Russia
◆Binding
Binds Every «оператор» — under art. 3(2) any state body, municipal body, legal person or natural person that, alone or jointly with others, organises and (or) carries out the processing of personal data and determines its purposes, composition and the operations performed. There is no size, sector or turnover threshold, so enterprise, SME, sole trader and public body are all covered. Art. 1(1) applies the Law to processing by federal and regional state bodies, other state and municipal bodies, legal persons and natural persons using automation means or without them where the processing corresponds to how it would be done with automation; art. 1(2) carves out processing by a natural person for purely personal and family needs, archival processing, and processing of information constituting a state secret. Art. 2(1) of Federal Law No. 242-FZ localisation duties sit separately and are not part of art. 16.. Russia's automated-decision rule predates the GDPR and is drafted as a flat prohibition with a very narrow way out. Article 16 of Federal Law No. 152-FZ of 27 July 2006 «О персональных данных» opens by forbidding outright the taking, on the basis of solely automated processing of personal data, of decisions «порождающих юридические последствия в отношении субъекта персональных данных или иным образом затрагивающих его права и законные интересы», except in the cases in part 2. The trigger is wider than the European one: the second limb catches any decision that «otherwise affects the rights and legitimate interests» of the person, with no significance qualifier at all, so nothing corresponding to GDPR art. 22(1)'s «similarly significantly affects» threshold has to be cleared. Part 2 then admits exactly two routes: the written consent of the data subject, or a case provided for by a federal law that also lays down measures to secure the person's rights and legitimate interests. There is no contract limb. GDPR art. 22(2)(a) lets a controller automate a decision that is necessary for entering into or performing a contract, and Zambia's s. 62(2) and Mauritius's s. 38(2) carry the same escape; Russia does not, so an automated credit refusal, tenancy screen or insurance decline taken in the course of contracting sits in the prohibition unless a signed consent exists. The consent route is also heavier than it looks, because art. 9(4) governs what a «согласие в письменной форме» has to contain — among other particulars the person's identity-document number and the date and issuing body of that document — and an electronic document signed with an electronic signature is the only equivalent of a handwritten signature. Part 3 is a standing, unconditional duty: the operator explains to the data subject «порядок принятия решения» — the procedure by which the decision is taken — and the possible legal consequences of it, provides the opportunity to state an objection to the decision, and explains how the person may protect their rights and legitimate interests. That duty is proactive rather than answer-on-request, which is stronger than GDPR arts. 13(2)(f) and 15(1)(h); but its object is the procedure, not «логика», so no meaningful-information-about-the-logic right exists anywhere in the Law. Part 4 gives the operator thirty days from receipt to consider the objection and notify the person of the result. It stops there: nothing obliges the operator to change the decision, and no right to obtain human intervention and no right to contest before a person are expressed as such. The rest of the Law is silent on automated decisions — the art. 14(7) access list runs to ten items and none of them is an automated-decision or logic item, and the art. 18(3) notice for data not collected from the subject runs to five items with no such limb either. The Law carries no AI-specific rule; its only three mentions of «искусственный интеллект» are cross-references to the Moscow AI experiment statute, Federal Law No. 123-FZ of 24 April 2020, and they are permissions to process anonymised data rather than obligations.
In force since 26 January 2007, and the 2006 date on the face of the Law is not the operative one. Art. 25(1) puts the Law in force «по истечении ста восьмидесяти дней после дня его официального опубликования». The official record card at pravo.gov.ru lists three publications — «Российская газета» No. 165 of 29 July 2006, «Парламентская газета» Nos. 126-127 of 3 August 2006, and Собрание законодательства РФ 2006 No. 31 (Part I) item 3451 — and the earliest of them, 29 July 2006, is the official publication for the purposes of Federal Law No. 5-FZ of 14 June 1994 art. 4. The 180-day period therefore ran from 30 July 2006 and expired at the end of 25 January 2007, putting the Law in force on 26 January 2007. Art. 16 in its present wording is the redaction of Federal Law No. 261-FZ of 25 July 2011, which rewrote much of the Law; the article has not been touched since. The most recent amendment to the Law, Federal Law No. 265-FZ of 26 July 2026, rewrote parts of art. 12 on cross-border transfers and left art. 16 alone, so the text checked here is the current consolidated official text.
Stated maximum penalty — Art. 24(1) of the Law only refers offenders to «предусмотренную законодательством Российской Федерации ответственность», so the amounts sit in the Code of Administrative Offences, and which paragraph applies depends on which part of art. 16 was breached. Taking the decision without the written consent that art. 16(2) requires is the offence in KoAP art. 13.11(2) — processing without the written consent of the data subject in the cases where that consent has to be obtained, or processing in breach of the requirements as to what the written consent has to contain — carrying 10,000-15,000 roubles for citizens, 100,000-300,000 for officials and 300,000-700,000 for legal persons, and on repetition under art. 13.11(2-1) 15,000-30,000, 300,000-500,000, 500,000-1,000,000 for individual entrepreneurs and 1,000,000-1,500,000 for legal persons. Failing the art. 16(3) duty to explain is the separate and much smaller offence in KoAP art. 13.11(4) — failure to provide the data subject with information concerning the processing of their personal data — at 40,000-80,000 roubles for legal persons. The general paragraph, art. 13.11(1), at 150,000-300,000 roubles for legal persons since Federal Law No. 420-FZ of 30 November 2024, expressly excludes the cases falling under parts 2 and 11-18, so it is the residual rather than the headline figure here. Enforcement is split: Roskomnadzor draws up the protocol under KoAP art. 28.3(2)(58) but does not impose the fine, because art. 13.11 cases are decided by a judge under KoAP art. 23.1. Art. 24(2) of the Law adds compensation for moral harm, recoverable independently of pecuniary damage and of the subject's losses.
Russia
◆Binding
Binds Any person that provides the ability to use a large foundational AI model as defined in art. 3(2) — not fewer than 1 billion parameters, general-purpose across a large number of tasks, and serving as the basis for creating and refining other software. The duty is expressed without a nationality, size or turnover limb, in contrast to arts. 6 to 8, which apply only to Russian legal persons developing models granted sovereign or national status. Art. 1(3) reserves to other federal laws and presidential acts the setting of special rules for defence, state security, operational-search activity, public order and property protection, public and road safety including counter-terrorism, anti-money-laundering and counter-terrorist-financing, emergency prevention, diplomatic and consular service and state administration, so those uses may be governed differently.. Federal Law No. 243-FZ of 26 July 2026 «О поддержке развития технологий искусственного интеллекта в Российской Федерации» is Russia's first AI statute, and this is its broadest genuine duty. Art. 10(1) requires «лица, предоставляющие возможность применения больших фундаментальных моделей искусственного интеллекта» — the persons who make a large foundational model available for use — to notify the user of two things unless another federal rule provides otherwise: to whom the rights belong in the results of intellectual activity obtained with the help of the model, and on what conditions the user is given access to, use of, and retention of those results, retention being qualified by technical possibility. Unlike arts. 6 to 8, the duty is not confined to sovereign or national models or to Russian developers, so it reaches any provider offering such a model to users in Russia. Its scope is set entirely by the art. 3(2) definition: a large foundational model is a computer program intended to perform intellectual tasks at a level comparable to or exceeding human intellectual activity, using algorithms and trained on data sets to infer patterns, supply information, take decisions or forecast results against human-set goals, simultaneously serving as the basis for creating and refining various kinds of software, containing not fewer than 1 billion parameters and applied to a large number of different tasks. Every cumulative limb has to be met, so smaller and narrow-purpose models fall outside the Law altogether. Art. 10(2) sits alongside as a permission rather than a duty: accessing information contained in copyright and neighbouring-rights objects for the practical application of what they contain, including machine extraction, comparison, classification and analysis of patterns, trends and correlations, and short-term reproduction in machine memory, is declared not to infringe — but only where it is done exclusively to train a sovereign and (or) national large foundational model, and only where the developer uses a lawfully obtained copy or the work had been communicated to the public and was available for analysis without technical restriction. A text-and-data-mining exception that is available only to models holding a state-conferred status is an unusual shape and worth noting when comparing it with the EU and Singapore exceptions.
The date on which this duty starts is 1 March 2027, not the 1 September 2026 date reported as the commencement of the Law. Art. 13(1) does put the Law in force on 1 September 2026, but art. 13(2) then defers arts. 8, 9 and 10 in full, together with art. 5(2) points 3 to 5 and art. 6 parts 2 to 5, to 1 March 2027. What actually commences on 1 September 2026 is the subject matter, aims, definitions and principles in arts. 1 to 4, the coordination and support-measure powers in art. 5(1) and art. 5(2) points 1 and 2, the statement of purpose in art. 6(1), the art. 7 list of what a status-holding developer may do, the bare liability referral in art. 11, and arts. 12 and 13 — none of which places a compliance duty on anyone. The official record confirms the position: the pravo.gov.ru register carries the Law as «Не вступил в силу» with a single original redaction marked «вступает в силу 01.09.2026». Adopted by the State Duma on 8 July 2026, approved by the Federation Council on 17 July 2026, officially published on the legal-information portal on 26 July 2026 under number 0001202607260003, and reproduced at Собрание законодательства РФ 2026 No. 30 item 4089 and in «Российская газета» of 31 July 2026.
Stated maximum penalty — None is stated in the Law. Art. 11 is a bare referral — participants in relations in the field of development, deployment and application of large foundational models bear responsibility «в соответствии с законодательством Российской Федерации» for breaches of the Law and of the acts adopted under it — and as at 21 August 2026 the Code of Administrative Offences carries no article addressed to large foundational AI models, so no monetary band attaches to art. 10(1). Where the failure to notify also amounts to a consumer-information failure or a personal-data breach, the existing KoAP articles apply on their own terms. This entry deliberately states no figure rather than importing one from an adjacent regime.
Russia
◆Binding
Binds Owners of sites, site pages, information systems and computer programs meeting all of the art. 9(3) limbs at once: intended for or used by users to supply or distribute information via personal pages the users create; carrying information in the state language of the Russian Federation, in the state languages of republics within it, or in other languages of the peoples of Russia, on which advertising aimed at attracting the attention of consumers located in Russia may be distributed; and accessed within twenty-four hours by more than 500,000 internet users located in Russia. That is a large-platform threshold, so the practical population is a short list of user-generated-content services. Art. 9(1) and (2) address the person applying the model and the person providing the ability to apply it, but neither is placed under a duty by them.. Russia's first AI statute stops short of an AI-content labelling mandate, and the gap between what art. 9 says and what it is widely reported to say is the point of this entry. Art. 9(1) provides that a person who applies a large foundational model to create informational material in audio and (or) visual form «обеспечивается возможность размещения информационного предупреждения» — is provided with the possibility of placing an informational warning about the use of AI technologies. That is an entitlement, not a duty, and art. 9(2) confirms the reading by leaving the format, content and manner of placing the warning to be fixed by agreement between the person applying the model and the person providing the ability to apply it, which is not how a statutory labelling obligation is drafted. The single hard duty in the article is art. 9(3), and it falls on the platform rather than on the creator: the owner of a site or page of a site on the internet, or of an information system, or of a computer program that is intended for or used by its users to supply and (or) distribute information through personal pages they create, on which advertising directed at consumers located in Russia may be distributed, and access to which within twenty-four hours exceeds five hundred thousand internet users located in Russia, has to ensure that users distributing information created with large foundational models on their personal pages have the possibility of placing an informational warning about that use. The obligation is therefore to build and offer the labelling affordance, not to label, not to detect AI-generated material, and not to take anything down. Compare the EU AI Act art. 50 machine-readable marking duty on the generating provider and the deployer's disclosure duty, or the Chinese labelling measures, both of which put the duty on the party that makes or publishes the content: Russia's rule leaves the decision to label with the user and makes the large platform supply the button.
Art. 9 is one of the articles art. 13(2) defers: the Law enters into force on 1 September 2026 under art. 13(1), but arts. 8, 9 and 10, along with art. 5(2) points 3 to 5 and art. 6 parts 2 to 5, take effect on 1 March 2027. The platform enablement duty therefore does not bite on the commencement date that most accounts of the Law report. Adopted by the State Duma on 8 July 2026, approved by the Federation Council on 17 July 2026, officially published 26 July 2026 as number 0001202607260003 on the official legal-information portal, and carried at Собрание законодательства РФ 2026 No. 30 item 4089 and in «Российская газета» of 31 July 2026. The official register records the Law as not yet in force with a single original redaction commencing 1 September 2026.
Stated maximum penalty — None is stated in the Law. Art. 11 refers offenders to «законодательство Российской Федерации» generally, and as at 21 August 2026 no article of the Code of Administrative Offences is addressed to large foundational AI models or to the art. 9(3) enablement duty, so no figure can be stated. The separate marking rules that apply to advertising and to information intermediaries are outside this entry.
Russia
◆Binding
Binds Russian individual entrepreneurs and legal persons that develop, design, train or modify a large foundational AI model within art. 3(5) and whose model has been granted sovereign and (or) national status under the procedure art. 6(5) leaves to the Government. Developers of large foundational models without that status, and foreign developers, are outside art. 8. The separate power in art. 5(2)(3) for the Government to designate cases in which only sovereign and (or) national models may be applied — for banking and other financial-market spheres in agreement with the Central Bank — is what can make the status commercially necessary rather than optional in a given sector.. Art. 8 is the closest thing Russian law has to a foundation-model developer obligation, and its chapeau is what decides how far it reaches: the duties are imposed on «разработчик суверенной и (или) национальной больших фундаментальных моделей искусственного интеллекта» — the developer of a sovereign and (or) national large foundational model — and not on developers generally. Sovereign and national status is conferred, not assumed: art. 6(5) leaves the Government to set the procedure for recording models and assigning the status, art. 6(2) makes a sovereign model one whose developer is a Russian legal person, whose development and characteristics are determined by that Russian legal person across the whole lifecycle, whose development cycle including training is fully technically reproducible, whose user queries are answered and whose data are stored in data centres located in Russia and belonging to Russian legal persons, and which has passed confirmation of conformity with Russian legislation and with traditional Russian spiritual and moral values in a procedure to be established by the Government; art. 6(3) defines a national model on similar lines but requires only that the Government-specified essential characteristics be determined by the Russian developer and that externally sourced components, including other developers' models, be distributed under an open licence. Art. 6(4) supplies the control test for what counts as a Russian legal person, at more than fifty per cent of the votes. Against that background art. 8 requires the status-holding developer to take organisational and technical measures to secure the model, to define rules of operation setting the limits and conditions of its application, updating and decommissioning, and to keep technical documentation describing the model's key parameters and limitations to the extent needed to assess the safety of its application. The duties are the counterpart of the art. 7 package of state support, access to state data sets for training under art. 5(2)(5) and the art. 10(2) training exception, so in substance this is a conditional regime a developer opts into rather than a horizontal safety obligation of the EU AI Act general-purpose kind. The consequence worth recording is the negative one: a developer of a large foundational model that does not hold either status carries none of the art. 8 duties.
Art. 8 is deferred by art. 13(2) to 1 March 2027, together with art. 9, art. 10, art. 5(2) points 3 to 5 and art. 6 parts 2 to 5, even though art. 13(1) puts the Law itself in force on 1 September 2026. Two further timing points sit on the face of the Law. The conformity-confirmation procedure required by art. 6(2)(5) and art. 6(3)(5) and the status-assignment procedure required by art. 6(5) are both left to Government acts that had not been made as at 21 August 2026, so the gateway to art. 8 is not yet operable. And art. 13(3) grandfathers information systems in which large foundational models were created or operated on the day art. 5(2)(3) commences: until 1 September 2032 the cases where only sovereign or national models may be applied do not extend to them, provided the data are processed and stored in Russia. Adopted 8 July 2026, approved by the Federation Council 17 July 2026, published 26 July 2026 as 0001202607260003, Собрание законодательства РФ 2026 No. 30 item 4089, «Российская газета» of 31 July 2026.
Stated maximum penalty — None is stated in the Law. Art. 11 refers to «законодательство Российской Федерации» without more, and the Code of Administrative Offences carried no article on large foundational AI models as at 21 August 2026. The practical sanction visible on the face of the Law is administrative rather than pecuniary: sovereign and national status is assigned and recorded by the Government under art. 6(5), so the loss of that status, and with it the art. 7 support measures, the art. 5(2)(5) access to state data sets for training and the art. 10(2) training exception, is what a failure of the art. 8 duties puts at risk.