Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has confirmed it will support a unified mechanism inside robots.txt that lets website owners signal their preference regarding the use of site content for training generative AI models.
The company stated in its Search Central blog that the new capability will be introduced in 2027 and is based on proposals developed by the AIPREF working group at IETF. Rather than maintaining separate directives for every AI provider, publishers will be able to set one general policy marker that participating organizations are expected to honor.
Google has indicated it will interpret an unspecified general marker in the same manner as its existing Google-Extended directive. At the same time, current per-provider settings will remain fully supported, allowing site owners to establish a broad default rule while still applying different conditions to individual companies.
For publishers, the change is expected to reduce the operational burden of managing an expanding list of AI crawlers. However, the mechanism only communicates usage preferences and does not technically block access to servers. Its effectiveness will ultimately depend on which organizations join the initiative and consistently respect the declared rules.
The proposal is still under active development and will continue to be refined through the IETF standardization process before final implementation.
Related articles
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.
Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027
The Russian Ministry of Digital Development plans to start issuing state-backed code signing certificates for software developers in 2027, with corporate security certificates following in 2028. The initiative aims to help operating systems identify publishers and verify that code has not been altered after release. A draft government decree would grant MinTsifry the powers of a National Certification Authority, allowing it to set certificate requirements, issue and revoke certificates, define validity periods, and maintain a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities in the software. The law permits charging fees for certificates, but no decision on pricing has been made yet. Full recognition by operating systems, browsers, and app stores will be required, and foreign platforms are not obligated to trust the Russian certificates automatically.
Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection
Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.
How EVRAZ Built Effective Information Security Processes Without Draconian Restrictions
EVRAZ maintains over 92 percent compliance with information security requirements through a small dedicated team despite managing thousands of developers and industrial infrastructure. The company gradually implemented security controls with long transition periods, starting with critical vulnerabilities and expanding to all projects after internal demand grew. External contractor agreements include mandatory adherence to EVRAZ security standards, while architecture reviews enforce DMZ usage and protective controls such as WAF for internet-facing services. A real-world case showed developers initially resisting WAF due to latency concerns but later requesting its reinstatement after observing increased bot activity during a temporary disablement. The department also handled a case where a non-IT employee used AI-assisted development to build an internal service that was quickly compromised during a pre-meeting assessment. EVRAZ now focuses on scaling existing review processes to cover AI-generated code and vibe coding across all users rather than imposing outright bans.