Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027

Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West

A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.

Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection

Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.

How EVRAZ Built Effective Information Security Processes Without Draconian Restrictions

EVRAZ maintains over 92 percent compliance with information security requirements through a small dedicated team despite managing thousands of developers and industrial infrastructure. The company gradually implemented security controls with long transition periods, starting with critical vulnerabilities and expanding to all projects after internal demand grew. External contractor agreements include mandatory adherence to EVRAZ security standards, while architecture reviews enforce DMZ usage and protective controls such as WAF for internet-facing services. A real-world case showed developers initially resisting WAF due to latency concerns but later requesting its reinstatement after observing increased bot activity during a temporary disablement. The department also handled a case where a non-IT employee used AI-assisted development to build an internal service that was quickly compromised during a pre-meeting assessment. EVRAZ now focuses on scaling existing review processes to cover AI-generated code and vibe coding across all users rather than imposing outright bans.