Development of AI regulations in Russia 

Russia is developing a legal framework to regulate artificial intelligence (AI) and experts say there is no immediate need for comprehensive regulation. Instead, it is sufficient to focus on improving ethical and technical standards to set boundaries for developers and users of AI technologies.

Existing Russian regulations directly or indirectly affect the development and use of AI, potentially leading to certain legal risks that require careful consideration by businesses and developers.

General regulatory developments

The development of AI is a state policy priority. Russia has adopted several acts defining key objectives and directions for AI development in the country, as well as implementation mechanisms, which include:

1. 1. The National Strategy for AI Development until 2030;
   2. The Strategy for the Development of the Information Society in the Russian Federation for 2017-2030;
   3. The Concept for the Development of Regulation of Artificial Intelligence and Robotics Technologies until 2024; and
   4. Federal projects “Artificial Intelligence” and “Regulatory Framework for the Digital Environment” under the National “Digital Economy” Programme.

These documents, however, only reflect the strategic goals for AI development in Russia.

Regulatory sandbox

In 2020, laws were adopted to create conditions for AI development in Russia. The main one focuses on creating experimental legal regimes (ELRs), or regulatory sandboxes – a tool allowing the implementation of innovations in test mode.

To create an ELR, a company or individual entrepreneur must develop a project, submit it and obtain approval from authorities.

Intellectual property

In most countries, including Russia, intellectual property regulations do not protect AI-generated content. In cases where an author has made a creative contribution to a work, and AI has been used only as a tool, this resulting content may be protected by copyright.

Third-party rights. Many AI systems are trained on large datasets, while users are practically unrestricted in forming queries and can:

1. 1. generate results that reproduce (fully or partially); or
   2. emulate the style of a real author. While case two falls outside IP regulation, the first may be illegal and lead to liability for the respective rights holder, even in cases of partial reproduction. For example, if an AI user creates an image that reproduces individual elements of a protected work, the criterion of a substantial part may be used to establish infringement – the rights holder controls not only the use of the entire object but also its substantial parts.

The substantial part is not interpreted literally (e.g. more than 50% of the work). It is determined based on qualitative and quantitative criteria, which interact like communicating vessels: the smaller one is, the larger the other must be.

Accordingly, if individual elements of a protected work are reproduced in a generated object, the court will analyse whether protected (substantial) elements were used. If such elements are found, the use of the generated object may be deemed illegal, with a ban on its use.

Personal data

Personal data in one form or another may be used in AI operations: by developers to train AI models; by users to generate various results; and in other cases. Such processing must comply with personal data legislation.

Potential issues vary depending on the subject’s status and include the following:

Extraterritorial application of Russian law. In 2022, an extraterritorial provision was added to the Russian Data Protection Law. Collecting data from Russian citizens based on a contract or consent is recognised as sufficient grounds for applying Russian personal data law to foreign entities.

Legal grounds for processing. A company may process personal data only if there are legal grounds (e.g. consent).

Use of sensitive data. AI systems may be used, among other things, to analyse voices or images of individuals. In certain cases, these may be classified as biometric personal data, which are subject to stricter controls and regulations.

Localisation. When collecting personal data of Russian citizens, their storage and certain other actions must be carried out using databases located in Russia.

Cross-border data transfer. Transferring data abroad needs compliance with special requirements:

1. 1. assessing the recipient; and
   2. notifying the competent authority (Roskomnadzor) of the transfer.

Automated decision making. The law prohibits making decisions that have legal consequences or otherwise affecting the rights of the subject based solely on automated processing of personal data without written consent.

Application of legal, organisational and technical measures to ensure personal data security. These measures are primarily aimed at properly organising work with personal data and, ultimately, protecting their confidentiality.

Moral rights

The publication and further use of a person’s image, including photographs, video recordings, or works of art depicting them, are generally permitted only with the person’s consent.

Moral rights are inseparable from the individual (including their appearance, artistic or everyday image, voice and other perceptible manifestations of individuality) and are protected by law. Thus, for instance, a person’s voice (including a generated voice) is protected and its use requires consent.

Advertising

AI may be used to create advertising materials and the subsequent distribution of such ads must comply with advertising legislation.

The law establishes several requirements for advertising. It must inter alia be truthful, fair, complete and ethical. Additional requirements are established for certain advertised objects (e.g. alcohol, medical devices and financial services). If AI is used to create advertising materials, it is necessary to ensure that the resulting product complies with legal requirements.

Prohibited information

Russian legislation defines various types of prohibited information. If prohibited information is identified, authorities (often with the help of a telecoms operator or hosting provider) initiates a procedure to block the information resource. If the prohibited information is removed, access may be restored, except in cases of permanent restriction.

Blocking procedures may vary depending on the type of information (e.g. extrajudicial or judicial blocking, with or without notification).

If a company plans to use AI to create materials for subsequent distribution, it is recommended to:

1. 1. analyse the list of prohibited information;
   2. identify the most relevant to its activities; and
   3. prevent their distribution.

Recommendation technologies

Recommendation technologies are subsets of AI or data mining providing information based on the collection and analysis of user preferences.

Resource owners using recommendation technologies must fulfill several obligations, including:

1. 1. Prohibiting the use of recommendation technologies that violate the rights and interests of people and companies or provide information prohibited by Russian law;
   2. Informing users on the use of recommendation technologies and providing information about the resource owner and their email address; and
   3. Publishing the rules for using recommendation technologies in Russian. The rules must describe the processes and methods used, and the types of information collected.

Liabilities

Under current state policy, responsibility for all consequences of AI systems lies with an individual or legal entity. Existing civil and criminal liability mechanisms do not require fundamental changes, and can be applied in cases of harm caused by AI.

Civil liability. If an individual, legal entity or their property is harmed, the person causing the harm must fully compensate the victim. This provision is universal and applies to all torts not explicitly regulated by law.

Thus, the general tort principle applies, meaning that liability for harm caused by AI lies with the person who caused the harm, provided their actions constitute a civil offence.

Depending on the circumstances, the responsible party may be the AI developer, the owner of exclusive rights to the AI, the AI user, the manufacturer of goods, or the provider of services using AI. The court will determine this on a case-by-case basis, most likely based on some expert opinion.

Criminal liability. AI is defined as a means of committing a crime (merely a tool), and the criminal law provisions on liability are fully applicable to crimes committed using AI technologies.

SEAMLESS Legal (SL Legal)
10 Presnenskaya Naberezhnaya,
Block C, 123112 Moscow, Russia
Tel: +7 49 5786 4000
Email: info@seamless.legal
www.seamless.legal