An AI agent that reads a customer card in a CRM and passes its text to a language model processes personal data, and it does so on behalf of the company. Under Russia’s Federal Law No. 152-FZ “On Personal Data”, the company remains the operator: it answers for the lawfulness of passing data to the model provider, for cross-border transfer if the model is foreign, for the agent’s decisions about people and for a leak through the agent. The law makes no exception for programs: the rules are the same as for an employee, only the agent takes more actions and takes them faster.
In brief
- A request to a model that contains a name, a phone number or a history of contacts is already processing of personal data (Art. 3(3) of 152-FZ): the law calls any action with such data processing, including transfer.
- The model provider processes the data on the company’s instruction, under a contract with mandatory content and, unless a federal law provides otherwise, with the data subject’s consent (Art. 6(3)). The company answers to the data subject for the provider (Art. 6(5)).
- A foreign model means cross-border transfer: notify Roskomnadzor before it starts, collect information about the recipient’s protection measures, and do not transfer to countries outside the list of states with adequate protection until the notice review period has passed (Art. 12).
- A decision about a person taken by the agent alone is prohibited without written consent or a basis in a federal law (Art. 16): a loan refusal, screening of candidates, blocking a customer.
- A leak through the agent is the operator’s incident: notice to Roskomnadzor within 24 and 72 hours (Art. 21(3.1)) and fines under Art. 13.11 of the Code of Administrative Offences: RUB 3 to 15 million for a legal entity, and 1 to 3% of revenue for a repeated leak.
What in an agent’s work counts as processing of personal data?
Everything the agent does with data about people. Art. 3(3) of 152-FZ defines processing as any action with personal data: collection, recording, storage, retrieval, use, transfer, deletion. For an agent this means:
| Agent action | What it is under 152-FZ |
|---|---|
| Reads a customer card in the CRM or an email with a signature | Retrieval and use |
| Puts a name, a phone number or a contact history into a request to a model | Transfer: provision to the model provider |
| Saves a dialogue to long-term memory or a vector database | Recording, accumulation, storage |
| Writes a log of its actions with customer data | Recording and storage |
| Sends an email or an export to a third party | Provision or dissemination |
| Takes a decision about a customer or a candidate | Use; for a decision based solely on automated processing, Art. 16 |
152-FZ has no separate regime for AI, and Russia’s AI law (243-FZ) does not introduce one: liability follows general legislation (on 243-FZ).
The model provider: processing on instruction or transfer to a third party?
If the company sends personal data to an external model service that processes it on the company’s assignment, this is processing on the operator’s instruction (Art. 6(3)). The law requires three things.
- A contract with mandatory content: the list of data, the list of actions with it, the purposes, the duty to keep the data confidential and secure, protection requirements under Art. 19, the duty to report incidents to the operator and to confirm the measures taken on request.
- The data subject’s consent to the instruction, unless a federal law provides otherwise. The processor itself does not have to obtain consent (Art. 6(4)).
- Clarity about who answers. The operator answers to the data subject for the processor’s actions (Art. 6(5)). If the processor is foreign, both the operator and the processor answer to the data subject (Art. 6(6)).
Standard terms of cloud model services are written for all customers and do not have to match the list in Art. 6(3). Checking them against that list is the company’s task before the agent sends the first customer card to the service.
A foreign model: cross-border transfer and localization
Transferring personal data to a foreign legal entity is cross-border transfer (Art. 3(11)). Article 12 sets the procedure:
- before the transfer starts, the operator notifies Roskomnadzor, separately from the general notice of processing (Art. 12(3));
- before filing the notice, it obtains from the foreign recipient information about protection measures and the conditions for ending processing, and for countries outside the adequacy list also about that country’s legal regime (Art. 12(5));
- to countries on the adequacy list data may be transferred once the notice is filed (Art. 12(10)); to other countries only after the review period of ten working days has expired (Art. 12(9), 12(11));
- Roskomnadzor may prohibit or restrict the transfer; the operator must then ensure that the recipient destroys the data already transferred (Art. 12(7), 12(14)).
There is also a localization requirement: when personal data of Russian citizens is collected, its recording, systematization, accumulation, storage, updating and retrieval must use databases located in Russia, with the exceptions listed in Art. 6(1) (Art. 18(5)). For an agent this concerns its memory, vector databases and logs: if they hold customer data, they must be inside the Russian perimeter.
A Russian model provider removes the cross-border question but not the instruction: a contract under Art. 6(3) is needed with it too.
May an agent take decisions about people on its own?
Only within narrow limits. Article 16 prohibits decisions based solely on automated processing that produce legal effects for a person or otherwise affect their rights and legitimate interests. The exceptions are the person’s written consent or a case expressly provided by a federal law (Art. 16(1)–(2)).
Even with consent, the operator must explain how such a decision is taken and what it may lead to, let the person object and review the objection within 30 days (Art. 16(3)–(4)). A loan refusal, screening out candidates, blocking an account or a customer, decided by an agent without a person, fall under this article. A workable option: the agent prepares the decision, a person takes it, and the log shows who took it and on what basis.
A leak through the agent: what does the company face?
An agent can be made to give data away: a hidden instruction in an email, a document or a web page changes its behaviour (prompt injection). If data has left, this is unlawful transfer, an incident of the operator.
Notice to Roskomnadzor (Art. 21(3.1)): within 24 hours, about the incident, its presumed causes, the harm and the measures taken; within 72 hours, about the results of the internal investigation and the persons whose actions caused the incident.
Fines for legal entities under Art. 13.11 of the Code of Administrative Offences (as amended on 4 August 2026):
| What leaked | Fine | Part of Art. 13.11 |
|---|---|---|
| Data of 1,000 to 10,000 subjects (10,000 to 100,000 identifiers) | RUB 3–5 million | Part 12 |
| 10,000 to 100,000 subjects (100,000 to 1 million identifiers) | RUB 5–10 million | Part 13 |
| Over 100,000 subjects (over 1 million identifiers) | RUB 10–15 million | Part 14 |
| Special categories of personal data | RUB 10–15 million | Part 16 |
| Repeated leak | 1–3% of the previous year’s revenue, at least RUB 20 million (RUB 25 million for special categories and biometrics) and at most RUB 500 million | Parts 15, 18 |
Officials are fined separately. Processing without a lawful basis or incompatible with the purposes of collection is a separate offence (Art. 13.11(1)).
What 152-FZ requires of each agent action
| Agent action | What 152-FZ requires | How to provide it |
|---|---|---|
| Passes customer data to an external model | Instruction under Art. 6(3): a contract with mandatory content, the subject’s consent | Rule: data about people goes only to approved providers with a contract |
| Passes it to a foreign model | Notice to Roskomnadzor and information about the recipient (Art. 12) | The rule prohibits sending to a foreign node without the notice; the refusal is logged |
| Keeps data in memory or a log | Localization in Russia (Art. 18(5)), protection measures (Art. 19) | Memory and log inside the Russian perimeter; retention by the purpose of processing |
| Decides on a person | Art. 16: written consent or an express basis in a federal law | A person approves the decision; the log shows who did and on what basis |
| Receives someone else’s instruction from an email or a document | Measures against unlawful transfer (Art. 19); after a leak, Art. 21(3.1) | Each action is checked against the rules before execution; the log lets the incident be reconstructed within 24 hours |
An approach in which a person approves the rule for an action, and every agent action is checked against it before execution and written to a log that cannot be quietly corrected, is IS 3.0.
What to do
- Map the agents’ data: which personal data each agent reads, where it sends it and where it stores it.
- Check the grounds: whether the company has a lawful basis for processing and consent to instruct the model provider.
- Check the contract with the model provider against the list in Art. 6(3); with a foreign provider, file the cross-border transfer notice before the transfer starts.
- Move agents’ memory and logs into the Russian perimeter if they hold data of Russian citizens.
- Take decisions about people out of full automation, or obtain written consent and meet Art. 16(3)–(4).
- Set rules for data transfer and check every agent action before execution; prepare the procedure for notifying Roskomnadzor of an incident within 24 hours.
Frequently asked questions
May customer personal data be passed to ChatGPT or another language model?
Only in compliance with 152-FZ. Passing data to a model provider is processing on instruction: a contract with the content of Art. 6(3) is needed and, unless a law provides otherwise, the data subject’s consent. If the provider is foreign, it is also cross-border transfer with a notice to Roskomnadzor before it starts (Art. 12).
Who is liable if an AI agent breaches 152-FZ?
The operator, the company that uses the agent. The operator answers to the data subject for the actions of a processor acting on its instruction (Art. 6(5)); if the processor is foreign, both answer (Art. 6(6)). Russia’s AI law (243-FZ) introduces no special rules for AI.
Must Roskomnadzor be notified if an agent uses a foreign model?
Yes, if personal data is passed to it. The cross-border transfer notice is filed before the transfer starts and separately from the notice of processing (Art. 12(3)). To countries outside the adequacy list, data may not be transferred until the ten working days of review have expired (Art. 12(9), 12(11)).
May an AI agent refuse a customer without a person involved?
If the decision produces legal effects or otherwise affects a person’s rights, only with the person’s written consent or in cases expressly provided by a federal law (Art. 16). The operator must explain how the decision is taken, accept an objection and review it within 30 days.
Where may an AI agent’s memory and logs be stored?
If they hold personal data of Russian citizens, recording and storing it upon collection must use databases located in Russia (Art. 18(5)). This covers the agent’s long-term memory, vector databases and action logs.
What is the fine for a personal data leak through an AI agent?
Under Art. 13.11 of the Code of Administrative Offences, RUB 3 to 15 million for a legal entity depending on the volume; RUB 10 to 15 million for special categories; for a repeated leak, 1 to 3% of revenue, at least RUB 20 million (RUB 25 million for special categories) and at most RUB 500 million. The incident must be reported to Roskomnadzor within 24 and 72 hours (Art. 21(3.1) of 152-FZ).
Sources
- Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, as amended on 26 July 2026: Articles 3, 6, 12, 16, 18, 19, 21 (in Russian), ConsultantPlus: https://www.consultant.ru/document/cons_doc_LAW_61801/
- Code of Administrative Offences of the Russian Federation, as amended on 4 August 2026, Article 13.11 (in Russian), ConsultantPlus: https://www.consultant.ru/document/cons_doc_LAW_34661/1f421640c6775ff67079ebde06a7d2f6d17b96db/
- Federal Law No. 243-FZ of 26 July 2026 “On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation”, Article 11 (in Russian), ConsultantPlus: https://www.consultant.ru/document/cons_doc_LAW_540336/
Checked: 18 October 2026, against the texts of the laws in force. This is guidance on the rules in force, not a legal opinion: the conclusion about a specific system is the organization’s.
Related pages
- What is an AI agent, and how does it differ from an assistant?
- Prompt injection: what it is and how to defend against it
- Russia’s law on artificial intelligence: Federal Law No. 243-FZ
- Who is liable for the mistakes of artificial intelligence
- Director liability for the actions of an AI agent
- IS 3.0: security of AI agent actions