By the editorial team airassvet.ru. This analysis was prepared on September 29, 2026, based on the text of Federal Law No. 243-FZ dated July 26, 2026, published on the official legal information portal and in ConsultantPlus. This material is for informational purposes only and is not legal advice: for decisions about your company, consult a lawyer. The editors have no commercial relationship with the publications and services mentioned, and there are no affiliate links in the text.
Short answer. AI Law 243-FZ, “On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation,” has been in force since September 1, 2026, but it does not regulate every type of AI—only large foundational models starting at 1 billion parameters. For a company that simply uses neural networks, there are currently no direct new obligations, and the law does not introduce a duty to label AI-written texts. The main changes will begin on March 1, 2027: notices about rights to generated results, the ability to label audio and video, the status of sovereign and national models, and a list of cases where only those models are allowed.
Below is a section-by-section breakdown: what took effect, what was postponed, which companies the law applies to depending on their role, and what action plan makes sense to start now.
Contents
- What the AI Law 243-FZ is
- What took effect and what was postponed
- Who the law affects: three company roles
- AI content labeling: what the law actually requires
- Sovereign and national models
- Transition period through 2032 and where data is processed
- Rights to generated outputs
- Are there fines
- What a company should do before March 1, 2027
- How we prepared this analysis and its limitations
- Frequently asked questions
What the AI Law 243-FZ is
Federal Law No. 243-FZ of July 26, 2026 is Russia’s first framework law on artificial intelligence. Under Article 1 it regulates “relations in the field of development, deployment, and use of large foundational artificial intelligence models.” This is the key qualifier: the law is not written for any algorithm, but for large general-purpose models.
Article 3 provides two definitions that determine everything else:
- Artificial intelligence — a set of technological solutions that makes it possible to imitate human cognitive functions and obtain results comparable to or better than human intellectual activity. The set includes infrastructure, software, processes, and data-processing services.
- Large foundational AI model — a program that performs intellectual tasks at a level comparable to a human, is trained on datasets, serves as a basis for creating and refining other software, contains at least 1 billion parameters and is used for a wide range of different tasks.
The law applies to a large foundational AI model—a general-purpose model with 1 billion or more parameters that is used to build other products. A narrow model that, for example, only recognizes license plates or forecasts demand does not, by the literal wording, fall under this definition. Popular chat models used today to build assistants and AI agents generally do fall under it.
The goals of the law (Article 2) are the accelerated adoption of such models in the economy, state support for developers, technological independence, and security. So in spirit, this is a support law, not a prohibition law: most of the text is devoted to government powers and support measures for Russian developers.
What took effect and what was postponed
The most common mistake in articles about the law is assuming everything began working on September 1. Article 13 separates the timelines:
| Deadline | What starts to apply | Provision |
|---|---|---|
| September 1, 2026 | General provisions: subject matter, goals, definitions, principles, powers of authorities, support measures for developers, liability | Articles 1–4, most of Article 5, Part 1 of Article 6, Articles 7, 11, 12 |
| March 1, 2027 | Cases where only sovereign and national models are allowed; requirements for preventing risks in certain industries; access to government data for training | Clause 3–5 of Part 2 of Article 5 |
| March 1, 2027 | Criteria for sovereign and national models, procedure for granting status | Parts 2–5 of Article 6 |
| March 1, 2027 | Obligations of developers of sovereign and national models | Article 8 |
| March 1, 2027 | Option to label audio and visual materials | Article 9 |
| March 1, 2027 | Notices to users about rights to generated outputs | Article 10 |
| until September 1, 2032 | Transition period for systems already in operation, provided data is processed and stored in Russia | Part 3 of Article 13 |
Separately, the law allows special regulation of Articles 3 and 6 within experimental legal regimes under Law No. 258-FZ (Part 4 of Article 13). That means that for certain pilots, the definitions and model criteria may apply differently.
Who the law affects: three company roles
The law does not divide businesses by size. It is more practical to look at the role a company plays in relation to the model. Below is an editorial classification based on the text of the law, not an official one.
A company that uses AI
Employees work in a chat assistant, marketing generates images, and sales uses a ready-made service. There are no direct obligations in the law for this role. Starting March 1, 2027, such a company will receive notices about rights to generated outputs (Article 10) and will have the option, but not the obligation, to add an AI label to audio and video (Article 9).
A company that gives customers access to a model
For example, you operate a chatbot or AI agent on your website or in a messenger app, and customers receive texts, images, or answers from it directly. Article 10 is addressed to “persons providing the ability to use large foundational models.” Whether a company that embedded someone else’s model into its own service will be treated this way is not stated explicitly in the law—but this is the role for which you should review the user agreement in advance. More on that below, in the section on rights to outputs.
A company that fine-tunes or modifies a model
Under Article 3, a developer means an individual entrepreneur or legal entity that carries out development, “including design and training, or modification” of a large foundational model. Literally, this definition is broader than creating a model from scratch. At the same time, the specific obligations (Article 8: security measures, operating rules, technical documentation) are imposed by the law (Article 8) only on developers of sovereign and national models—that is, on those who claim that status. How regulators will interpret fine-tuning an open model will become clearer after government decrees are issued.
AI content labeling: what the law actually requires
The AI law does not require businesses to label texts created by a neural network. Article 9 applies only to audio and/or visual materials and takes effect on March 1, 2027. Here’s what it says:
- Anyone who creates audio or visual material using a large model is “given the opportunity” to add an informational notice about the use of AI. This is a right, not an obligation.
- The format, content, and procedure for such a notice are determined by the agreement between the user and the party providing access to the model.
- Platforms where users maintain personal pages, where advertising may be distributed, and which are visited by more than 500,000 users from Russia per day, must give authors a technical way to add such a label.
The practical takeaway is this: under Article 9, the obligation falls primarily on large platforms and generation services, not on the company publishing a video on its own channel. If you create advertising with a synthesized voice or video, the AI law itself does not require a label, but check other rules as well — advertising and consumer protection laws still apply independently of Federal Law No. 243-FZ.
Sovereign and National Models
Starting March 1, 2027, the law introduces two statuses for large models (Art. 6). The general requirements for both are:
- the developer is a Russian legal entity, meaning a company in which more than 50% of the voting rights are directly or indirectly controlled by the Russian Federation, its constituent entities, municipalities, or Russian citizens with no other citizenship;
- responses to user requests are prepared, and data are stored, in data centers located in Russia and owned by Russian legal entities;
- the model has undergone confirmation of compliance with legislation and traditional Russian spiritual and moral values under a procedure to be established by the government.
Difference between the statuses:
| Criterion | Sovereign model | National model |
|---|---|---|
| Who defines the characteristics | Russian developer at all stages of the lifecycle | Russian developer defines the material characteristics, the list of which is set by the government |
| Reproducibility | Full technical and technological reproducibility of the development cycle, including training | Not required in this form |
| Third-party components | There is no separate rule in the law; full reproducibility of development by a Russian developer is required | Permitted, including third-party models, if they are distributed under an open license |
A national model is an option for companies that adapt open models: third-party components are allowed if they are under an open license, and processing and storage of data take place in Russian data centers. The procedure for accounting and assigning statuses will be established by the government (Part 5 of Art. 6).
Why does this matter for a business that does not develop models? Because starting March 1, 2027, the government will define the cases in which only only sovereign or national models may be used (clause 3, part 2 of Art. 5), and in the banking sector and financial market — in coordination with the Central Bank. As of September 29, 2026, no list of those cases exists. If your company works with government contracts, finance, or critical infrastructure, this is the list to watch first.
Transition period through 2032 and where data is processed
For systems that are already operating, the law provides a grace period (Part 3 of Art. 13). The restriction that applies only to sovereign or national models until September 1, 2032, does not apply to information systems where large models were created or operated on the date the relevant rule took effect, that is, on March 1, 2027. But with one condition: data must be processed and stored in Russia.
That condition is the most practical takeaway from the law right now. If your AI assistant or agent sends requests to a foreign cloud service, the grace period may not apply once the government approves the list of cases. So it is worth knowing now where model requests are physically processed in each of your workflows. For more on cross-border data transfer to AI services, see our breakdown of Federal Law 152-FZ and foreign neural networks, and for choosing between cloud and your own server, see the article cloud or on-premise LLM.
Rights to Generated Outputs
Article 10 takes effect on March 1, 2027 and consists of two parts.
Part 1 requires those who provide access to large models to notify the user:
- who owns the rights to the intellectual property results obtained with the model;
- under what conditions the user gets access to those results, may use them, and store them, if technically possible.
For a business user, this means that by spring 2027 AI services will most likely update their offers and terms of use. It is worth reading them: the wording determines whether you can freely use generated text, images, and code for commercial purposes. For a company that itself gives clients access to a model through a bot or app, this is a reason to prepare its own notice text in advance with a lawyer.
Part 2 concerns training. Extraction, comparison, classification, and analysis of patterns in works, as well as temporary recording in computer memory, are not considered copyright infringement if they are done exclusively for training a sovereign and/or national model and the developer uses a lawfully obtained copy or material that is available without technical restrictions. By its plain language, this exception does not apply to training any other models.
Are there fines?
The law does not introduce new fines. Article 11 is cross-referential: for violations of the law and the acts adopted under it, participants in the relationship bear liability “in accordance with the legislation of the Russian Federation.” In other words, liability arises under existing rules — on personal data, advertising, copyright, and others. For a company, this means the main risks of using AI today lie not in Federal Law No. 243-FZ, but in those rules. An overview of those risks is in the article AI risks for business in Russia.
What a company should do before March 1, 2027
The law does not require urgent action from most companies, but a few steps are worth taking in advance: they are cheaper now than after the government issues its decrees.
- Create an AI usage inventory. Which services and models are used, in which processes, what data is sent there, and who owns the process.
- Identify the large models. For each service, determine whether it runs on a large general-purpose model. Narrow ML models for accounting and forecasting are likely outside the scope of the law.
- Find out where requests are processed. Russia or a foreign data center — this affects the transition period through 2032 and risks under Federal Law 152-FZ.
- Define your role. User, company that gives clients access to the model, or company that fine-tunes the model — the relevant articles 8–10 depend on the role.
- Review contracts with AI vendors. Rights to outputs, storage, access, termination terms. In spring 2027, these terms will likely change.
- Assess industry risk. Government contracts, finance, and critical infrastructure are the first candidates for the “only sovereign and national models” list. For them, it is useful to have a model replacement plan: see AI service exit plan.
- Decide how audio and video will be labeled. The law does not require labeling, but a single internal policy will answer questions from customers and platforms.
- Assign a person responsible for monitoring. Government decrees under Articles 5 and 6 will determine which obligations become real. They need to be tracked through March 2027.
If your company also works with European clients, take into account the separate requirements of European regulation — we covered them in the article on the EU AI Act and Article 50.
How we prepared this analysis and its limitations
The analysis is based on the official text of the law in the version dated 07/26/2026: we read Articles 1–13 in ConsultantPlus on September 29, 2026, and cross-checked the publication on pravo.gov.ru. The effective dates were taken from Article 13 and ConsultantPlus notes to Articles 5, 6, and 10. The classification of companies by role is editorial; it is not set out in the law.
Limitations of the analysis:
- government decrees under Articles 5 and 6 had not been published as of the preparation date — the list of industries, the procedure for assigning statuses, and the risk requirements are unknown;
- there is still no court or enforcement practice under the law;
- we did not assess sector-specific requirements, for example from the Central Bank, which may be introduced separately.
Frequently asked questions
When does AI Law 243-FZ take effect?
The main part of the law took effect on September 1, 2026. Provisions on sovereign and national models, the obligations of their developers, labeling of audio and video, and notices about rights to generated outputs take effect on March 1, 2027. The transition period for systems already in operation runs through September 1, 2032.
Do texts written by neural networks need to be labeled?
No. The AI law does not introduce an obligation to label texts. Article 9 applies only to audio and visual materials and gives the option, not the duty, to place a notice about the use of AI. The obligation to provide this option rests with large platforms with an audience of more than 500,000 users per day.
Does the AI law apply to small businesses that use neural networks?
The law does not introduce direct new obligations for companies that only use AI services. Indirectly, it will affect them through changes to the services’ user agreements starting March 1, 2027, and through the list of cases where only sovereign or national models may be used.
What is a sovereign AI model?
It is a large foundational model developed by a Russian legal entity throughout all stages of the lifecycle, with full reproducibility of the development cycle, with query processing and data storage in Russian data centers, and with confirmed compliance with legislation. A national model differs in that it allows third-party components under an open license.
Can you keep using foreign neural networks?
The AI law itself does not ban foreign models. Restrictions will appear only in cases that the government determines starting March 1, 2027. For systems already in operation in those cases, a deferral applies until September 1, 2032, if the data is processed and stored in Russia. Separately, the requirements of Federal Law No. 152-FZ on the transfer of personal data continue to apply.
Are there fines for violating the AI law?
There are no standalone fines in the law. Article 11 refers to existing legislation: liability arises under already existing rules, for example on personal data, advertising, or copyright.
How the airassvet.ru team helps prepare AI processes for Law 243-FZ
If the checklist above shows that you do not know which models are used in your processes and where the data is processed, the airassvet.ru team can: airassvet.ru can:
- audit processes where AI is already used: compile a register of services and models, a data flow map, and identify processes that depend on foreign processing;
- deploy a large language model on the company’s servers (on-premise) so that queries and data remain within your own environment;
- reconfigure the integration of AI agents and assistants with your systems so the model can be replaced without rebuilding the entire process, and test the system after the swap.
These steps do not replace a legal assessment of the law — that is provided by a lawyer. The first step is to choose one AI process, document how it works now, what data and services it uses, what limitations exist, and what criteria will be used to judge whether the changes are successful. If you have such a process, discuss the project.
Conclusion
AI Law 243-FZ is a framework law supporting large foundational models, not a law of bans. Starting September 1, 2026, nothing mandatory changed for an ordinary company that uses neural networks, and there is no obligation to label texts at all. Real changes will come on March 1, 2027: notices about rights to generated outputs, sovereign and national model statuses, and the list of cases where only those models are allowed. The most useful thing you can do now is create an inventory of AI use, determine where data is processed, and define the company’s role. Then government decrees will not catch you off guard.