Starting in 2027, the Ministry of Digital Development will implement mandatory code certification for Russian software developers. By 2028, the agency intends to introduce corporate security certificates. These measures aim to verify software publishers and track any modifications made to the code after its initial release.
The certification data will be embedded directly into installation files. This allows operating systems to identify the developer and alert users if an application originates from an unknown source. The Ministry will assume the powers of the National Certification Authority on March 1, 2027, taking charge of requirements, key generation, and registry management.
While website certificates remain free via the Gosuslugi portal, the new framework may introduce fees for other certificate types. Specific pricing and validity periods are currently undecided. Government agencies and the Bank of Russia will be exempt from these costs, receiving the documents free of charge.
Industry experts have raised concerns regarding a potential conflict of interest, as the Ministry will act as both the regulator and the service provider. Furthermore, because these Russian certificates lack international recognition, companies operating globally will likely need to maintain multiple electronic signature systems to ensure compatibility.
