The FSTEC of Russia has released several regulatory documents addressing artificial intelligence within information systems. Key publications include the 'Methodology for Analyzing Information System Security' approved on November 25, 2025, and the 'Composition and Content of Measures for Protecting Information in Information Systems' approved on April 12, 2026.
The security methodology introduces specific procedures for vulnerability analysis. Point 3.1.7 of the document explicitly mentions AI, requiring information gathering on software that implements machine learning models. This process involves external scanning of the information system's perimeter to identify potential security gaps.
The document regarding protection measures includes a dedicated section, 3.18, focused on AI security. It mandates that organizations must prevent unauthorized access to information processed by AI systems from both external and internal threats. Developers are required to conduct a security threat assessment for AI systems using the FSTEC threat database.
Following the threat assessment, organizations must develop technical specifications for implementing security measures. The regulatory framework also references several existing orders, such as Order No. 117 dated April 11, 2025, which sets requirements for protecting information in state information systems and other government-related infrastructure.
