A new experimental legal regime for the development of artificial intelligence (AI) projects is unfolding in Moscow and subsequently throughout Russia. The first initiative was introduced in a draft bill earlier this year, which underwent very few changes after its first publication. As a result, Russia's Federal Law No. 123-FZ came into force on July 1, 2020, introducing a special legal framework for "digital sandboxes" in Moscow.

Digital sandboxes are territories where technologies may be developed and tested even if such technologies fall outside of the current legislation. And as a result of the issues posed by this new law, a more expansive law - Federal Law No. 258-FZ - will come into effect in 2021.

Federal Law No. 123-FZ

This experimental regime allows companies to work on innovative AI technologies that are not regulated under existing legislation. It creates opportunities for seeing just how AI functions under real-life conditions.

Additionally, the new law is a first step in the legal regulation of AI in the Russian Federation, since it introduces definitions for artificial intelligence and artificial intelligence technology that may be used in future regulations. The duration of the experimental regime is five years, and it started in July 2020.

The experimental regime will also facilitate the realization of the Moscow government's project, "Moscow - the Smart City 2030," which focuses on the development of smart living, smart mobility, a smart economy, and a smart environment in Russia's capital. Although the project aims to fundamentally digitize the city by 2030, some AI technologies already form an integral part of the daily life of Moscow's citizens. For example, self-driven cars have been tested in Moscow since 2019, and several companies are currently examining their use on public roads.

By launching digital sandboxes, the authorities can closely monitor which legal issues arise from the daily use of AI and which of those must be urgently regulated. The clearest red-flag issues going forward are a liability in cases of AI malfunction or fault, and the accidental disclosure or erasure of personal data by AI.

Fundamental concerns

The provisions of 123-FZ regarding the processing of personal data have already caused significant concern among citizens. For example, the law states that no personal data involved in the project can be transferred to persons not related to the experiment, nor can that data be stored outside of Moscow. This seems obscure, given the boundless nature of the Internet and the fact that cloud services are commonly used for data storage and access. Moreover, the personal data will still be at the disposal of the Moscow city government, as well as the entrepreneurs and legal entities entered into a special register of operators.

The update also amends the Law on Personal Data. Part 1 of Article 6 is supplemented by Clause 9.1, according to which the processing of personal data obtained as a result of depersonalization is carried out in order to increase the efficiency of state or municipal administration, as well as for other purposes provided by 123-FZ.

The amended Article 10 of the "Law on Personal Data" indicates that "the processing of personal data regarding the state of health obtained as a result of depersonalization is allowed in order to increase the effectiveness of state or municipal administration."

At the same time, the law does not address such fundamental questions as:

  • where the data of our digital identities will be stored and how it will be erased;
  • how exactly the privacy of citizens will be ensured; and
  • who will be liable in the cases of failure to depersonalize data.

Such regulations over personal data also raise questions about the primary aim of the new law, as well as generating concerns that participants in the experimental regime will have access to and can process the personal data of Moscow's citizens.

To minimize the negative effect of the law, a draft bill was submitted to the State Duma proposing to delay the introduction of the legislation until July 2025 in order to provide more clarity on the processing of anonymized personal data. The explanatory note related to the bill indicates that the use and implementation of AI technologies, including tracking and facial recognition systems, cause serious and legitimate concerns among citizens.

During the proposed postponement period, legal gaps related to the responsibility of officials for possible violations of the proper use of personal data can be eliminated. The draft received negative comments during the first reading, and the second reading of a revised version will take place during the autumn session of the State Duma.

Overall, Russia has the resources to implement innovative technologies into the country's operations, but the legislation is still lagging significantly. This could lead to an abuse of power by both the authorities and the accredited operators with access to the data.

Federal Law No. 258-FZ

As a result, comprehensive regulation of AI in Russia is urgently needed. First steps in this regulation, however, have already been taken, including the recent enactment of the Federal Law No. 258-FZ "On Experimental Legal Regimes in the Sphere of Digital Innovations in the Russian Federation." This law comes into force in January 2021. Other corresponding laws are expected in the years ahead.

This new law will allow the creation of digital sandboxes throughout the whole country. Unlike 123-FZ, 258-FZ establishes the maximum duration of the regime for three years, with a possible extension.

The spheres allowed to participate in this new regime include the medical sector, transportation and logistics, architecture and construction, finance, the remote sales of goods and services, municipal services, industrial production, and agriculture. Other sectors may be added later.

Under the new law, the government will have the right to establish exemptions from certain legislative requirements that prevent the implementation of digital innovations. However, in order for digital sandboxes to begin immediately after the implementation of 258-FZ, the sectoral federal laws regulating areas of respective activity must also be adjusted accordingly. Moreover, the hierarchy of overlapping provisions between 123-FZ applying to Moscow and 258-FZ extending to the whole country presents issues that must be resolved in the course of the implementation of the new laws.