Russia is currently discussing a draft law on the regulation of artificial intelligence (the AI Law), which may come into force on September 1, 2027. Major market players and legal experts are taking part in the discussion, but it is already clear that the central issue is not technological development. It is control over what users ask and what machines answer. T-invariant explains how the state intends to effectively legalize censorship in the AI sphere, how this mechanism would work, and who may end up taking the blame.
AI Censorship
Almost all public AI models, especially large language models (LLMs), implement some form of censorship. Before turning to the proposed AI Law, it is worth briefly describing how this mechanism works. Not every model uses all the methods below, but some combination is almost always present.
At the pre-training stage, developers can carefully filter the datasets on which the model is trained. This is the most effective method of censorship. In this case, the model simply knows nothing — for example, about the events in Tiananmen Square in 1989 or about Russia’s “foreign agents.” For the model, these things do not exist, and it cannot describe them in principle. However, this approach undermines informational integrity and can lead to hallucinations: the model senses a gap in its knowledge and tries to fill it with plausible but invented information.
Latest news on scientists’ work and experiences during the war, along with videos and infographics — subscribe to the T-invariant Telegram channel to stay updated.
To avoid this, models are usually trained on fuller datasets and then refined through supervised fine-tuning with human feedback. The model generates answers, which human evaluators mark as “good” or “bad.” “Good” answers are reinforced; “bad” ones are down-ranked. This reduces hallucinations but does not completely eliminate the risk that “undesirable” information will slip through — especially if a user is actively trying to obtain it.
For this reason, developers usually add an output filter as well. Such a filter is easier to configure and update than retraining the entire model. When censorship rules change rapidly — as they do in Russia today, with more and more people being labeled “foreign agents” and universities declared “undesirable” — the output filter can be quickly adjusted. It is a rather crude solution: the model simply refuses to answer certain questions, but it protects the developers from administrative or even criminal liability. This is how filters currently work in most Russian AI models.
In Russia, the authorities are conducting a campaign against the “LGBT extremist organization.” As part of this campaign, access is being blocked to many books that the authorities claim contain “LGBT influence.” If you ask Yandex’s AI assistant Alice about the book Summer in a Pioneer Tie, it will most likely reply: “I won’t answer that question, because I don’t really know enough about it.” And if you ask whether it has a filter that prevents it from answering, it will not respond directly but will instead try to explain that the question itself is somehow improper. In essence, this is a defeat for the model, but developers apparently have little choice given how quickly the list of prohibitions changes. Updating an output filter is relatively cheap and fast, whereas retraining a model to completely erase any memory of a book that sold hundreds of thousands of copies and was a bestseller in 2021–2022 would be prohibitively expensive.
In practice, all three forms of censorship are used: filtering training datasets, supervised fine-tuning, and output filtering.
Users and Developers
The AI Law has mainly been discussed in the media in terms of restricting user access to foreign (“cross-border”) models. Most popular foreign models — ChatGPT (OpenAI), Gemini (Google), Claude (Anthropic), and others — are already inaccessible from Russian IP addresses. Russian users typically access them via VPNs. Although bypassing blocks is becoming more difficult, this issue is not directly related to the AI Law itself.
Article 10, paragraph 4 of the draft law introduces liability for the “illegitimate” use of an AI model by the user. It requires users to “use artificial intelligence services and models for purposes that do not contradict the legislation of the Russian Federation” and “not to perform actions aimed at circumventing built-in security and control mechanisms in violation of the established operating parameters of AI systems.”
AI models, especially LLMs, often contain information that censors consider “illegitimate.” For example, Alice knows perfectly well about Summer in a Pioneer Tie. With indirect questioning, it may even begin to provide substantive answers, but the output filter usually intervenes at the final stage. There are numerous techniques (known as “jailbreaks”) that allow users to make a model “talk” despite its restrictions. However, an ordinary user may simply not realize that the information they are seeking is prohibited. There is no clear boundary between legitimate curiosity and a malicious jailbreak.
The law therefore introduces liability for an “improper” query. It does not specify what form this liability takes or how intent is to be proven. Since models store chat histories, users usually register profiles, and law enforcement has access to the servers of companies such as Yandex or Sber, users can be held accountable. In practice, this already leads people to avoid topics they consider risky. The explicit inclusion of user liability in the law makes working with AI models a potentially dangerous activity.
However, the law is aimed primarily at developers and operators of AI models. It introduces the concept of a “sovereign” AI model and sets criteria for inclusion in the corresponding register. Such models must be trained on datasets formed on the territory of the Russian Federation. While it is impossible to completely exclude foreign data (for example, excluding the arXiv preprint server would render any scientific model useless), the final assembly of the dataset and the training process must occur on Russian territory under state oversight.
Up-to-date videos on science during wartime, interviews, podcasts, and streams with prominent scientists — subscribe to the T-invariant YouTube channel!
“Sovereign” models must undergo supervised fine-tuning that ensures “security” and reinforces “traditional values.” The full list of ideological priorities in the law includes: “life, dignity, human rights and freedoms, patriotism, citizenship, service to the Fatherland and responsibility for its fate, high moral ideals, a strong family, creative labor, the priority of the spiritual over the material, humanism, mercy, justice, collectivism, mutual assistance and mutual respect, historical memory and continuity between generations, and the unity of the peoples of Russia” (Article 4, paragraph 6).
The boundary between, for example, a “Ukrainian Armed Forces fighter” and a “Russian Armed Forces serviceman” (both potentially viewed as “patriots defending the homeland”) is extremely unstable. Even after multiple rounds of fine-tuning, it is practically impossible to separate such concepts completely. Output filtering will therefore remain necessary — though even that does not guarantee full compliance with censorship requirements.
The law also introduces the concept of a “trusted” AI model. “Trusted” and “sovereign” are not the same thing. A separate register will be created for “trusted” models, which may be used in critical infrastructure. Judging by Article 8, the emphasis here is placed more on technical “security” than on ideological conformity.
When Liability Begins
Of course, there are also specialized models. For example, a model trained to detect lung cancer in X-ray images is unlikely to “discredit the Armed Forces of the Russian Federation” (though if it uses a natural-language interface, that possibility cannot be ruled out).
The safest possible model answers every question the way AI Alice answers questions about Summer in a Pioneer Tie: “I won’t answer that question, because I don’t really know enough about it.” But such a model would be useless to anyone.
Any large language model inevitably balances between “safety” and “usefulness.” Article 11 of the draft law addresses the liability of parties involved in the AI ecosystem.
Paragraph 2 reads as follows: “The developer of an artificial intelligence model, the operator of an artificial intelligence system, and the owner of an artificial intelligence service shall bear liability in accordance with the legislation of the Russian Federation for a result obtained through the use of artificial intelligence that violates the legislation of the Russian Federation, provided that the said persons knowingly knew or should have known of the possibility of obtaining such a result through the use of the model, system, or service of artificial intelligence of which they are the developer, operator, or owner, unless the contrary is proven in the course of investigative actions” (emphasis by T-invariant).
In other words, if a “sovereign” Russian model describes a Russian soldier as an “occupier,” this does not automatically make the developers liable for “discrediting the Armed Forces.” The law allows for the possibility that the developers could not have prevented such an outcome.
Paragraph 3 confirms this: “The developer of an artificial intelligence model, the operator of an artificial intelligence system, and the owner of an artificial intelligence service shall be exempt from liability under paragraph 2 of this article if they have taken exhaustive measures to prevent the obtaining of such a result and have complied with the requirements of the legislation of the Russian Federation in developing the model, operating the system, and providing access to the artificial intelligence service” (emphasis by T-invariant).
Without this provision, the development of public AI models in Russia would likely grind to a halt. However, it remains unclear how this will work in practice. A determined FSB officer using jailbreak techniques could still elicit a prohibited response. Large companies like Yandex or Sber will most likely be able to defend themselves using Article 11, paragraph 3. Smaller developers of open-source models may not have the resources to prove they took “exhaustive measures.”
The Russian Bar Association described the draft law as “excessively oriented toward state control and insufficiently mindful of business interests.” This is a fair assessment — though hardly surprising.