That exchange is what makes a project open source in practice. In this repository it has never happened.

Measure	Count
Pull requests ever opened	35
Opened by a person	0
Opened by the bot that copies code from the agency’s private repository	8, all merged
Opened by Dependabot, the automatic dependency updater	27, none merged
Merged changes reviewed by someone other than the person merging	0
Bug reports with no reply from the agency	2, waiting since July and August
Last change to the code	May 25, 2026

The README says the project does not accept pull requests, and takes issues only for critical problems. That is a fair choice for a one-off code release. But the April announcement promised continued fixes for vulnerabilities and answers to technical questions, and the repository shows neither.

Changes arrive unexplained. Every real change lands as one bulk copy from a private repository, with the same note saying it passed internal tests. The public repository runs no tests, so nobody outside can check that. When I installed and ran the tests that ship with the AWS app, they failed before a single test ran.

Updates are switched on and then ignored. Dependabot has opened 27 updates and none has been merged. Two of them fix published security advisories in the AWS app, one rated high, open since April and May. All 27 also show the same configuration error, three missing labels, which takes a minute to fix.

The best work in the repository is the outside reports. One reporter checked 9,469 law titles against the government’s own list and rebuilt the database to measure the problem (issue 36). The other is porting the code to run on their own on-premises servers (issue 39). Both proposed fixes. Neither has had a reply.

Can the legal-answer app cite the wrong law?

Yes. The legal app’s whole job is to quote the right article of the right law, as it stands today. Three separate faults can each break that, and in every case the app tells the AI the text is official e-Gov law.

Here is how the app builds an answer, and where it goes wrong.

It guesses which laws the question is about. It then adds each law’s enforcement order and enforcement rules by attaching those words to the law’s name, without checking that they exist. The Civil Code has neither.
It looks up the closest law title for each name, and always takes the nearest match, however far off. So the made-up “Civil Code Enforcement Order” returns the Act on the Enforcement of the Civil Code, a different law, and all 80 of its articles go into the answer. A check meant to catch this misses names that look this similar. Reported in issue 36 in July.
It picks one version of each article. e-Gov publishes laws in versions dated by when they take effect. The app’s sort order favours the latest date, which can be an amendment that is not yet in force. Reported in issue 39 in August.
It matches the article number in the question, say Article 27, to the articles it holds. Its article labels do not record which law each article belongs to, and step 1 means most questions carry two or three laws. So Article 27 can be matched to another law’s Article 27. The app then gives the AI that article’s title as the one the user meant, with an instruction to correct the user if they disagree. This one has not been reported; I found it in the code.
It adds web pages from a Google search and writes the report.

The README says accuracy is handled by instructing the AI, for example to state only what is certain. Instructions cannot repair wrong source text. A model told that a passage is the official article will quote it.

Four more things make the app harder to trust as it stands.

It has no automated tests. It is the only one of the three apps with none, and the only one anyone has reported bugs against. Each fault above is a few lines of logic that a small test would pin down.
Fixes may never reach the server. The deployment script only notices a change when the list of software packages changes, so a fix to the app’s own code can be uploaded without being switched on.
The documentation describes an earlier design. It mentions database tables that do not exist, a different way of splitting laws into passages, and automated update jobs that are not in the repository.
Fetched web content is not checked. Content from web pages the app retrieves can shape both the report and its list of sources.

What happens when you set up the other two apps?

A city IT team following either template’s guide would hit a failed install first. Once past that, they would be running defaults that should not reach real staff or real data.

Document search, on Amazon Web Services

The guide fails as written. A sample sign-in setting points at a role called DummyRole, which does not exist, so the first deployment stops.
One shared key is the only lock. The app is protected by a single API key, a long password every caller shares. Its firewall ships with two settings: allow everyone, or block everyone.
One request can trigger unlimited AI calls. Any key holder can also replace the app’s instructions to the AI, so one leaked key can run up an open-ended bill.
What users send and get back is logged permanently. The log sits outside the app’s own encryption and expiry settings and never expires.
Every JPG upload fails. The app sends the file type as “jpg”, and the AI service only accepts “jpeg”.
Deleting the app deletes every uploaded document. The guide says only the encryption key is kept.
The tests do not pass as shipped. Installing the test tools from the published package list breaks, and one test file depends on reference files that were never published.

Self-hosted model, on Microsoft Azure

The settings file ships with 999.999.999.999 as an allowed address in three places. That is not a valid address, and the guide says values it does not mention need no editing. The first install fails or nobody can connect.
The GPU server’s password can be worked out from public details of the deployment. Password login is switched on by default.
The server never starts on a Monday. The weekday 08:00 start job checks for weekends using UTC, where 08:00 on Monday in Japan is still Sunday.
The paid web firewall lets approved traffic skip its attack rules. The deployment pays for protection it does not apply to most requests.
The GPU server downloads its software from public sources at every start, without fixed versions. That includes model code it is set to run as trusted. If any of those sources changes, the next start runs the change.
The setup scripts save a server key and an access key into a folder the project does not exclude from version control. A team that commits its configuration to its own repository would publish both.
A job that only needs to start and stop one server has full control of the whole deployment.
Uploaded files are deleted only when processing succeeds. After any error they stay with the AI provider.
The guide promises two web endpoints that the gateway does not define. Calls to them return “not found”.

What happens to what staff type?

All three apps record what people type by default, and none of them asks anyone to decide how long it stays or who can read it.

App	What is recorded	How long it is kept
Legal answers	The full text of every question	Google Cloud’s default of 30 days; the app sets nothing
Document search	What users send, including questions and uploads, and the answers	Forever, in a log the app’s own settings do not cover
Self-hosted model	The first part of every prompt and answer, with the caller’s IP address	30 days

A civil servant pasting a case into the legal app may include a resident’s name and address. Under Japan’s Act on the Protection of Personal Information, someone has to decide how long that is kept and who can see it. None of the three apps raises the question or documents the answer.

What does it cost to run?

Neither template says what it costs. At list prices on November 3, 2026, in the Tokyo regions, the default setups cost the following each month before anyone asks the AI a question.

Setup	Monthly cost, USD before tax	Where the money goes
Self-hosted model, GPU running all month	about 5,010	GPU server 3,888; gateway 700; web firewall 402; disk 23
Self-hosted model, GPU on weekdays 08:00 to midnight	about 2,990	GPU server 1,864 for about 350 hours; the rest as above
Self-hosted model, GPU switched off	about 1,120	The gateway and firewall run around the clock either way
Document search, default with redundancy	about 975	Search cluster at 4 units of 0.334 per hour
Document search, development setting	about 490	Search cluster at 2 units
Legal answers	pay per question	Roughly 5 to 10 US cents of AI usage per long report, plus 3.5 cents per web-searched question beyond 1,500 free a day

Cheaper settings exist in both templates but are neither the default nor explained. A smaller gateway tier costs about 150 a month instead of 700, a firewall without the paid attack rules about 224 instead of 402, and the AWS app has an undocumented storage option with no always-on cluster at all. The GPU server also comes in a discounted spot version at 0.984 an hour instead of 5.326, which Azure can reclaim at short notice.

One more cost to plan for: Google’s developer service lists the AI model the legal app is built on, Gemini 2.5 Flash, as deprecated from December 1, 2026. The agency has not said whether its version is affected.

Prices are from the Azure Retail Prices API, the AWS Price List API, Vertex AI pricing and Gemini API pricing, all read on November 3, 2026.

Is the translation model free for a government to use?

That is not clear. The Azure template’s example model is PLaMo 2 Translate from Preferred Networks, released under the PLaMo Community License. Three terms matter for a public body.

In-house use counts as commercial use. The licence includes use “within the USER’s organizational frameworks”.
Free commercial use has a revenue ceiling. It requires registration with Preferred Networks and annual revenue or sales of no more than 1 billion yen.
Government bodies are not mentioned.

A ministry or prefecture has no revenue in that sense, so whether the free licence covers it is a question for Preferred Networks before anyone deploys. The template links the licence but does not raise this. The model also needs its own code to run as trusted, which makes pinning it to a known version all the more important.

What should happen next?

Most of this is ordinary maintenance. The first group is an afternoon for one person. The second is a quarter of steady work. The third is a decision.

For the Digital Agency, this month

Reply to the two open bug reports, even if only to say “confirmed, no date yet”.
Merge the two security updates, and create the three labels Dependabot is asking for.
Change the worst defaults: no placeholder addresses or guessable passwords, no full-content logging, a cap on AI calls per request, and a Monday start that works.

For the Digital Agency, this quarter

Run the tests in public on every change, so that “passed internal tests” is something anyone can check.
Fix the legal app’s three citation faults, with tests written first, and make sure a code fix actually redeploys.
Decide, for each app, what gets logged, for how long, and who can read it, and write it down.
Pin every external download on the GPU server to a known version.
Publish a cost page for each template, with the default and the low-cost settings side by side.
Rewrite the documentation from the code as it stands.

For the Digital Agency, the decision

Say what the repository is. Either it is a snapshot, marked as published in May 2026 and not maintained. Or it is a maintained project that accepts small, tested fixes and has a public place for the technical questions the announcement promised to answer. Today it carries the costs of both and the benefits of neither.

For local governments and vendors thinking of reusing it

Treat the legal app as a prototype until the citation faults are fixed. Do not give its answers to staff as authoritative.
Budget from the cost table above, not from the idea that open source is free.
Turn off full-content logging, or set its retention on purpose, before real data goes in.
Ask Preferred Networks about the PLaMo licence before deploying the translation model.
Report what you find. The May fixes show that a good report can still get a good response.

About this review

What was reviewed. The genai-ai-api repository at commit 0e460f6, the latest as of November 3, 2026. Its last code change was on May 25, 2026.
How. I read all of the code and documentation, and every pull request, issue and release on GitHub. I ran the AWS app’s own tests and the repository’s own code-style checks. I deployed nothing and used no government system.
Prices. List prices in US dollars before tax, read from the cloud providers’ own price lists on November 3, 2026.
Security details. Some findings are security weaknesses in software the agency says is in use. Their technical detail is left out here.
Open questions. Some things need a cloud account or the agency to settle: exactly how the placeholder addresses fail, what testing the private repository runs, and how Preferred Networks reads its licence for public bodies.

If your organisation is weighing an AI tool, open source or not, the questions in this review apply: what it logs, what it costs, who maintains it, and whether its answers can be checked. A Diagnostics review starts there.