FSTEC of Russia Order No. 117 of 11 April 2025 has applied since 1 March 2026 to state information systems and other systems of state bodies, state unitary enterprises and state institutions; its requirements on artificial intelligence are points 60 and 61. The draft amendments of 24 August 2026 restate these points and introduce measures for AI models and agents from 1 March 2027. Below is what the text of the draft says and how it can be met.
FSTEC is the Federal Service for Technical and Export Control, Russia’s regulator for the technical protection of information. Quotations from the order and the draft below are our translation; the official texts are in Russian.
What the draft amendments to Order No. 117 require
The draft: regulation.gov.ru, No. 170500 (in Russian), published on 24 August 2026, to take effect on 1 March 2027; not approved as of 16 October 2026. Checked: 16 October 2026, against the text of the draft.
- point 14(d): the operator’s documents must include the procedure for protecting information when artificial intelligence is used;
- point 60: AI models are placed in a separate segment; privileged access to it uses strengthened multi-factor authentication; users get access to models with minimal rights; users’ actions in the segment are logged and analysed;
- point 60, if a model processes restricted information or performs significant functions of the operator: control of access to models, filtering of input data (requests) and output data (responses), request quotas, and limitation and control of the models’ functionality;
- point 61: “when AI agents are used, including autonomous AI agents”, measures aimed at preventing unauthorized impact on the resources of the information system, as well as control and management of the agents’ access rights under internal standards and regulations;
- definitions: artificial intelligence, as in Article 3, point 1 of Federal Law No. 243-FZ of 26 July 2026 (see Russia’s AI law); an AI agent, as in clause 3.1.1 of GOST R 71476-2024.
Where it hurts
An operator of a state information system (a regional agency, a state institution, a state unitary enterprise) has already deployed an agent on a local model, but its security team has no tool to keep a log of the agent’s calls that cannot be quietly edited in places, or to show that the agent’s rights are limited and each of its actions is checked. An ordinary syslog can be edited with one command, and no trace of the edit remains.
How it is addressed
ISS Ledger 117. A log of receipts on a hash chain of GOST R 34.11-2012 (“Streebog”): an outsider recomputes its integrity with a single-file script in an isolated environment, without trusting the developer and without installing the developer’s software. The open code is below.
Open source · Apache-2.0 · iss-ledger-117 1.1.1
iss_ledger_117-1.1.1-py3-none-any.whl · sha256: 8d4ffe60f41ebd377c476f369655aaef5e0ac91858a3d294be37fd1e3100bc87
iss_ledger_117-1.1.1.tar.gz · sha256: 6eccef523e24fa60fed29c78866ff12afbab092bd17d51642e00d34dfcea9fa5
iss_verifier.py · sha256: 1ff894574407307d33ec99115652bcaec4e53d06189178696d0db1c767a8608f
Source code: https://git.isslab.ru/isslab/iss-ledger-117
Measurement: the GOST test vectors from RFC 6986 (M1, M2) pass; a stand-alone single-file verifier for isolated environments.
The contradiction: an audit log must carry evidential weight for the regulator, and it must not depend on closed trust servers and external suppliers. The TRIZ resolution: a chain of receipts under GOST R 34.11-2012 in pure Python with no dependencies; its integrity is recomputed by a single-file script in an isolated environment, without trusting the developer.
MITR Sentinel. Excluding a destructive call before it runs: a deterministic admissibility gate. A destructive database operation or a step outside the working directory does not reach the executor if it matches a prohibition pattern.
Open source · Apache-2.0 · mcp-sentinel 1.1.2
mcp_sentinel-1.1.2-py3-none-any.whl · sha256: 681a4db59a1a44e89a2b1386ec4b4f2e1fc23c1025c295b9ebf00fd5d20901ea
mcp_sentinel-1.1.2.tar.gz · sha256: abb88978db7b34a2f1f56e0eff42bcd1365b9cc0eb17e4a4380f7815e4f1b79e
Source code: https://git.isslab.ru/isslab/mcp-sentinel
Measurement: checking contracts in memory, median 0.015 ms; a full cycle including writing the decision to the log on disk, median 22.5 ms (N=100).
The contradiction: an agent must act freely to solve tasks, and each of its actions must be guaranteed safe. The TRIZ resolution: the model’s thought stays free, while a discrete tool call is checked separately from it: the open package checks the call and the tool’s response against the given rules and returns the reason for a refusal to the agent, so that it does not repeat the inadmissible action.
The boundary: what is claimed here and what is not. The open tool helps keep and verify a log of AI actions; it does not certify compliance with the order. Compliance is established by the organization and the certification body. The hash function implementation passes the GOST R 34.11-2012 test examples (RFC 6986), but it is not a certified cryptographic information protection tool.
Legal reference: state systems, critical information infrastructure and open code
FSTEC of Russia Order No. 117 (approved on 11 April 2025, registered by the Ministry of Justice on 16 June 2025, in force from 1 March 2026 in place of Order No. 17) sets requirements for protecting information in state information systems and other systems of state bodies, state unitary enterprises and state institutions, including systems with AI (points 60–61). For significant objects of critical information infrastructure, the relevant acts are Federal Law No. 187-FZ and FSTEC of Russia Order No. 239. As of 2026, no separate approved methodology for certifying software with AI technologies has been adopted.
- Internal development environment. No licence for information protection tools is required to protect one’s own development environment; the decision is made by the head of information security under the organization’s internal policy.
- Production use at significant objects. The existing procedures apply: conformity assessment of the software under the general requirements, and certification of the information system that includes it. A fully open implementation and an external integrity verifier make it easier to confirm that the solution can be trusted, without blind trust in the supplier.
This is a reference to the norms in force, not a legal opinion; the organization decides whether it applies to a specific object.
Frequently asked questions
Is an FSTEC licence needed to use such a log under Order No. 117?
No licence for information protection tools is required for the internal protection of one’s own development environment; the head of information security decides under the internal policy. The legal conclusion belongs to the organization’s lawyer.
Does it work in an isolated (air-gapped) environment?
Yes. The implementation is pure Python with no external dependencies; the stand-alone verifier is one file that is moved to an isolated machine and run without a network. The target operating systems are Astra Linux, RED OS and Alt Linux.
What do the draft amendments require for AI agents?
Point 61 of the draft requires, when AI agents are used, including autonomous ones, measures to prevent unauthorized impact on the resources of the information system, and control and management of the agents’ access rights under internal standards and regulations. The draft is to take effect on 1 March 2027 and had not been approved as of 16 October 2026.
Sources
- Draft amendments to FSTEC of Russia Order No. 117, regulation.gov.ru, project 170500 (in Russian): https://regulation.gov.ru/projects/170500
- FSTEC of Russia Order No. 117 of 11 April 2025 (in Russian): http://publication.pravo.gov.ru/document/0001202506170011
Checked: 16 October 2026