In 2026, regulation of the IT industry is developing along several tracks at once. In established and sensitive areas — particularly critical information infrastructure (CII) and cybersecurity — the government is introducing more detailed requirements, strengthening oversight, and increasing corporate responsibility. At the same time, regulatory frameworks are being developed for new and rapidly evolving segments of the digital economy, including artificial intelligence and the platform economy.
Digital and technological sovereignty is also becoming a cross-cutting regulatory priority. Requirements concerning the origin and security of software, import substitution, and support for domestic solutions are increasingly being integrated into the regulation of individual segments of the IT market.
Experts from the Baikal Lobridge Analytical Center examined legislation adopted and under development in 2026, regulatory decisions, as well as public and non-public industry discussions. The study identifies the key trends shaping the direction of IT regulation.
The full study is available here.
An article based on the study was also published by Forbes.
Below are the study’s key findings.
Digital and technological sovereignty is also becoming a cross-cutting regulatory priority. Requirements concerning the origin and security of software, import substitution, and support for domestic solutions are increasingly being integrated into the regulation of individual segments of the IT market.
Experts from the Baikal Lobridge Analytical Center examined legislation adopted and under development in 2026, regulatory decisions, as well as public and non-public industry discussions. The study identifies the key trends shaping the direction of IT regulation.
The full study is available here.
An article based on the study was also published by Forbes.
Below are the study’s key findings.
CII Regulation Is Shifting Toward Continuous Risk Management
In the field of critical information infrastructure, the focus is gradually shifting from compliance with individual formal requirements toward continuous monitoring of system security and risk management.
In 2026, a unified list of standard industry CII facilities was approved, covering around 400 types of facilities across 14 industries. At the same time, sectoral authorities are specifying industry-specific approaches to CII categorization, while security requirements are becoming increasingly risk-based.
For businesses, this means growing expectations not only regarding the availability of security tools, but also their ability to regularly assess security levels, identify vulnerabilities, and respond quickly to threats. In parallel, work continues on transitioning significant CII facilities to Russian software and software-hardware systems.
In 2026, a unified list of standard industry CII facilities was approved, covering around 400 types of facilities across 14 industries. At the same time, sectoral authorities are specifying industry-specific approaches to CII categorization, while security requirements are becoming increasingly risk-based.
For businesses, this means growing expectations not only regarding the availability of security tools, but also their ability to regularly assess security levels, identify vulnerabilities, and respond quickly to threats. In parallel, work continues on transitioning significant CII facilities to Russian software and software-hardware systems.
Cybersecurity Is Evolving Into Systemic Cyber Resilience
The regulatory focus is gradually moving beyond individual information-security tools. Increasing importance is being placed on an organization’s ability to remain resilient during cyberattacks, identify threats, and maintain continuous interaction with government cyber-response systems.
In 2026, the rules governing information exchange on cyberattacks and incidents were updated, technical requirements for security tools were further specified, and security requirements for government information systems were strengthened.
As a result, cyber resilience is becoming an ongoing process, while organizations themselves are assuming greater responsibility for managing the relevant risks.
In 2026, the rules governing information exchange on cyberattacks and incidents were updated, technical requirements for security tools were further specified, and security requirements for government information systems were strengthened.
As a result, cyber resilience is becoming an ongoing process, while organizations themselves are assuming greater responsibility for managing the relevant risks.
The Approach to Intellectual Property Is Becoming More Complex
Intellectual property regulation is developing along several tracks simultaneously.
On the one hand, the Federal Antimonopoly Service of Russia continues to consider removing certain antitrust immunities for intellectual property rights holders, including software developers. The initiative has faced opposition from industry associations, which point to potential risks for Russian developers and the protection of intangible assets.
On the other hand, amendments to the Russian Civil Code have entered into force, changing the rules for determining and recovering compensation for infringement of exclusive rights. The changes affect both the methodology for calculating compensation and the definition of an individual infringement, while also increasing liability for certain violations: the maximum amount of compensation has risen from RUB 5 million to RUB 10 million.
A separate regulatory track is emerging around the use of intellectual property in the development and training of artificial intelligence models. Here, regulators continue to face the challenge of balancing technological innovation with the protection of rights holders.
In the near term, businesses will need to account for these factors simultaneously, with regulatory predictability and transparency likely to remain a central issue in industry discussions.
On the one hand, the Federal Antimonopoly Service of Russia continues to consider removing certain antitrust immunities for intellectual property rights holders, including software developers. The initiative has faced opposition from industry associations, which point to potential risks for Russian developers and the protection of intangible assets.
On the other hand, amendments to the Russian Civil Code have entered into force, changing the rules for determining and recovering compensation for infringement of exclusive rights. The changes affect both the methodology for calculating compensation and the definition of an individual infringement, while also increasing liability for certain violations: the maximum amount of compensation has risen from RUB 5 million to RUB 10 million.
A separate regulatory track is emerging around the use of intellectual property in the development and training of artificial intelligence models. Here, regulators continue to face the challenge of balancing technological innovation with the protection of rights holders.
In the near term, businesses will need to account for these factors simultaneously, with regulatory predictability and transparency likely to remain a central issue in industry discussions.
Artificial Intelligence Is Developing Its Own Regulatory Framework
Artificial intelligence has become one of the most rapidly evolving areas of regulation.
In 2026, Russia adopted a law supporting the development of AI technologies. The law is framework-based and focuses on targeted support for advanced domestic models rather than comprehensive regulation of the entire sector. It introduced the concepts of large foundational models, as well as “sovereign” and “national” AI models. In certain areas, the government will be able to establish special conditions for their use.
At the same time, experimental legal regimes are being expanded, while measures to support developers, access to government data for model training, and requirements for the localization of technological infrastructure are under discussion.
For now, regulation remains largely framework-based. As the use of AI expands, regulatory attention is likely to shift from rules governing the technology itself toward managing specific risks and use cases.
In 2026, Russia adopted a law supporting the development of AI technologies. The law is framework-based and focuses on targeted support for advanced domestic models rather than comprehensive regulation of the entire sector. It introduced the concepts of large foundational models, as well as “sovereign” and “national” AI models. In certain areas, the government will be able to establish special conditions for their use.
At the same time, experimental legal regimes are being expanded, while measures to support developers, access to government data for model training, and requirements for the localization of technological infrastructure are under discussion.
For now, regulation remains largely framework-based. As the use of AI expands, regulatory attention is likely to shift from rules governing the technology itself toward managing specific risks and use cases.
The Platform Economy Is Becoming a Distinct Regulatory Category
On October 1, 2026, Russia’s federal law on the platform economy enters into force, establishing a dedicated regulatory framework for digital platforms.
The law defines the status of platforms, operators, and partners, introduces requirements for product listings, and restricts retrospective changes to commercial and logistics terms. A register of intermediary digital platforms is also being established.
At the same time, regulation of the sector continues to evolve. The Ministry of Economic Development has prepared a second package of measures covering settlements with sellers, product returns, administrative liability, and further development of the platform register.
Digital platforms are therefore gradually evolving from universal intermediaries into a distinct regulated category of business subject to a dedicated set of rules and obligations.
The law defines the status of platforms, operators, and partners, introduces requirements for product listings, and restricts retrospective changes to commercial and logistics terms. A register of intermediary digital platforms is also being established.
At the same time, regulation of the sector continues to evolve. The Ministry of Economic Development has prepared a second package of measures covering settlements with sellers, product returns, administrative liability, and further development of the platform register.
Digital platforms are therefore gradually evolving from universal intermediaries into a distinct regulated category of business subject to a dedicated set of rules and obligations.
Technological Sovereignty Is Becoming a Permanent Regulatory Priority
In 2026, technological sovereignty is moving beyond individual import-substitution measures and becoming a permanent part of the regulatory environment.
Since March, new requirements have applied to software seeking inclusion in the registers of Russian and Eurasian software. A three-tier system for public procurement is being developed, distinguishing between trusted software, standard Russian software, and foreign solutions. A list of significant Russian software developers is also being established.
Regulators are seeking not only to replace individual foreign products, but also to create demand for domestic solutions across key technological ecosystems.
At the same time, a significant share of businesses continues to use foreign enterprise software. Further regulatory development will therefore depend to a considerable extent on the availability of competitive Russian alternatives.
Since March, new requirements have applied to software seeking inclusion in the registers of Russian and Eurasian software. A three-tier system for public procurement is being developed, distinguishing between trusted software, standard Russian software, and foreign solutions. A list of significant Russian software developers is also being established.
Regulators are seeking not only to replace individual foreign products, but also to create demand for domestic solutions across key technological ecosystems.
At the same time, a significant share of businesses continues to use foreign enterprise software. Further regulatory development will therefore depend to a considerable extent on the availability of competitive Russian alternatives.
Government Support Is Becoming More Targeted
Government support for the IT sector remains in place, but the model itself is changing.
Instead of broad industry-wide preferences, support measures are increasingly linked to specific projects, technological priorities, and additional commitments undertaken by businesses. Certain tax incentives and the conditions for accessing them have also been revised.
At the same time, the government is considering increasing grant co-financing for particularly significant projects implemented by Industrial Competence Centers from 50% to 80%. Given the limited number of recipients, this is likely to increase competition among companies for direct public funding.
In the future, access to government support may depend increasingly not only on whether a solution is Russian, but also on its technological significance, commercialization potential, and ability to create long-term competitive advantages for the industry.
Instead of broad industry-wide preferences, support measures are increasingly linked to specific projects, technological priorities, and additional commitments undertaken by businesses. Certain tax incentives and the conditions for accessing them have also been revised.
At the same time, the government is considering increasing grant co-financing for particularly significant projects implemented by Industrial Competence Centers from 50% to 80%. Given the limited number of recipients, this is likely to increase competition among companies for direct public funding.
In the future, access to government support may depend increasingly not only on whether a solution is Russian, but also on its technological significance, commercialization potential, and ability to create long-term competitive advantages for the industry.
Key Takeaway
IT regulation in 2026 is not developing according to a single universal model. Several regulatory trends are evolving simultaneously. In mature and sensitive areas, regulators are strengthening oversight and introducing more detailed requirements; for emerging markets, they are creating baseline rules; and technological sovereignty and government support are becoming increasingly embedded in sectoral policy.
For businesses, this means monitoring several regulatory tracks at once depending on their area of activity — from cybersecurity and CII to AI, digital platforms, intellectual property, and access to government support.
Importantly, companies need to follow not only regulation that has already been adopted, but also draft legislation and industry discussions that are shaping the future rules of the market.
For businesses, this means monitoring several regulatory tracks at once depending on their area of activity — from cybersecurity and CII to AI, digital platforms, intellectual property, and access to government support.
Importantly, companies need to follow not only regulation that has already been adopted, but also draft legislation and industry discussions that are shaping the future rules of the market.
