Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

On 26 December 2025 the Peruvian executive promulgated and published in El Peruano Ley N° 32537, modifying Decreto Legislativo 1293 to extend the Registro Integral de Formalización Minera (REINFO) — Peru's artisanal-and-small-scale mining formalisation registry — through 31 December 2026, or until the new MAPE Law and its regulations enter into force, whichever occurs first. The statute is the parent instrument above DS 009-2025-EM (May 2025) and pushes the formalisation regime — which previously had a 30 June 2025 sunset under Ley 32213 — out by another 18 months. It also (i) orders a national MAPE census run by INEI, MINEM and INGEMMET (to begin within six months and conclude within twelve), (ii) requires REINFO registrants to declare real operational coordinates within 120 days via the Ventanilla Única de Formalización Minera, (iii) compels regional governments to transfer their formalisation paper and digital archives to MINEM within 60 days, and (iv) directs SUNAFIL to issue payroll-compliance verification rules for REINFO holders within 60 days. The law affects ~80,000+ artisanal and small-scale miners and is the statutory ceiling under which Peru's gold and copper-concentrate export chain operates.

Taiwan's Legislative Yuan passed the Artificial Intelligence Basic Act (人工智慧基本法) on third reading on 23 December 2025, and President Lai Ching-te promulgated the 20-article statute on 14 January 2026, bringing it into force immediately. The Act designates the National Science and Technology Council (NSTC) as the central AI-policy competent authority and codifies seven governance principles — sustainability and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability — that apply to all public-sector AI procurement and high-risk sectoral applications. The statute establishes a statutory foundation for the Taiwan AI Action Plan 2.0, mandates an Executive Yuan National AI Strategy Committee, and provides authority for sector-specific implementing regulations by FSC, NCC, MOHW, and MOTC across finance, telecoms, medical, and autonomous-vehicle AI within a two-year window. As the first national AI governance statute in the Greater China region and the third globally after the EU AI Act and South Korea's AI Basic Act, it frames regulatory expectations for the companies at the heart of the global AI hardware supply chain — TSMC, NVIDIA ODM partners, and advanced-packaging incumbents — that are headquartered or operate substantially in Taiwan.

On 22 December 2025 the FCC's Public Safety and Homeland Security Bureau released Public Notice DA-25-1086, adding to the Covered List (under section 1709 of the FY2025 NDAA) all unmanned aircraft systems (UAS) and UAS critical components produced in a foreign country, plus communications and video-surveillance equipment/services produced by DJI Technologies and Autel Robotics (and their subsidiaries, affiliates, and licensing/JV partners). The designation is comprehensive by scope — every foreign-made drone from consumer quadcopters to large uncrewed systems, with no size/performance carve-out — and blocks the FCC from granting any new equipment authorization to covered UAS/components going forward. Previously authorized models already in the US market are not revoked. A follow-on Public Notice (DA-26-22, 7 January 2026) narrowed the scope with a temporary exemption (see amendments).

Arrêté ministériel n° 00964/CAB.MIN/MINES/01/2025, signed 19 December 2025 by DRC Mines Minister Louis Watum Kabamba, suspends with immediate effect all activities of entities (notably comptoirs d'achat / buying counters, treatment units and similar structures) involved in the purchase, processing, transformation and commercialisation of copper and cobalt minerals sourced from artisanal exploitation across the country. Industrial, legally established mining operators are excluded. The order requires affected entities to submit compliance documentation within ten days, establishes an ad hoc commission to verify administrative, legal, technical and traceability conformity (15-day review window), and obliges operators to demonstrate the lawful origin of their supplies in line with OECD due-diligence guidance. Framed as a "conservatory" measure to restore order in the cupro-cobaltifère value chain and curb illicit exports.

Section 851 of the FY 2026 National Defense Authorization Act (P.L. 119-60), signed December 18, 2025, prohibits US federal agencies from procuring biotechnology equipment or services from designated "biotechnology companies of concern" (BCCs), and bars federal contractors from using such equipment/services in work performed under federal contracts, grants, or loans. The final enacted text ties initial BCC designations to DoD's existing §1260H Chinese-military-company list (which currently includes BGI and MGI, but not WuXi AppTec or WuXi Biologics) and directs OMB to designate additional BCCs within one year of enactment; operational prohibitions activate 60-90 days after FAR revision, with a five-year grandfather period for pre-existing contracts — enforcement is expected to begin in 2027-28. The legislation is the successor to H.R.8333 (118th Congress, House-passed September 2024 but stalled in the Senate before adjournment) and represents the first enacted US federal-procurement biotech-supply-chain-resilience statute.

In the early hours of 11 December 2025 the Council of the EU and the European Parliament reached provisional political agreement in trilogue on the "EU Pharma Package" — the revised pharmaceutical Regulation (COM 2023/0131) and Directive (COM 2023/0132) — the most significant overhaul of EU pharmaceutical legislation in over two decades. The package replaces Directive 2001/83/EC (Community Code on medicinal products for human use) and Regulation (EC) 726/2004 (the EMA Regulation), and consolidates the orphan-medicine (Regulation 141/2000) and pediatric-medicine regulations into a single framework. Headline provisions: (i) a new "8+1(+1)(+1)" IP-incentive architecture — 8 years of regulatory data protection plus 1 year of market protection, with up to two additional 12-month extensions for products addressing unmet medical need or new active substances meeting comparative-trial conditions, capped at 11 years total; (ii) an EU-wide list of critical medicines under enhanced governance via the Medicines Shortages Steering Group (MSSG) and an EMA "list of critical shortages in the EU"; (iii) mandatory shortage-prevention plans on marketing-authorisation holders for prescription medicines and Commission-designated products; (iv) modernisation of clinical-trial requirements, environmental-risk assessment, antimicrobial stewardship, and a transferable-exclusivity-voucher (TEV) regime to incentivise novel antibiotic R&D. The COREPER I committee endorsed the compromise text on 6 March 2026 and final adoption by Parliament and Council is expected during summer 2026, with the regulatory framework becoming applicable in 2028.

On 10 December 2025 the European Commission opened an in-depth investigation under the Foreign Subsidies Regulation (FSR) — its first ex officio Phase II investigation — into whether Chinese state-controlled security-scanner producer Nuctech received foreign subsidies enabling it to offer prices and conditions that EU competitors could not match across airport, port, and border-crossing markets. Nuctech Technology, controlled by Tsinghua Tongfang (PRC state-linked), operates EU subsidiaries in Poland and the Netherlands (Nuctech Warsaw and Nuctech Netherlands), supplying threat-detection scanners to roughly 80% of EU airports and 70% of EU sea and land border crossings. The case (FS.100068) followed April 2024 unannounced FSR dawn raids at Nuctech's Polish and Dutch premises — one of the first uses of FSR inspection powers — and sets a precedent for ex officio scrutiny of state-subsidised foreign incumbents beyond the M&A and public-procurement tracks where FSR had previously operated.

On 10 December 2025 the National Assembly of Vietnam adopted Law No. 134/2025/QH15 on Artificial Intelligence (8 chapters, 35 articles), Vietnam's first dedicated AI statutory framework and one of the first comprehensive horizontal AI laws in Southeast Asia. The law establishes a three-tier risk-based regulatory architecture (high / medium / low) for the research, development, provision, deployment, and use of AI systems; defines the rights and obligations of providers, deployers, importers, distributors, and users; and mandates state oversight via the Ministry of Information & Communications and Ministry of Science & Technology. Prohibited acts include systematic deception, manipulation of human perception, generation of fake content endangering national security, exploitation of vulnerable populations, and obstruction of human-supervision mechanisms. The law applies to Vietnamese agencies, organizations, and individuals as well as foreign organizations and individuals involved in AI-related activities in Vietnam, taking effect 1 March 2026 with 12-18 month transition windows for existing systems depending on sector.

Vietnam's National Assembly passed Law on Cybersecurity No. 116/2025/QH15 on 10 December 2025 (434 of 443 deputies in favour), effective 1 July 2026. The law supersedes both the 2018 Cybersecurity Law (Law 24/2018/QH14) and the 2015 Law on Cyber Information Security, consolidating cybersecurity, cyber-information-security, and network-information-security into a unified Ministry of Public Security-led framework. It retains data-localization obligations for foreign digital-service providers handling personal data, user-generated content, and relationship graphs of Vietnamese users (minimum 24-month retention), introduces 6-hour urgent / 24-hour standard content take-down windows on MPS request, expressly prohibits AI/deepfake forgery of images, voices, and videos for illegal purposes, and mandates child-safety platform measures.

On 18 November 2025, the European Supervisory Authorities (EBA, ESMA, and EIOPA) jointly designated 19 Critical ICT Third-Party Providers (CTPPs) under DORA Article 31, with immediate effect — the first-ever exercise of direct EU financial-regulator supervision over hyperscale cloud and infrastructure providers. The designated entities include Amazon Web Services, Microsoft Azure, Google Cloud, Deutsche Telekom, Oracle, SAP, IBM, Bloomberg LP, London Stock Exchange Group (LSEG), Tata Consultancy Services, and Orange, among others. Designation triggers direct oversight by a lead ESA (EBA for banking-critical, ESMA for capital-markets-critical, EIOPA for insurance-critical) via Joint Examination Teams (JETs), with powers to conduct investigations, carry out on-site inspections, and impose fines of up to 1% of average daily worldwide turnover per day for non-compliance.

India's Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 via Gazette notification G.S.R. 846(E) on 13 November 2025, operationalising the 2023 DPDP Act. The Rules introduce a "negative list" cross-border personal-data transfer regime under Rule 14, verifiable parental consent, breach-notification windows, and tiered penalties up to INR 250 crore. Implementation is phased: Data Protection Board provisions in force on notification, Consent Manager rules from 13 Nov 2026, and core data-fiduciary / cross-border-transfer obligations from 13 May 2027.

Germany's transposition of EU Directive 2022/2555 (NIS2), enacted as the "Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung." Bundestag passage 13 November 2025; Bundesrat approval 21 November 2025; published as BGBl. I 2025 Nr. 301 on 5 December 2025; entered into force 6 December 2025. The statute designates the Bundesamt für Sicherheit in der Informationstechnik (BSI) as the central national supervisory authority over an estimated 29,500 covered entities across 18 critical and important sectors, introduces a mandatory 24h initial / 72h detailed / 1-month final cyber-incident reporting cascade, establishes board-level personal liability for senior management, and applies to SME critical- infrastructure suppliers — with no transitional grace period from entry into force.

FinCEN issued a final rule under Section 311 of the USA PATRIOT Act (31 U.S.C. § 5318A) prohibiting US covered financial institutions from opening or maintaining a correspondent account for, or on behalf of, Cambodia-based Huione Group, a foreign financial institution found to be of primary money-laundering concern. Treasury determined that Huione Group and its subsidiaries — including Haowang Guarantee, Huione Pay PLC, and Huione Crypto — laundered at least $4 billion of illicit proceeds between August 2021 and January 2025, including funds tied to North Korean cyber-heist actors and Southeast Asian "pig-butchering" investment-scam compounds. The rule also imposes a special-due-diligence requirement on US covered institutions to guard against indirect access via foreign correspondent accounts. Effective November 17, 2025.

Indonesia's Ministry of Energy and Mineral Resources issued Permen ESDM No. 17 of 2025 on procedures for preparing, submitting and approving Work Plans and Budgets (RKAB) and reporting of mineral and coal mining activities. Signed by Minister Bahlil Lahadalia on 30 September 2025 and in force from 3 October 2025, the regulation reverses the 2023 three-year RKAB cycle back to an annual cycle, requires all IUP/IUPK holders to resubmit through the new MinerbaOne digital portal between 1 October and 15 November each year, annuls previously-issued 2026/2027 quotas, and introduces a 5-working-day auto-approval rule. Operationalised by a 2026 nickel-ore RKAB target band of 250–270 million wmt — roughly one third below the 2025 approved quota of ~379 million wmt — explicitly framed as a price-management and conservation instrument. First clear use of the RKAB framework as an explicit market-management lever rather than a domestic-licensing tool.

Presidential Decree No. 693 of 30 September 2025 ("On certain particularities of the sale of property held in federal ownership"), signed by Vladimir Putin and entered into force on the day of its official publication, creates an accelerated pathway for disposing of federally-owned property in cases determined by a separate decision of the President, where the goal is to ensure the Russian Federation's defence capability and security. Market valuation and the appraisal report must be completed within 10 business days of signing the appraisal contract; PSB Bank JSC (formerly Promsvyazbank, the state-controlled defence-procurement bank) is designated as the sale-organising agent and seller-on-behalf-of-the-state. The Decree also authorises the President to set special features of how Russian legislation on privatisation, joint-stock companies, limited-liability companies, the securities market, banks and competition protection applies to such sales. Expressly framed as a counter-measure to "unfriendly" actions by the United States and its allies; structurally the disposal-mechanism complement to the foreign-asset external- administration and seizure decrees (95/322/520/442) — the fast-track liquidation channel that converts seized or nationalised assets into state-budget cash for defence purposes.

China's State Council promulgated Order No. 818 on 28 September 2025 (effective 1 May 2026), establishing a comprehensive dual-track regulatory framework for biomedical new technologies — defined as techniques operating at the cellular or molecular level not yet clinically applied in China, covering cell therapy, gene editing, CAR-T, stem-cell, xenotransplantation, brain-computer interfaces, and nucleic-acid therapies. The regulation creates two parallel pathways: a traditional NMPA drug/device registration route and a new NHC-supervised clinical-research-to-commercialization track applicable to highly personalised or rare-disease therapies meeting staged safety and efficacy thresholds. Commercialisation under the NHC track is initially restricted to accredited Grade-3A medical institutions without full NMPA marketing approval, potentially accelerating patient access for qualifying technologies by 5–8 years relative to the standard registration pathway.

Italy enacted Legge 23 settembre 2025, n. 132 — "Disposizioni e deleghe al Governo in materia di intelligenza artificiale" — published in Gazzetta Ufficiale Serie Generale n. 223 of 25 September 2025 (atto 25G00143) and entered into force on 10 October 2025. The statute makes Italy the first EU member state to enact a comprehensive national AI law complementing Regulation (EU) 2024/1689 (EU AI Act), designating AgID (Agency for Digital Italy) and ACN (National Cybersecurity Agency) as national oversight authorities under Presidency-of-the-Council-of-Ministers coordination. It sets sectoral rules for healthcare, labour, intellectual professions, public administration and the judiciary; authorises up to €1 billion in state-backed venture capital (via CDP Venture Capital) for AI, cybersecurity and telecoms; creates criminal penalties of up to five years' imprisonment for harmful deepfakes; mandates parental consent for under-14 users; and delegates secondary legislation to the Government across multiple domains.

Republic Act 12253, signed by President Ferdinand R. Marcos Jr. on 4 September 2025, replaces the Philippines' long-standing flat-royalty regime for large-scale metallic mining with a five-tier margin-based royalty (1–5% on income from mines outside mineral reservations; 5% retained inside reservations) layered on a five-tier windfall-profits tax (1–10% on profits above a 30% margin), and ring-fences each mining agreement as a separate taxable entity. The law amends the National Internal Revenue Code (RA 8424) and is projected to raise an additional PHP 25.08 bn over 2026–2029. The new fiscal regime became operative on 17 February 2026, 150 days after effectivity, with DOF-issued IRR.

Czech Republic's first standalone federal statute on the resilience of critical-infrastructure entities — Act No. 266/2025 Sb., "Zákon o odolnosti subjektů kritické infrastruktury a o změně souvisejících zákonů" (Critical Infrastructure Act). Transposes EU Directive 2022/2557 (CER Directive on the resilience of critical entities) into Czech law and removes critical-infrastructure regulation from the earlier crisis-management law (Zákon č. 240/2000 Sb.) into a dedicated statute. Covers the 11 CER-Directive sectors (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, food production-processing-distribution) and obligates designated operators of essential services to conduct risk analyses, implement technical/organisational resilience measures, report incidents to sector-competent authorities, and submit to inspection. Published in the Sbírka zákonů on 4 August 2025; in force 19 August 2025; operator information-obligation deadline 1 March 2026.

Vietnam's Government adopted Decree 193/2025/ND-CP on 2 July 2025 (effective retroactively from 1 July 2025) as the primary operational statute elaborating the Law on Geology and Minerals No. 54/2024/QH15. The decree decentralises licensing for most mineral categories to provincial People's Committees while preserving central Ministry of Agriculture and Environment (MAE) authority over strategic and critical minerals, including rare earths, gold, uranium, and thorium. It codifies a three-tier Group I/II/III mineral classification, imposes a 100% financial-capacity bond requirement for exploration licences, sets a 40-working-day processing deadline, and defines the closed-enterprise framework that makes Vietnam's 1 January 2026 raw rare-earth export ban operationally enforceable through a Prime-Minister-designated list of licensed enterprises.

Türkiye's Grand National Assembly adopted Law No. 7552 (İklim Kanunu) on 2 July 2025, published in the Resmî Gazete on 9 July 2025 (Issue 32951) and entering into force immediately. The law is Türkiye's first comprehensive climate statute, establishing the legal framework for a national Emissions Trading System (ETS) — pilot phase from 2026, full implementation from 2028 — and creating the Carbon Market Board (Karbon Piyasası Kurulu) to govern allowance allocation and market operations. The ETS is designed for EU Carbon Border Adjustment Mechanism (CBAM) compatibility, materially affecting Türkiye's steel, cement, aluminium, and fertilizer export sectors, for which the EU is the primary market.

Canada announced on 29 June 2025 that it would rescind the Digital Services Tax Act (originally enacted 20 June 2024) to revive US-Canada trade negotiations after President Trump suspended talks on 27 June, citing the 3% DST on large digital-services revenues as a discriminatory measure against US technology firms. The Canada Revenue Agency halted collection effective 30 June 2025, and legislation to retroactively repeal the Act back to its June 2024 enactment date is to follow, with refunds — plus interest at the standard corporate tax refund rate — to be paid to affected taxpayers including US technology majors.

On 26 June 2025 President Bola Ahmed Tinubu signed four acts constituting Nigeria's most comprehensive fiscal overhaul in decades: the Nigeria Tax Act 2025 (NTA), Nigeria Tax Administration Act 2025 (NTAA), Nigeria Revenue Service (Establishment) Act 2025, and Joint Revenue Board (Establishment) Act 2025. The NTA consolidates and repeals six core statutes — CITA, PITA, PPTA, VAT Act, CGT Act, and Stamp Duties Act — into a single unified code effective 1 January 2026, while the NTAA standardises assessment, filing, and enforcement procedures across all federal taxes. The two establishment acts restructure the Federal Inland Revenue Service (FIRS) into the Nigeria Revenue Service (NRS) with a broadened mandate and create an empowered Joint Revenue Board to coordinate federal-state fiscal relations.

The National Assembly of Vietnam passed the Personal Data Protection Law (Luật Bảo vệ dữ liệu cá nhân), Law No. 91/2025/QH15, on 26 June 2025; it enters into force on 1 January 2026. The PDPL is Vietnam's first statutory (rather than decree-level) personal-data-protection framework, elevating the prior Decree 13/2023/ND-CP (PDPD) regime into a 5-chapter, 39-article primary statute and adding revenue-based administrative penalties of up to 5% of prior-year annual revenue for cross-border data-transfer violations and up to 10x illegal gains for unlawful data trading. The law is implemented by Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026) and applies extraterritorially to foreign organisations offering services to or processing the personal data of Vietnam residents.

Hong Kong enacted the Inland Revenue (Amendment) (Minimum Tax for Multinational Enterprise Groups) Ordinance 2025 (Ordinance No. 21 of 2025), gazetted on 6 June 2025 after the Legislative Council passed the Bill on 28 May 2025. The Ordinance inserts Part 4AA and Schedules 61–64 into the Inland Revenue Ordinance (Cap. 112), implementing the OECD/G20 Pillar Two GloBE rules for MNE groups with consolidated annual revenue ≥ EUR 750 million in at least two of the four preceding fiscal years. It introduces a 15% Income Inclusion Rule (IIR) and the Hong Kong Minimum Top-up Tax (HKMTT) — a Qualified Domestic Minimum Top-up Tax (QDMTT) — effective for fiscal years beginning on or after 1 January 2025; the Undertaxed Profits Rule (UTPR) is deliberately deferred to a date to be specified by gazette notice, completing a structurally phased Pillar Two architecture. IRD estimates additional revenue of approximately HKD 15 billion per year from 2027–28.

Peru's Ministry of Energy and Mines published Decreto Supremo N° 009-2025-EM in El Peruano on 18 May 2025, approving the implementing regulation for Law 32213 (Dec 2024). The decree operationalises the extension of the REINFO mining-formalisation registry deadline through 30 June 2025 (extendable +6 months), reaffirms MINEM as the rector authority over the small-scale and artisanal mining (MAPE) formalisation process, and creates SIPMMA — the Sistema Interoperable de Pequeña Minería y Minería Artesanal — as a state interoperable system for operational traceability of minerals, explosives, chemical inputs and controlled products. A controversial Article 10 had also opened a "REINFO hereditario" path allowing succession transfer of registry inscriptions; that provision was derogated two weeks later by DS 010-2025-EM (1 Jun 2025) under domestic and international anti-illegal-mining pressure.

On 11 April 2025 President Javier Milei signed Decreto de Necesidad y Urgencia 269/2025, published in the Boletín Oficial on 14 April 2025 (edición Nº 35.647). The decree repealed Decreto 28/2023, formally lifting the cepo cambiario — the foreign-exchange restrictions that had been in continuous operation in some form since November 2011. Operative provisions include elimination of the 80/20 export-proceeds-channelling mandate, removal of individual USD purchase and wire-transfer caps, permission for companies to repatriate post-1-January-2025 dividend profits, and replacement of the daily crawling-peg with a band float within a $1,000–$1,400 ARS/USD corridor with BCRA floor/ceiling intervention rules. The measure was coordinated with the IMF Extended Fund Facility (USD 20bn total; USD 15bn 2025 free-availability tranche) approved 11 April 2025, and operationalises the currency-stability guarantee embedded in the RIGI large- investment regime (Law 27.742, July 2024).

Ghana's Parliament passed the Ghana Gold Board Act, 2025 (Act 1140) on 29 March 2025; presidential assent followed on 2 April 2025, with full operational effect from 1 May 2025. The Act repeals PNDCL 219 (1989) and establishes the Ghana Gold Board (GoldBod) as the sole statutory licensor and exclusive primary buyer, seller, assayer, grader, weigher and exporter of all gold produced by the country's licensed Artisanal and Small-Scale Mining (ASM) sector. Large-scale mining operations remain outside the monopsony. Effective 1 May 2025, no person other than GoldBod may export ASM gold from Ghana, and all gold trading and marketing businesses must hold a GoldBod licence (application window for Ghanaian-owned firms opened 22 April 2025). Proceeds from all ASM gold exports settle through the Bank of Ghana, channelling foreign-exchange flows from roughly 30% of national gold output — Ghana is the world's #6 producer and Africa's largest — into formal central-bank reserves. The stated objectives are to combat smuggling, capture the smuggling-loss premium for the state, support Bank of Ghana gold-reserves accumulation, and generate foreign exchange. The Act sits alongside the Bank of Ghana's Domestic Gold Purchase Programme as the legal infrastructure for Ghana's gold-as-reserve-asset strategy.

Indonesia issued Government Regulation (Peraturan Pemerintah) No. 8 of 2025 on Foreign-Exchange Proceeds from Natural-Resource Exports (DHE SDA), amending PP No. 36/2023. President Prabowo Subianto announced the policy at Merdeka Palace on 17–18 February 2025 and the regulation takes effect on 1 March 2025. It mandates that exporters of non-oil- and-gas mining, plantation, forestry, and fisheries products with export-proceeds value of USD 250,000 or more per shipment retain 100 percent of those foreign-exchange proceeds inside Indonesia's financial system for 12 months — sharply up from the prior 30 percent for 3 months under PP 36/2023. Oil-and-gas exporters remain on the earlier 30 percent / 3-month regime. Permitted in-period uses include rupiah conversion at the holding bank, payment of state obligations in foreign currency, dividend distribution, payment for imported raw materials and capital goods unavailable domestically, and servicing of foreign-currency capital-expenditure loans. Non-compliance carries administrative sanctions including suspension of export services. The government has projected the measure could lift retained foreign- exchange proceeds by USD 80 billion in 2025 and over USD 100 billion on a full 12-month basis.

Japan's National Diet enacted the Cyber Response Capability Enhancement Act (重要電子計算機に対する不正な行為による被害の防止に関する法律, Law No. 42 of 2025) on 16 May 2025, together with companion arrangement legislation. Commonly known as the Active Cyber Defense (ACD) Law, the statute authorises (i) government monitoring of foreign-origin internet traffic transiting designated Japanese communication infrastructure for national-security threat indicators, (ii) pre-emptive access and neutralisation operations against attacker infrastructure abroad by the National Police Agency and the Self-Defense Forces under unified command, and (iii) mandatory cyber-incident reporting and government cooperation duties on critical-infrastructure operators. Implementation is phased through November 2027, with the NISC reorganised into the National Cybersecurity Office (NCO) under the Cabinet Secretariat from July 2025.

The Iraqi Council of Representatives adopted Law No. 4 of 2025 on 2 February 2025 (176 deputies present, majority vote), amending Article 12 of the Federal General Budget Law for Fiscal Years 2023-2024-2025 (Law No. 13 of 2023). The amendment mandates that the federal government pay international oil companies (IOCs) operating in the Kurdistan Region of Iraq (KRI) USD 16 per barrel in advance for crude production and transportation costs — more than doubling the USD 6/bbl rate in the original budget law — with all KRI crude to be delivered to and marketed exclusively through the State Organization for Marketing of Oil (SOMO). An international consulting firm, jointly appointed by Baghdad and Erbil within 60 days, is mandated to audit field-level production and transportation costs, with cost-recovery adjustments applied retroactively from the date pipeline flows resume. The law was published in the Iraqi Official Gazette (Al-Waqai al-Iraqiyya) Issue No. 4814 on 17 February 2025.

BIS (acting through its Office of Information and Communications Technology and Services, OICTS) published a final rule under Executive Order 13873's ICTS authority prohibiting certain connected-vehicle (CV) transactions involving hardware and software designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction of the People's Republic of China or the Russian Federation. The rule reaches the Vehicle Connectivity System (VCS — hardware/software enabling external RF connectivity above 450 MHz) and the Automated Driving System (ADS) software stack. Effective 17 March 2025, with phased prohibitions: import/sale of CVs incorporating covered software prohibited from model year 2027; import of covered VCS hardware prohibited from model year 2030 (or 1 January 2029 for hardware not associated with a model year). Importers and connected-vehicle manufacturers must file annual Declarations of Conformity.