Japan just built a rule that walls off Chinese cloud providers without ever naming China. Starting in 2027, Japan will launch a national security certification for data centers and cloud services. Hospitals, banks, and research institutions that handle sensitive data will be strongly steered toward certified providers. The criteria look at ownership, capital ties, and foreign government influence, but no country is named. Here’s the practical reality: no Chinese product has ever passed Japan’s existing JC-STAR cybersecurity certification. Not one. The new system builds directly on that record. The unspoken target is China’s National Intelligence Law, which can force Chinese companies to hand data over to the state even when their servers are in Japan. Alibaba opened its fifth Tokyo data center earlier this year. Under the new framework, sensitive institutions will be guided away from exactly that kind of operator. Using an uncertified service stays technically legal. In practice, the government will be reviewing those same institutions’ data practices directly, so the choice is heavily one-sided. No country is named. The effect is clear.