Russia Simplifies State Support Access for National AI Model Developers
Russian developers of large AI models will soon face a shorter and clearer path to government support after the law on artificial intelligence development comes into force. Authorities plan to simplify the process of obtaining the status of a national or sovereign model, with all decisions verified using a single standardized set of test tasks.
The reference test, according to Izvestia, will be published in open access and updated on a regular basis. This approach will allow developers to understand in advance exactly what criteria the state intends to use when examining their neural networks, rather than discovering requirements only after submitting documents.
New statuses and related support measures will be available to companies including MWS AI, T-Bank, and other market participants. Several organizations that have passed state verification will conduct the expertise. The primary criterion will focus on Russian company control over the entire lifecycle of the model instead of the origin of every line of code.
Developers will be permitted to use foreign components under open licenses, provided they can independently modify, develop, and maintain the solution even after external technologies disappear. Bureaucratic hurdles will also be reduced: missing documents can be submitted after the initial application, and some redundant information will no longer be required.
Computing infrastructure must remain in Russia, although data centers may be rented or used on other legal grounds. The first sectors where domestic models will become mandatory include education and public services, covering educational processes, citizen appeals handling, and remote interactions.
The main provisions of the law will take effect on September 1, 2026, while requirements for sovereign models, content labeling, and intellectual property will begin on March 1, 2027. A complete ban on foreign AI solutions is not planned, although the government may restrict certain sectors to Russian models only.
Related articles
VPN Rules in Russia 2026: No Fine for Ordinary Users but Strict Penalties for Advertising and Extremist Content Access
As of September 2026, Russia maintains no separate administrative fine for ordinary citizens simply connecting to a VPN service. Responsibility arises only for specific actions such as deliberately searching for known extremist materials, advertising tools to bypass restrictions, or failing to comply with Roskomnadzor demands as a service operator. Corporate VPNs used for remote access to company networks remain fully legal under exceptions in Article 15.8 of Law No. 149-FZ. New provisions in the Code of Administrative Offenses, including Articles 13.53, 13.52 and 14.3 introduced by Laws 281-FZ and 282-FZ, impose fines ranging from 3,000 to 500,000 rubles depending on the violation and the offender category. The rules distinguish clearly between end users, service owners and advertisers. VPN technology itself is not banned, yet public services face ongoing blocking and operators must integrate with state filtering systems. The material reflects the regulatory situation on 24 September 2026.
Troubleshooting Erroneous TSPU Blocks: How Admins Can Collaborate with Russian Regulators
A Moneta client outage traced back to erroneous filtering on Russia's TSPU system rather than internal infrastructure or DDoS protection. Engineers used curl, traceroute, nping, and custom Python scripts to confirm TCP payload-based blocking after the handshake. The team submitted a request via the VTS personal account, received partial acceptance status, then escalated to DCOA and SSOP to obtain the specific TSPU site number. Detailed network traces and active traffic were required for diagnostics. The case highlights coordination challenges between operators, DCOA, and SSOP when erroneous blocks occur on information resources.
Security Vision Unveils Self-Assessment Portal for Unified Information Security Evaluation Across Corporate Holdings
Security Vision has launched a new Self-Assessment portal designed to consolidate information security self-evaluations for entire corporate groups and holdings. The platform addresses common challenges where subsidiaries maintain inconsistent compliance records, with some requirements fulfilled while others remain unresolved for years in scattered emails and spreadsheets. Security Vision SA covers the complete workflow from defining requirements and distributing questionnaires to calculating results and tracking remediation actions. Parent organizations gain a consolidated view of subsidiary compliance status along with detailed breakdowns by individual systems. The system supports requirement templates, version control, scheduled assessments, automated metric-based answers, and conversion of gaps into actionable plans with assigned owners and deadlines. Additional features include internal policy document management and interactive dashboards for analysis. The first public demonstration is scheduled for the SOC Forum on October 27-28.
Russian Websites Remain Dependent on Foreign SSL Certificates and Analytics Despite Sanctions
A Russian security researcher developed an open-source tool to scan websites for dependencies on foreign services that could be cut off abruptly. The scan of 50 major Russian sites including banks, retailers, telecoms, airlines, delivery services, online schools and government portals revealed that servers have largely been migrated domestically. However, critical components such as SSL certificates, analytics platforms and fonts remain tied to overseas providers. 43 out of 50 sites still use foreign SSL certificates, primarily from Belgian GlobalSign and American Let's Encrypt, while only four rely on the Russian NUC certificate from the Ministry of Digital Development. The study also highlights legal obligations under Roskomnadzor rules effective since March 2023 requiring prior notification for cross-border personal data transfers. Many sites continue using Google Analytics, Google Fonts and reCAPTCHA without realizing the compliance and resilience risks. The tool assigns letter grades from A to F based on the number of foreign dependencies detected.