Critical Infrastructure Facilities Face the Risk of Temporary Administration

26 August 2026

Ivan Tarasenko

Legal Trainee

On 24 August 2026, Decree of the President of the Russian Federation No. 604 “On Measures to Ensure the Security of Critical Infrastructure Facilities of the Russian Federation” (the Decree) was published and entered into force. The Decree empowers the Government of the Russian Federation, acting upon an instruction of the President, to introduce temporary administration over business entities connected with critical infrastructure facilities.

Concept of a critical infrastructure facility

The Decree defines critical infrastructure facilities as:

facilities of the fuel and energy complex
industrial facilities
communications facilities
utility, transport and logistics infrastructure facilities (including transport and logistics hubs)
power generation facilities (including nuclear power facilities)
life-support facilities
critically important and potentially hazardous facilities
other facilities of particular importance for ensuring the security and economic stability of the Russian Federation and the daily life of the population

The definition set out in the Decree is broad and non-exhaustive. As a result, the risk zone may extend to infrastructure facilities of companies operating in the pharmaceutical sector, the food industry, the agricultural sector and other industries identified as priority areas for the implementation of the country’s technological sovereignty projects.

It should be noted that the facilities falling within the scope of the Decree are not identical to the already familiar concept of critical information infrastructure (CII) facilities within the meaning of Federal Law No. 187-FZ of 26 July 2017 “On the Security of the Critical Information Infrastructure of the Russian Federation”.

Who qualifies as a business entity?

For the purposes of the Decree, business entities are:

commercial and non-commercial organisations, individual entrepreneurs and self-employed individuals
persons controlling Russian legal entities, as defined in sub-clause 24 of clause 1 of Article 2 of Federal Law No. 39-FZ of 22 April 1996 “On the Securities Market”, which are state (interstate) institutions of foreign states, state associations and (or) unions, foreign organisations, foreign nationals or stateless persons

Accordingly, the Decree covers an extremely wide range of entities, and its application is not conditional on any connection with “unfriendly” jurisdictions.

Both Russian and foreign persons (including persons from “friendly” states) may potentially face the introduction of temporary administration.

Grounds for introducing temporary administration

The Decree lists the following grounds for introducing temporary administration:

failure by a business entity to take, or untimely taking of, measures to ensure the security of critical infrastructure facilities
breach of the requirements for ensuring the security of critical infrastructure facilities
creation by a business entity of a threat to the security or normal operation of facilities (including where measures aimed directly at countering the threat of attacks involving unmanned aerial vehicles (UAVs) are found to be ineffective)
failure to restore, or untimely restoration of, the operation of critical infrastructure facilities

A literal reading of these grounds suggests that they relate primarily to risks in the area of the physical security of such facilities. In our view, these risks may arise from:

mistakes in management policy and (or) failure to adopt, or untimely adoption of, corporate decisions
insufficient funding of measures to secure and (or) restore facilities
the absence of the physical protection equipment required for the facilities, as well as harm (or the risk of harm) to human life and health

We would also note that a failure to ensure the information security of CII facilities may, in our view, likewise give rise to risks in the area of the physical security of facilities (for example, leaks of sensitive information or compromise of facility security systems).

Since the Decree does not specify the criteria under which protective measures are deemed ineffective, nor the deadlines for taking measures by which the operation of a facility must be restored, we assess the degree of administrative discretion in applying the Decree as high.

Companies operating in sensitive areas are advised to develop and implement, on a pre-emptive basis, a set of internal policies setting out:

the key infrastructure facilities and the risk factors relating to their security;
the list of measures aimed at ensuring the security of the facilities;
the responsible officers and units, with a clear allocation of responsibility and competences;
the incident response procedure aimed at minimising adverse consequences;
a system for monitoring and assessing the effectiveness of the measures in place and for improving processes.

Temporary administration

Where at least one of the above grounds is present, temporary administration may be introduced in respect of a critical infrastructure facility by decision of the Government of the Russian Federation adopted on the basis of an instruction of the President.

Temporary administration may be established in respect of:

all or part of the movable and immovable property of a business entity located in the territory of the Russian Federation
securities and participatory interests in the charter capital of Russian legal entities held by a business entity
property rights held by a business entity

As a general rule, the temporary administrator is Rosimushchestvo (the Federal Agency for State Property Management), which exercises:

the powers of the owner of the movable and immovable property, securities, participatory interests in the charter capital of a Russian legal entity and property rights placed under temporary administration, save for the power of disposal;
the functions of taking inventory of the property placed under temporary administration and of ensuring its safekeeping.

The Decree does not limit the duration of temporary administration. It is terminated by decision of the Government of the Russian Federation on the basis of an instruction of the President.

Practical implications

The regime introduced by the Decree may create a material risk for business entities of losing effective control over their business or fixed assets.

The Government of the Russian Federation has stated that temporary administration will be an extraordinary measure applied to enterprises that fail to respond to existing security threats and do not cooperate in resolving issues in this area.

However, given the uncertainty surrounding the criteria for the ineffectiveness of measures protecting critical facilities and the absence of any real possibility of fully eliminating hazardous factors, the risks of temporary administration being introduced cannot be eliminated entirely, and business entities are advised to develop an appropriate set of measures proactively.

To mitigate these risks, we recommend that companies: