Deals die in Japan not because the product is wrong but because the vendor’s engagement model is wrong. The most common failure mode: the vendor mistakes urgency for progress and burns the relationship trying to accelerate a process that cannot be accelerated without being started correctly.
How decisions are actually made
Ringi is the formal written approval process. A ringi-sho is drafted, circulated from the lowest relevant management level upward, and signed off at each level until it reaches the appropriate decision authority. This can take weeks. It can take months. It is not a bottleneck to route around. It is the decision.
Before the ringi-sho is drafted, nemawashi happens. Nemawashi is informal consensus-building that determines whether the formal process will succeed. Individual stakeholders — IT security, legal, procurement, the department that will use the product, finance — are approached separately. Their concerns are addressed. Their support is secured. The ringi-sho that fails is almost always the one drafted before nemawashi was complete.
The fiscal year reality
Japan FSI operates on an April-to-March fiscal year. Budget decisions for the next fiscal year are typically locked by December. If you are running a first meeting in October, you are in a conversation for the April budget cycle. A first meeting in February means you are almost certainly pitching for April of the year after. Understanding where you are in the fiscal cycle is not optional.
APPI as a parallel procurement track
APPI governs how organisations handling personal data evaluate and approve third-party data processors. For most foreign SaaS security vendors, APPI compliance review is a separate track running in parallel to commercial procurement. It has different decision-makers and a different timeline. Missing this track, or treating it as an afterthought, kills deals that were otherwise on track.
What successful vendors do
They arrive with a prepared account of how their product handles personal data, who has access to it, where it is stored, and how they would respond to a data incident. They have Japanese-language documentation ready. They do not push for decisions before the internal team is ready. They maintain contact between meetings without creating pressure. They treat the 12-18 month cycle as the cost of entry.