Digest No. 5 — October 2026
This issue is dated 21 October. Five stories about deadlines and about who answers for a decision. Europe pushed high-risk obligations to 2027–2028. Russia brought its own requirements into force on 1 March 2026, with two working clauses on AI, and explained the transition separately. Six government decrees are being drafted for the AI law — without them it does not work. Eight US states are suing OpenAI over how the product is designed, not over a malfunction. A Russian MP proposes guaranteeing a human review of AI decisions. And on the same day the supreme courts of Russia and China agreed to introduce AI as a judge's assistant. Every item carries a primary source and a note on what the document does not say.
1. Two regulators, two directions
1.1. EU: high-risk obligations moved to 2027 and 2028
24.07.2026. The Official Journal published Regulation (EU) 2026/1744, the “digital omnibus on AI”. Adopted on 8 July, it entered into force three days after publication, on 27 July. It amends three regulations at once: 2024/1689 (the AI Act itself), 2018/1139 (aviation safety) and 2023/1230 (machinery).
The substance is in the dates. Obligations for high-risk systems listed in Annex III moved from 2 August 2026 to 2 December 2027; for systems inside regulated products under Annex I, from 2 August 2027 to 2 August 2028. Transparency and prohibitions were not postponed. Article 5, on the contrary, was tightened: systems that generate intimate images without consent and child sexual abuse material are now explicitly prohibited.
The regulation states the reason itself, in the recital: harmonised standards, common
specifications and alternative guidance were not ready, national authorities were not in place,
and keeping the original date would have pushed compliance costs up so far that the date could
no longer be justified. Two years of head start are two years to prepare evidence — not two years
off.
Sources: the regulation's text in the Official Journal
(reprint in the Boletín Oficial del Estado: OJ No. 1744, 24.07.2026, pp. 1–41),
BSI's explainer of 13.10.2026.
1.2. Russia: FSTEC Order No. 117 in force since 1 March
01.03.2026. FSTEC Order No. 117 of 11.04.2025 has been in force since 1 March. It was registered with the Ministry of Justice on 16.06.2025 under No. 82619 and published on the official portal on 17.06.2025. Clause 2 repeals the previous requirements — Order No. 17 of 11.02.2013 and Order No. 27 of 15.02.2017. Certificates issued before 1 March 2026 remain valid (clause 3).
AI appears in two places. In the list of measures, subparagraph “t”, there is one line: “ensuring information protection when artificial intelligence is used”. The operative work is in clauses 60 and 61. Clause 60 forbids transferring restricted-access information held in information systems to the person who developed the model, including for improving the model, and requires excluding unauthorised influence on datasets, on the model and its parameters, on data-processing and decision-search services. Clause 61 requires defined request and response templates or permitted topics with compliance control, statistical criteria for identifying unreliable AI answers, and narrowing the area of decisions built on such answers.
12.03.2026 brought information message No. 240/22/1492 — and it is about
the transition, not about AI: the phrase “artificial intelligence” does not appear in its text
once. What it does say: first approve the information protection policy, internal standards and
regulations (clause 14); until a new methodological document is approved, work under the 2014
document “Information protection measures in state information systems”; bring systems certified
under Order No. 17 into line and run additional certification tests under Order No. 77 of
29.04.2021; contracts concluded before 1 March 2026 may be performed under the previous
requirements. Plus a recommendation to adopt a transition plan.
Sources: FSTEC information message,
the order's text.
1.3. What the order does not say
A ComNews review of 23.03.2026 states that the order “established a direct ban on the use of cloud AI services” for state secrets and restricted-access information. That is the outlet's reading. The phrase “cloud AI services” is not in the order: the cloud appears once, among the base measures — “protection of virtualisation and cloud computing” (clause 63). The ban is framed around the recipient — the person who developed the model — and around restricted-access information. The practical difference is significant: an in-house model in your own environment does not fall under that clause, while passing data to the model's developer does.
What follows in practice. Methodologies for clauses 60 and 61 do not exist yet, and that is not our inference: the message says plainly that until a new document is approved the old one applies. So internal AI rules have to be written now — what does not go into the model, how answers are checked, who answers for an unreliable answer, and what a person does with a decision the system proposed.
The comparison is simple. The EU moved the dates because standards are not ready; Russia introduced requirements because the order is ready but the methodology is not. In both cases an organisation faces a document without instructions — only the date from which liability runs is different.
2. Russia: six implementing decrees are being drafted for the AI law
09.10.2026. Deputy Minister of Digital Development Ivan Lebedev at the
“Digital Solutions” forum: “A law never lives without implementing acts. It has an approved
schedule, and we are adopting a whole series — six — of government decrees that will set out
approaches in detail across several areas.” Three of the six are named: the procedure for
confirming that models match spiritual and moral values, the lists of spheres where only
sovereign and national models are allowed, and access to data for training large foundation
models.
Sources: Garant, 09.10.2026 (secondary: the ministry's own site is unreachable from our environment);
the law itself: Federal Law No. 243-FZ of 26.07.2026, mostly in force since 01.09.2026.
What the report does not contain: the other three decrees, adoption dates, or any texts. We checked the official publication portal — 1,600 acts published between 12 and 21 October, searched by title: none of them is a decree implementing 243-FZ. The caveat is mandatory: we saw titles only, and a decree may not mention artificial intelligence in its name.
What follows in practice. The framework law has been in force since 1 September, but it only works through decrees: they will set both the admission procedure for models and the rules for data access. Watch draft acts on the public consultation portal rather than the news — that is where requirements are visible before signature. How labelling under 243-FZ works and who answers for it is covered in issue No. 1.
3. US: eight states sue OpenAI
14.10.2026. The attorneys general of eight states — Iowa, Kansas, Nebraska,
West Virginia, Arkansas, Arizona, Idaho and Montana — filed separate suits in their own state
courts. This is a coordinated campaign, not one class action. The claim: ChatGPT is designed to
be overly agreeable and to simulate human compassion so that a person trusts it more and stays
in the conversation longer. On the plaintiffs' account, that design reinforces delusional
thinking, produces dangerous medical advice and in some cases encourages self-harm; the second
count is disclosure — OpenAI knew about the risks and said too little, which is a matter of
state consumer protection law.
Sources: Xinhua (Spanish edition, 15.10.2026),
China Economic Net (19.10.2026),
Bizhankook (21.10.2026) reading the complaint.
The suits ask for more than money: change how ChatGPT operates, strengthen protection for minors, pay civil penalties and damages. In Iowa's complaint, as Bizhankook reads it, the penalty reaches $40,000 per violation, and testing of advanced models should pause until an independent auditor verifies them. OpenAI responds that age-specific safeguards, parental controls and break reminders are already in place, and says it will work with the states. Florida sued the company back in June.
Why this is a shift. Earlier claims were about an error: the model lied, gave harmful advice, leaked data. This dispute is about construction. “Sycophantic design” is not a malfunction but a built-in property, and the states pursue it as a product design claim — the same model of litigation used against social networks over harm to teenagers.
Caveats. We did not open a single attorney general's press release and did not read the complaint in full: the list of states and the substance of the claims come from Xinhua and China Economic Net, details such as the penalty from the Bizhankook reading. Case numbers are not given in our sources.
4. Safeguards against AI decisions: a deputy's position, not a bill
19.10.2026. Anton Gorelkin, first deputy chair of the State Duma committee
on information policy, IT and communications, told Gazeta.Ru that two safeguards should be fixed
in law for people affected by AI decisions. First, a free appeal to a specialist to review a
decision made with a neural network. Second, advance notice that an application or circumstances
are being assessed by a system rather than by an employee. Such guarantees matter most at
dismissal, on a credit application and when benefits are awarded.
Sources: Gazeta.Ru, 19.10.2026 (the original interview; the page only renders in a browser, so we read the AMP version),
Duma TV, 19.10.2026.
The mechanics are spelled out down to deadlines. About 30 days to consider such an appeal — the same term as Article 16 of the personal data law sets for objections to decisions taken solely by automated means. The mere presence of an employee is not enough: the specialist must write a short justification showing that the circumstances of the case were examined rather than a model's suggestion reproduced. The deputy suggests this could go into industry rules or an organisation's own documents.
What is not here. A bill. This is a deputy's position in an interview, not a drafted text: no norm obliges anyone yet. Gorelkin also speaks more broadly — current personal data regulation does not cover every feature of modern AI systems, the Duma is considering a separate law, and liability for an error still has to be split between the specialist, the organisation and the model's creator.
5. Courts of Russia and China: an assistant, not a judge
21.10.2026. In Beijing, the chair of the Russian Supreme Court Igor Krasnov
and the chief justice of China's Supreme People's Court Zhang Jun signed a document on
introducing AI into judicial systems jointly. Krasnov: “The main goals and principles of this
document largely coincide with your work. They concern raising the capacity of the judge and the
efficiency of the system while unconditionally preserving the judge's key role in decision-making.”
The agreement includes mutual legal consultations and an exchange of practice.
Sources: Channel One, 21.10.2026,
Kommersant, 21.10.2026,
Sputnik China, 21.10.2026.
Krasnov visited the “Smart Court” laboratory at China's Supreme People's Court — according to the Russian side, the site opened on 31.12.2019. The figures that follow are the Chinese side's words, not our verification: the platform is trained on hundreds of millions of court documents, AI transcribes the hearing record and prepares a draft decision after the judges' deliberation, saving a judge 30–40% of the time. The judge checks and finalises; an independent AI ruling is prohibited, and responsibility stays with the judge. Over two years, 3,500 courts were linked into one network.
Our reading. The Russian and Chinese lines run in the same direction: AI is an assistant, a human decides. That is a direct pair to the safeguards in section 4: if a person must check, they need the time, a readable justification and the right to a review. One country calls this a principle; the other so far has a deputy's proposal.
6. What follows from this
- A deadline is regulation too. The EU moved high-risk obligations to 2027–2028; Russia brought its requirements into force on 1 March. Both stories say the same thing: the paper exists, the practice of compliance does not, and the date decides who answers for what.
- A retelling is not the text. ComNews's “ban on cloud AI” and clause 60's “do not pass data to the model's developer” are different things. The first is inferred, the second is written down; an argument with an inspector will be had over the second.
- The right to a human is now a requirement, but not yet a law. Gorelkin's safeguards, Krasnov's principle and FSTEC's clause 61 say one thing: a person checks the decision. In the order it is binding for state systems; elsewhere it is a proposal so far.
- The dispute has moved from error to design. Eight states are suing not over an answer ChatGPT gave but over how it was built. We look at agents the same way: behaviour comes from construction, not from a glitch.
7. Figures in this issue and where to check them
| Figure | What it means | Where to check |
|---|---|---|
| 2026/1744 | number of the EU digital omnibus regulation | the Official Journal text |
| 24.07.2026 | publication in the Official Journal | same source |
| 27.07.2026 | entry into force, three days after publication | Article 4 of the regulation |
| 02.12.2027 | new date for high-risk systems under Annex III | Article 113 as amended |
| 02.08.2028 | new date for Annex I systems | same article |
| 117 | number of the FSTEC order | the order's text |
| 01.03.2026 | the order is in force from this date | clause 4 of the order |
| 60 and 61 | the order's clauses on AI | the order's text |
| 240/22/1492 | number of the FSTEC message of 12.03.2026 | fstec.ru |
| 1,600 | acts on the publication portal checked by title (12–21 October) | publication.pravo.gov.ru |
| 6 | decrees being drafted for 243-FZ | Garant, 09.10.2026 |
| 8 | states suing OpenAI | Xinhua |
| 14.10.2026 | date the suits were filed | same source |
| 30 | days proposed to review an AI decision with a human | Gazeta.Ru, 19.10.2026 |
| 21.10.2026 | date the courts' AI document was signed | Channel One, Kommersant |
Prepared on 21.10.2026. External sources were opened and checked on the day of publication; figures reported by the other side — the Chinese court statistics, the details of the US complaints — are marked as such in the text. If you spot an error, write to info@isai.su and we will correct it and note the change.
Key points
- Issue No. 5: five stories about deadlines and about who answers for a decision.
- The EU moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028.
- FSTEC Order No. 117 has been in force since 1 March 2026; its AI content is subparagraph “t” and clauses 60 and 61.
- Six implementing decrees are being drafted for the AI law; eight states are suing OpenAI.
- The caveats are in the text: the “cloud AI ban” is an outlet’s reading, and the deputy’s safeguards are not a bill.
What to remember
- A delay and an entry into force are two sides of one thing: a document without instructions.
- Read the text, not the retelling: the ban concerns passing data to the model’s developer.
- The right to a human is already a requirement for state systems; elsewhere it is a proposal so far.