FSTEC of Russia Order No. 117 establishes mandatory information protection requirements for government information systems, including separate rules for the use of artificial intelligence. These requirements apply from March 1, 2026, to state and municipal information systems, systems used by government authorities, state unitary enterprises, and public institutions. The key AI rule: restricted-access information may not be transferred to the model developer, and neural network prompts and outputs must be limited by templates or approved topics and checked for accuracy.
Prepared by AIrassvet October 23, 2026 for IT directors, information security specialists in government organizations, and contractors implementing AI in public-sector systems. The answers are based on Order No. 117 as amended by FSTEC Order No. 137 of May 8, 2026, effective September 1, 2026, and on the National Strategy for the Development of Artificial Intelligence. This is not legal advice: consult information security specialists and the certification organization before applying these requirements to a specific system.
Contents
- Brief overview
- What’s covered and not covered in this article
- Scope questions
- Questions about AI requirements
- Questions about the project and the contractor
- AI requirements in Order No. 117: summary table
- Primary sources and verification method
Brief overview
- Who it applies to: state and municipal information systems, systems used by government authorities, state unitary enterprises, and public institutions. Commercial companies are affected if they receive restricted-access information from a government information system or work as a contractor to the operator.
- Main prohibition: restricted-access information may not be transferred to the person who developed the AI model, including “for model improvement” (paragraph 60).
- Dialogue control: prompts and responses must be limited by templates or a list of approved topics, and statistical criteria and response procedures must be established for inaccurate answers (paragraph 61).
- The system may include only trusted AI technologies or their components.
- Starting March 1, 2027, the contractor independently assesses the information security maturity level before gaining access to the operator’s systems.
- Amendments are pending: the FSTEC draft on a separate segment for AI systems and protection against AI agents has not yet taken effect.
What’s covered and not covered in this article
We analyze the provisions of Order No. 117 on scope, artificial intelligence (subparagraph “t” of paragraph 34, paragraphs 49, 60, and 61), and contractors. We do not cover the full list of baseline security measures, certification of security tools, cryptography, or requirements for significant critical information infrastructure facilities — we wrote about AI equipment at CII facilities in the analysis of the foreign GPU initiative.
Terms. *GIS* — government information system. *Operator (information holder)* — the organization that operates the system and is responsible for its protection. *Restricted-access information* — information access to which is restricted by law: official-use information, personal data, and others. *Data set, AI model, model parameters* — terms from the National Strategy for the Development of AI. *Kzi and Uzi* — indicators of protection and information security maturity levels.
Scope questions
What is FSTEC Order No. 117, and when did it take effect?
These are FSTEC of Russia’s requirements for information protection in state information systems and other systems used by government authorities, state unitary enterprises, and public institutions. The order was signed on April 11, 2025, registered by the Ministry of Justice on June 16, 2025 under No. 82619, and took effect on March 1, 2026. It replaced Order No. 17 of 2013, and certificates issued before March 1, 2026 remain valid.
What did FSTEC Order No. 137 change?
Order No. 137 of May 8, 2026 clarified the requirements, but did not change the artificial intelligence provisions. Most of the amendments took effect on September 1, 2026: for example, the maturity level indicator is now designated as Uzi, and enhanced multi-factor authentication is allowed alongside strict authentication. The new version of paragraph 32, which defines who assesses protection maturity and how often, will take effect on March 1, 2027.
Does the order apply to commercial companies?
Not directly, but it can apply indirectly. The requirements apply to GIS, systems used by government authorities, state unitary enterprises, and public institutions, as well as municipal systems unless otherwise established by law (paragraphs 1 and 3). They matter to a commercial company in two cases: its system receives restricted-access information from a GIS (paragraph 2), or it works as a contractor to the operator and gains access to its systems (paragraph 16).
How is Order No. 117 related to Federal Law No. 152-FZ and CII requirements?
It applies together with them, not instead of them. If a system processes personal data, the requirements of Government Decree No. 1119 and Order No. 117 both apply (paragraph 5). If the system is a significant critical information infrastructure facility, protection is ensured under acts adopted pursuant to 187-FZ and under these requirements (paragraph 6). For cryptographic tools, FSB of Russia requirements also apply.
Questions about AI requirements
What does Order No. 117 say about artificial intelligence?
AI is mentioned in three places. Subparagraph “t” of paragraph 34 makes information protection when using AI a separate mandatory measure for the operator. Paragraph 49 allows the use of trusted AI technologies to analyze security events during monitoring. Paragraphs 60 and 61 set out the actual requirements: what must be protected, how prompts and responses must be limited, how to respond to inaccurate answers, and which AI technologies may be included in the system.
What must be protected in an AI system under paragraph 60?
Four items: data sets, AI models, their parameters, and data processing and decision-making processes and services. Protection must prevent unauthorized access to and interference with the system through these elements, unauthorized disclosure and modification of information, and use of the system for unintended purposes. The terms come from the National Strategy for the Development of AI: model parameters are the numerical values that determine how it works; for a neural network, these are primarily the weights.
Can data from a GIS be sent to a cloud-based neural network?
Restricted-access information cannot be sent if it reaches the model developer. Paragraph 60 expressly prohibits transferring such information to the person who developed the AI model, including for the purpose of improving its performance. This means that a cloud API provided by the model developer is suitable only for publicly available data. For official-use information, personal data, and other restricted-access information, you need a model deployed within the operator’s protected environment.
Can an open-source model be used on your own servers?
Yes: the order does not name approved or prohibited models. A model hosted on the operator’s servers removes the issue of data transfer to the developer, but the other requirements remain: protection of weights and data, control of prompts and responses, and monitoring. The last paragraph of paragraph 61 requires trusted AI technologies or their components to be included in the system. Separately check the model license — our FAQ on open LLM licenses.
What are trusted AI technologies?
This term comes from subparagraph “c” of paragraph 5 of the National AI Development Strategy, as amended by Decree No. 124 of February 15, 2024. It refers to technologies that meet safety standards, are designed in line with the principles of fairness, non-discrimination, and ethics, and do not cause harm to people, society, or the state. The order does not set out a procedure for confirming this status, so the criteria should be agreed in advance with the certifying organization.
What do “prompt and response templates” mean in paragraph 61?
This is a mode in which the user does not enter arbitrary text into the neural network but fills out a predefined form, and the answer is returned in a set format as well. The operator must define such templates and monitor both prompts and responses for compliance with them (subparagraph “a”). For example, classifying a citizen’s request into one of a fixed list of categories or extracting document details into specified fields.
How do you meet the requirement for allowed topics in an open chat?
You need to list in advance the topics the assistant is allowed to answer on and check every prompt and every response against that list and the established formats (subparagraph “b”). In practice, this is done with a separate classifier or with rules at the model input and output: a prompt outside the scope is rejected, and an out-of-format response is not shown. We explained how such filters work in the article about LLM firewall.
What are statistical criteria for inaccurate answers?
These are predefined measurable indicators that the system uses to flag suspicious answers so they can be collected and analyzed (subparagraph “c”). The order does not provide ready-made criteria. For example, you could measure the share of answers without a source citation from the knowledge base, discrepancies with reference answers on a validation set, or the share of answers users marked as incorrect. Methods for this kind of evaluation are described in the article about RAG accuracy.
How should AI inaccurate answers be handled?
Limit what the system decides or does based on such answers (subparagraph “d”). For example, an answer that has not passed the criteria check is not automatically sent to the accounting system; instead, it is routed to an employee, and in some functions AI is used only as a recommendation. Such restrictions should be described in the internal information security policy together with trigger thresholds and responsible parties.
What does it mean to “eliminate unregulated AI influence on model parameters”?
The model must not change its parameters or the system’s behavior outside the established procedure. If the assistant is fine-tuned on user conversations or an agent can change its own settings, those changes must follow the approved process: with a responsible person’s decision, review, and version tracking. The simplest approach is to use an immutable model version and update it like ordinary software, with testing before deployment.
Can AI be used for information security monitoring?
Yes. Paragraph 49 expressly allows trusted AI technologies to analyze recorded security events and identify signs that current threats are being realized. The monitoring itself is carried out under sections 4 and 5 of GOST R 59547-2021, and the report on its results is prepared by the information security unit. Here, AI is an analysis tool for logs, not a replacement for responsible specialists.
Questions about the project and the contractor
Will the AI requirements in Order No. 117 change?
Most likely, yes: FSTEC is preparing amendments. According to ppt.ru, in August 2026 a draft of the changes was published on regulation.gov.ru, with planned entry into force on March 1, 2027. It proposes a separate segment for AI systems with multi-factor authentication, filtering of incoming prompts and outgoing data, quotas on the volume of input data, and protection against influence from AI agents. In the current version as of October 23, 2026, these rules are not in place.
Is a threat model needed for an AI system?
Current threats must always be identified, and a threat model is required in cases established by Government Resolution No. 676 for state information systems (paragraph 36). For non-government systems, the operator’s head decides whether a threat model is needed. Negative consequences are determined by the FSTEC threat database (paragraph 11). For an AI system, the list should include threats to the data sets, models, and services listed in paragraph 60.
What will change for contractors starting March 1, 2027?
The maturity level indicator will be assessed by the contractor itself — before gaining access to the operator’s systems or information and thereafter at least once every two years. That is how paragraph 32 is worded in Order No. 137. Even now, paragraph 16 requires contractors to know the information security policy and have their duties set out in the documents under which they are granted access.
What should be included in the technical requirements and contract for an AI project for a government customer?
The requirements from paragraphs 60 and 61 should be turned into verifiable acceptance criteria. The minimum set includes: where the model is hosted and that data is not transferred to its developer; operating mode — templates or allowed topics; criteria for inaccurate answers and the response procedure; prohibition on uncontrolled model changes; logging; and the contractor’s obligations under the information security policy. The remaining items are collected in the AI implementation contract checklist.
AI requirements in Order No. 117: summary table
The table is based on the text of the order as amended on May 8, 2026, verified on October 23, 2026. The “How to implement” column contains our examples, not the wording of the order.
| Paragraph | Requirement | How to implement in practice |
|---|---|---|
| 34 “t” | Information security when using AI is a mandatory measure | Include AI components in information security documents |
| 49 | Trusted AI may be used to analyze security events | Use it as a log analysis tool; specialists prepare the report |
| 60 | Protect datasets, models, parameters, processes, and services | Restrict access to weights and data, and keep a change log |
| 60 | Do not transfer restricted-access information to the model developer | Host the model within the operator’s environment or work only with open data |
| 61 “a” | Prompt and response templates and compliance control | Input forms and response structure validation |
| 61 “b” | Allowed topics and formats for open dialogue | Topic classifier at the model input and output |
| 61 “c” | Statistical criteria for inaccurate answers | Metrics on a validation set and collection of flagged answers |
| 61 “d” | Response to inaccurate answers | Limit automatic actions and route the answer to an employee |
| 61 | Eliminate unregulated AI influence on the model and system | Immutable model version, updated under the approved procedure |
| 61 | Only trusted AI technologies may be used as part of the system | Agree on the criteria with the certifying organization |
Source documents and verification method
We downloaded the document texts on October 23, 2026, and cross-checked every answer against the primary source:
- FSTEC Order No. 117, current version dated May 8, 2026 — Kontur.Normative.
- FSTEC Order No. 137 of May 8, 2026, introducing amendments — Kontur.Normative.
- FSTEC Order No. 117, original version — GARANT.
- Draft amendments to Order No. 117 on AI on regulation.gov.ru and summary of the draft on ppt.ru — the project text on the portal loads via script, so we are providing its content as published on ppt.ru.
- Presidential Decree No. 490 on AI Development — the official website of the President of Russia, and Decree No. 124 dated February 15, 2024, with new definitions.
The FSTEC of Russia website was inaccessible from our location on October 23, 2026, so the text of the order was verified against two legal databases. Limitations: we did not review FSTEC methodological documents for calculating Kzi and Uzi, and we did not assess specific systems — that requires information security specialists and an attestation organization.
How AIrassvet helps implement AI in a secure environment
It is easier to build the requirements of Order No. 117 into the architecture before development begins than to add them afterward. On the AIrassvet website the following directions are listed to address this task:
- implementing LLMs with deployment on the customer's own servers so that restricted-access information does not go to the model developer;
- RAG systems based on the organization's knowledge base, where answers rely on verifiable documents within the secure perimeter;
- process audit, testing, and rollout: a control set of questions for criteria related to inaccurate answers and verification of topic-based restrictions before production launch.
The first step is to choose one process where AI is needed and document the current result, data sources, processing restrictions, and acceptance criteria.
Bottom line: AI in government systems starts with the secure environment and dialogue rules
Order No. 117 does not prohibit artificial intelligence in government systems, but it sets the framework for it. Restricted-access information remains with the operator, interaction with the neural network is limited by templates or topics, inaccurate answers are measured and do not control the system automatically, and the model is not changed without a formal procedure.
Start with an inventory of AI components: model, version, hosting location, data, interaction mode, inaccurate-answer criteria, and responsible party. Then transfer these conditions into the technical specification and the contract with the contractor — taking into account that as of March 1, 2027, the contractor independently assesses the level of security maturity.
