Russia Adopts Its First AI Law: What Federal Law No. 243-FZ Means for Developers and Users

Russia has established its own legal framework for artificial intelligence. Its cornerstone is Federal Law No. 243-FZ of 26 July 2026, ‘On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation’. It entered into force on 1 September 2026, while certain obligations will not take effect until 1 March 2027. The policy foundation is the National Strategy for the Development of Artificial Intelligence Through 2030 (Presidential Decree No. 490 of 2019, updated in 2024). The strategy aims to foster domestic AI technologies, ensure technological independence and promote wider use of AI in the economy and public administration.

 

Unlike the European Union, with its comprehensive, risk-based Artificial Intelligence Act (AI Act), Russia follows a more targeted approach. The law does not regulate AI as a whole, but only large foundation AI models (in Russian, ‘большие фундаментальные модели’). All other AI applications remain subject to general legislation, particularly laws on personal data protection and copyright.

 

The law distinguishes between two categories of such AI models: sovereign and national. For both categories, data must be processed within the territory of the Russian Federation by Russian legal entities (Article 7). Under Article 6(4) of Federal Law No. 243-FZ, for an AI model to qualify as sovereign or national, its developer must not be under foreign control. The decisive criterion is direct or indirect control of more than 50% of the voting rights by Russian government bodies or citizens of the Russian Federation who hold no other citizenship. These requirements take effect on 1 March 2027.

 

The state promotes the development of these models through support measures. The government may also determine the sectors in which only sovereign or national models may be used and establish exceptions to this rule.

 

This has four key implications for businesses:

 

  1. Developers of large models must comply with specific requirements concerning hosting locations, data processing and control over the development process. From 1 March 2027, they will also be required to implement organisational and technical security measures and maintain technical documentation.
  2. Users should bear in mind that, in future, the use of AI in certain sectors may be permitted only with sovereign or national models. Whether these requirements apply to a particular company will depend on its field of activity and the regulations adopted by the government.
  3. Creators of AI-assisted content will be able to label it: users have the right to indicate the use of AI in audio and video materials. The law does not impose a general obligation to label every AI-generated text or image.
  4. Copyright and liability: Providers must inform users about the rights associated with generated outputs (Article 10(1)). For the training of sovereign and national models, a copyright exception is provided for works that have been lawfully acquired or are freely available (Article 10(2)). Liability for violations is governed by other provisions of Russian law (Article 11).

 

The law supplements other legislation that remains in force. This includes Law No. 152-FZ ‘On Personal Data’, which also applies to AI systems, and Law No. 572-FZ on the Unified Biometric System, which applies to biometric identification. Law No. 258-FZ on experimental legal regimes also permits time-limited trials under relaxed legal conditions.

 

Timeline:

 

  • September 2026: The law enters into force, except for provisions that take effect at a later date.
  • March 2027: Obligations for developers and the option to label audio and video materials.

 

Before March 2027, companies developing or offering large AI models should review where and by whom data are processed and adapt their security and documentation procedures. Users should check whether their use of existing AI services will remain permitted in regulated sectors. Contracts with AI providers should include provisions on the location of data processing and liability.

 

It has not yet been determined in which sectors the government will require the use of sovereign or national models.