Russia to Introduce Requirements for Personal Data Protection When Using AI

Russia's FSTEC published a draft order on July 24, 2026, updating organizational and technical measures for personal data protection in information systems. The document is expected to take effect on September 1, 2026. New measures include separate protection for AI, IoT, virtualization, cloud computing, mobile devices, and remote access. A three-tier flexible system allows operators to adapt basic measures to their IT architecture, followed by a mandatory maturity level assessment before data processing and every three years, as well as after IT incidents. For critical information infrastructure, continuous interaction with the state system GosSOPKA is required. Experts note that AI protection standards remain immature globally, and the new requirements will likely focus on regulating AI use and preventing personal data leaks to external models.