🇷🇺Russia

Overview

Russia’s approach to artificial intelligence (AI) regulation is characterized by a high degree of state-led strategic planning and a focus on 'technological sovereignty.' The foundational document for this landscape is the National Strategy for the Development of Artificial Intelligence until 2030, originally approved by Presidential Decree No. 490 in 2019 and significantly updated by Presidential Decree No. 124 in February 2024. The Russian government views AI not merely as a technological tool but as a critical component of national security and economic independence. This philosophy has intensified since 2022, leading to a regulatory environment that prioritizes the development of domestic hardware, software, and foundational models to reduce reliance on foreign technology stacks. The strategy emphasizes the need for 'AI readiness' across all sectors of the economy, with a specific focus on the transition to the 'Data Economy' national project, which aims to consolidate data resources for machine learning purposes. The maturity of the Russian AI regulatory framework has evolved from high-level ethical guidelines and broad strategic goals toward more concrete legislative mechanisms. The primary vehicle for AI deployment is the 'Experimental Legal Regime' (ELR) framework, which functions as a series of regulatory sandboxes. These regimes allow the government to test AI applications in real-world scenarios—such as autonomous vehicles or AI-driven medical diagnostics—while temporarily exempting participants from certain federal laws. This iterative approach allows the state to gather data on AI risks before enacting permanent, nationwide legislation. By 2024, the focus has shifted toward addressing the legal gaps identified in these experiments, particularly regarding liability, insurance, and the governance of generative AI systems. The updated strategy also places a heavy emphasis on the development of large language models (LLMs) and the creation of a domestic ecosystem for generative AI that adheres to national security and cultural standards.

Regulatory approach

Russia utilizes a hybrid regulatory model that combines horizontal strategic mandates with sector-specific experimental rules. At the horizontal level, the National AI Strategy sets the agenda for all federal executive bodies, requiring them to integrate AI targets into their sectoral planning. However, the actual 'binding' rules are often found within the specific decrees that establish Experimental Legal Regimes. This risk-based approach allows the government to tailor restrictions to the specific dangers of an application; for instance, AI in healthcare or autonomous transport is subject to much stricter oversight and mandatory insurance requirements than AI used in administrative or e-commerce contexts. The Ministry of Economic Development acts as the central coordinator for these sandboxes, ensuring that innovation does not bypass fundamental safety protocols. The regulatory philosophy is increasingly moving from 'soft law' (voluntary ethics) to 'hard law' (statutory requirements). While the 2021 Code of Ethics in the Field of Artificial Intelligence remains a cornerstone for voluntary industry alignment, the enactment of Federal Law No. 123-FZ in 2024 introduced mandatory civil liability insurance for participants in experimental regimes. This indicates a transition toward a more prescriptive framework where developers must guarantee compensation for potential harms. Furthermore, the integration of the federal AI project into the broader 'Data Economy' national project signifies a move toward a unified digital governance architecture where AI, big data, and cybersecurity are regulated as an interdependent ecosystem. This approach is designed to foster a 'sovereign' technology stack, reducing the influence of international standards that may conflict with domestic policy objectives. The governance of AI in Russia is highly centralized, with the Ministry of Economic Development serving as the primary administrative authority. This ministry is responsible for the 'Experimental Legal Regimes' framework, maintaining the registry of participants, and evaluating the results of AI testing. It works in close coordination with the Ministry of Digital Development, Communications and Mass Media, which oversees the underlying digital infrastructure, including the creation of national datasets and the expansion of domestic computing power. These ministries ensure that AI development aligns with the broader goals of the 'Data Economy' national project, which is the successor to the 'Digital Economy' project. Enforcement and oversight are also managed through the Coordination Council for Experimental Legal Regimes. This inter-agency body has the power to approve, suspend, or terminate AI experiments if they pose a risk to public safety. Additionally, the National Center for Artificial Intelligence, acting under the Government of the Russian Federation, provides analytical support and monitors the implementation of the National Strategy. For issues involving data usage in AI, Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media) acts as the primary regulator, ensuring that AI systems comply with strict personal data protection and localization laws. The Russian Academy of Sciences also plays a role in the technical certification and safety evaluation of high-risk AI systems.

Enforcement & penalties

Enforcement in the Russian AI sector is currently focused on compliance within Experimental Legal Regimes and data protection standards. Under Federal Law No. 123-FZ, the most significant enforcement mechanism is the mandatory insurance requirement. If an AI system causes harm to life, health, or property, the developer or operator is liable for compensation. Failure to maintain adequate insurance or to comply with the safety protocols of an experimental regime can lead to immediate exclusion from the sandbox, revocation of regulatory exemptions, and administrative fines. The law also established a compensation fund to cover damages that exceed insurance limits, which is funded by participant contributions and managed by the state. Beyond AI-specific laws, enforcement is handled through the Code of Administrative Offenses and the Criminal Code. For instance, if an AI system is involved in a massive data breach or unauthorized processing of personal data, Roskomnadzor can impose substantial administrative fines, which have been increased in recent years to reflect the scale of digital risks. In cases of gross negligence leading to death or significant property damage, criminal liability may apply to the individuals responsible for the system's deployment. The 2024 amendments have specifically improved the 'attribution mechanism,' making it easier for authorities to identify whether the developer, the deployer, or the infrastructure provider is legally responsible for a specific AI-related incident, particularly in the context of autonomous systems.

Data protection

The data protection framework for AI in Russia is governed primarily by Federal Law No. 152-FZ 'On Personal Data.' This law is broadly similar to the GDPR in terms of its focus on consent and data subject rights but includes unique, stringent requirements for data localization. All personal data of Russian citizens must be stored and processed on servers physically located within the Russian Federation. For AI developers, this means that training models on the data of Russian users requires a domestic infrastructure, which aligns with the state’s broader 'technological sovereignty' objectives. This localization requirement is strictly enforced by Roskomnadzor, with non-compliance leading to heavy fines or the blocking of services. Recent updates to the data framework have introduced more specific rules for 'big data' and the creation of 'state data sets' for AI training. The government has moved to centralize access to anonymized data from public services to assist domestic AI companies in training large models. However, Roskomnadzor maintains strict oversight over the anonymization process to prevent the re-identification of individuals. AI developers must also navigate the requirements of Federal Law No. 149-FZ 'On Information, Information Technologies and Information Protection,' which governs the security of critical information infrastructure and sets standards for the transparency of algorithms used in public-facing services. There is also a growing focus on 'data sovereignty,' ensuring that critical datasets do not leave the country or fall under the control of foreign entities.

Sector-specific rules

Sector-specific AI regulation in Russia is most advanced in the fields of healthcare, transportation, and finance. In healthcare, the Ministry of Health has established specific protocols for the use of AI in medical imaging and diagnostics. These systems must undergo rigorous clinical testing within an experimental legal regime before they can be certified for general use in state hospitals. The focus is on ensuring that AI acts as a 'decision support system' rather than a replacement for human medical professionals, maintaining a 'human-in-the-loop' requirement for final diagnoses. Specific GOST standards have been developed to regulate the quality and safety of medical AI software. In the transportation sector, Russia has implemented extensive testing for autonomous vehicles (AVs). Federal decrees have enabled the operation of driverless taxis and freight trucks in specific regions, such as Innopolis and parts of Moscow and Tatarstan. These rules specify the technical requirements for AV sensors, the mandatory presence of a remote operator or 'test driver' in certain stages, and the specific insurance coverage required for potential accidents. Similarly, in the financial sector, the Central Bank of Russia oversees the use of AI in credit scoring and algorithmic trading, focusing on preventing systemic risks and ensuring that AI-driven decisions do not lead to discriminatory lending practices. The Central Bank has also issued recommendations on the use of AI in internal risk management for commercial banks.

International alignment

Russia’s international alignment on AI has shifted significantly toward the BRICS (Brazil, Russia, India, China, and South Africa) and the Eurasian Economic Union (EAEU). While the early development of the Russian AI Ethics Code drew inspiration from UNESCO and OECD principles, the current focus is on creating a 'sovereign' regulatory standard that is independent of Western frameworks like the EU AI Act. Russia actively promotes the creation of a BRICS AI Study Group to develop common standards for AI safety and ethics that prioritize national sovereignty and non-interference in domestic affairs. This shift is part of a broader strategy to build a multipolar digital world where different regions can maintain their own technological and ethical standards. Despite this shift, Russia continues to monitor international technical standards, such as those from the ISO and IEC, to ensure that domestic AI products remain competitive in global markets, particularly in the Global South. The Russian government has expressed skepticism toward the 'Brussels Effect' of the EU AI Act, arguing that overly restrictive regulations may stifle innovation and serve as a tool for protectionism. Instead, Russia advocates for a model where international cooperation is focused on preventing the use of AI for cyber-warfare and ensuring that AI development does not exacerbate the digital divide. Russia also participates in the development of AI standards within the Commonwealth of Independent States (CIS) to ensure regional interoperability.

What's next

The next phase of AI regulation in Russia will be dominated by the transition to the 'Data Economy' national project, which is scheduled to be fully operational by July 1, 2024. This project will consolidate funding and oversight for AI, aiming to achieve 'AI readiness' in 95% of critical economic sectors by 2030. Legislatively, there are ongoing discussions regarding a unified 'AI Act' or a 'Digital Code' that would move beyond experimental regimes to establish permanent legal definitions for AI entities, digital personalities, and the ownership of AI-generated intellectual property. This would provide a more stable legal environment for long-term investment and clarify the status of AI as a subject or object of law. Another key area of future development is the regulation of generative AI and deepfakes. The Russian parliament is considering amendments to the Information Law that would require mandatory labeling of AI-generated content and establish stricter penalties for the use of deepfakes in fraud or disinformation campaigns. Additionally, as the 2024 liability law undergoes its first years of implementation, the government is expected to refine the 'Compensation Fund' mechanisms and potentially introduce specialized 'AI Courts' or arbitration bodies to handle complex technical disputes arising from AI-related harms. There is also a push to develop national benchmarks for LLMs to ensure they align with Russian linguistic and cultural values, further cementing the goal of technological sovereignty.