The law regulates only large foundation models with at least one billion parameters. Credit scoring, anti-fraud, computer vision, predictive maintenance and classic machine learning remain outside its scope.
The two statuses are clearly distinguished. A sovereign model requires a Russian legal entity to carry out development at all stages of the life cycle, full reproducibility of training, and inference and data storage in Russian data centres owned by Russian legal entities. A national model allows third-party components, including foreign base models, provided they have an open licence and a Russian legal entity controls the system’s essential characteristics. The “Russian interface on top of a proprietary foreign API” scheme does not qualify for either status: the licence is closed and inference runs outside Russia.
The law contains no direct ban on foreign models. The government gets the right to set cases in which sovereign or national models must be used; this provision takes effect on 1 March 2027. For the banking sector and the financial market, such cases are set only in agreement with the Bank of Russia. The financial sector is the only industry explicitly named in the text of the law.
Systems put into commercial operation before 1 March 2027, provided data is stored and processed in Russia, receive a deferral until 1 September 2032. This window closes in a year and a half.
Obligations arise only for holders of sovereign or national model status: security measures, operating rules, and technical documentation with key parameters and limitations. The adopted version contains no register of trusted models and no mandatory audit: these provisions were removed during revision. The law does not resolve the question of liability: the article is reduced to a reference provision without distinguishing between developer, operator and user.
The criteria for the statuses are narrow. According to market participants, Sber’s solution qualifies as a sovereign model and Yandex’s as a national one. The status holder gets the right to train the model on copyrighted content and access to data from state information systems.
For startups with an international ownership structure or a founder with two passports, obtaining the status is blocked: the law requires more than half of the votes to be controlled by the state, a municipality or a Russian citizen without a second citizenship. Large businesses have a budget for migration and infrastructure, and overheads are spread over large volumes of operations.
Moving from foreign LLM services to Russian or in-house models will require rebuilding integrations, reworking prompts and agent scenarios, and internal staff training. Replacing an API takes a few weeks, while adapting accumulated experience takes much longer. Russian services lag behind familiar solutions in the maturity of agent scenarios, model versioning and quality monitoring.
Two parallel tracks help reduce risks: a Russian cloud service and local deployment of an open model in your own environment. The second option ensures predictable model call costs and meets the criteria for a national model if the components have an open licence and are hosted in a Russian data centre. It requires powerful hardware, expertise and ongoing support.
A practical course of action: inventory your AI solutions and identify systems with a billion or more parameters, check the physical location of inference and the ownership of the data centre, audit component licences and analyse the ownership structure of the legal entity. For the financial sector: monitor Bank of Russia acts; recommendations 3-MR of 16 June already describe the threat model, protection of training data against poisoning, drift control and human validation of results in critical processes. In supervisory practice, such recommendations quickly become a mandatory subject of inspection.
Related news:
- Customs moves to AI: Rosatom will rebuild the entire customs IT system by 2028 — how AI is changing customs administration
- AI, marketplaces and direct contracts: how Shenzhen came to negotiate with Russian retail — Shenzhen’s experience in digital trade
- Laws for business from October 2026: marketplaces, VAT and customs — which business laws took effect this autumn
- Product cards on marketplaces: new requirements from 1 October 2026 — new requirements for product listings
