Active public discussions continue regarding the draft law “On the Foundations of State Regulation of Artificial Intelligence Technology Applications in the Russian Federation”, drafted by the Ministry of Digital Development of the Russian Federation. The document covers the development, implementation and use of artificial intelligence (hereinafter – “AI”), and establishes obligations for service owners, developers and users. Below is an overview of the key changes that will affect businesses.
The draft law defines the main roles when working with AI models, which include:
- developer – an individual or legal entity engaged in research, design, development, training, testing or modification of an AI model;
- operator – a citizen or legal entity operating an AI system, including processing information contained in its databases;
- owner – a person holding the corresponding rights to an AI service, including exclusive or other rights;
- user – a person using an AI service.
It should be noted that the text of the draft law explicitly identifies developers as individuals and legal entities, operators as citizens and legal entities, while no such categories are specified for owners and users. However, it appears reasonable to extend the concepts of individuals and legal entities to all four roles.
In the field of advertising and consumer interaction, the draft law proposes the following innovations:
- Mandatory labelling of AI-generated content (audio, video, images generated by AI) used in advertising. AI service owners must place a warning in both machine-readable and human-readable formats;
- Obligation to inform consumers about the use of AI when selling goods/providing services without human involvement. If AI makes autonomous decisions affecting a citizen’s rights, a corresponding notice must be given to such a citizen. In cases established by the Government, a citizen has the right to refuse AI and receive the service in a “human” format;
- Obligations for owners of large AI services – if the daily audience of users from the Russian Federation exceeds 100 000 viewers, the owner must check whether synthetic content has a label; if the label is missing, the owner must either add the label or delete the content. If the daily audience from the Russian Federation exceeds 500 000 viewers, such owner is additionally subject to the requirements imposed on organizers of information dissemination.
Certain changes will affect CII entities (critical information infrastructure):
- For state information systems and critical information infrastructure (CII) facilities, only models included in the register of trusted AI models are permitted. The procedure for maintaining such a register is established by the Government of the Russian Federation;
- The Government may establish cases where the use of sovereign/national large foundational models is mandatory – this creates a closed market for government projects;
- CII entities must appoint persons responsible for the safe operation of AI, maintain an incident log, and immediately disconnect systems when there is a threat of causing harm;
- CII entities are required to carry out all stages of development, training and operation exclusively on the territory of the Russian Federation, using Russian citizens and legal entities under the control of the Russian Federation. The Government has the authority to establish cases where the use of such models is mandatory.
In the context of intellectual property rights, the draft law also proposes to establish the following provisions:
- Legalization of data extraction from protected works for AI training does not constitute a copyright infringement if the developer had a lawful copy of the work or the work was made publicly available;
- Objects created with the help of AI are recognized as protectable if they meet the originality criteria under the Civil Code of the Russian Federation, regardless of whether they were created by a human or an automated system. This is an important clarification for businesses monetizing AI-generated content;
- Extraction of data from works for AI training is expressly permitted if the developer has a lawfully obtained copy or the work was made publicly available. This reduces the risk of claims by copyright owners when creating datasets;
- Obligation for developers to provide service owners with free access to intellectual property results obtained using their models, and to guarantee the absence of third-party rights infringements;
- Obligation for AI service owners to specify the terms regarding notification, access, downloading and transfer of rights to intellectual property results created with the help of AI, in their user agreements.
The law is expected to enter into force on September the 1st, 2027. However, business entities should already consider implementing mechanisms for labelling AI-generated content and notifying consumers about the use of AI (especially for autonomous decisions), as well as preparing alternative “human” service channels in case a citizen refuses the use of AI technologies in circumstances prescribed by the Government of the Russian Federation. Companies working with the public sector or CII must analyze their AI models, if any, with respect to cross‑border data transfers to foreign states, in order to identify infrastructure that may need to be replaced due to potential obligations to use domestic software.