Consulting
Software Import Substitution in 2026: What Is Mandatory and What Is Not
Foreign software is now banned on significant critical infrastructure objects in Russia. A clear look at who this legally applies to, who it does not, and why many unregulated businesses are planning ahead anyway.
In short
As of 1 January 2026, significant objects of critical information infrastructure, banks, telecom, energy, transport, healthcare, government services, are fully banned from running foreign software, with fines up to 500,000 RUB. For every other business this is not a legal requirement, but roughly 57 percent of companies have already replaced at least one foreign service with a Russian one for practical reasons of their own.
What actually changed on 1 January 2026
As of 1 January 2026, significant objects of critical information infrastructure (КИИ) in Russia are fully banned from running foreign software. Significant КИИ objects are systems in banking and finance, telecommunications, energy, transport, healthcare and government services, formally entered into the relevant registry through a categorisation procedure. Non-compliance carries fines of up to 500,000 RUB and the risk of systems being blocked during an inspection, a concrete regulatory rule now in force, not an abstract threat.
One detail worth pinning down right away: the requirement applies to specific systems, not to an entire industry. A bank as a company and a specific banking information system that has gone through categorisation are not the same thing under this law. The rest of this article gives an honest breakdown of who this legally applies to, who it does not, and what makes sense to do in each case.
Who this legally applies to, and who it does not
The distinction between these two groups matters, and it is worth stating plainly rather than alarming businesses the requirement does not formally touch. КИИ subjects are legally required to move significant objects to Russian software, with real consequences for non-compliance. Ordinary businesses outside the КИИ registry, retail, services, development shops, most of e-commerce, have no legal obligation to do this at all, but face a growing number of practical reasons to think about it ahead of time anyway.
| Category | Legally mandatory | What is at stake | The practical takeaway |
|---|---|---|---|
| КИИ subjects (significant objects): banking, telecom, energy, transport, healthcare, government services and other listed sectors | Yes, mandatory as of 1 January 2026 | Fines up to 500,000 RUB, risk of systems being blocked during an inspection | This is not optional, it is a requirement with a firm deadline and active oversight |
| Ordinary business outside the КИИ registry | No, there is no legal requirement | No formal sanctions apply | Growing practical risk: foreign services being blocked or withdrawing, unavailable updates and support, and requirements from large partners and tenders increasingly asking for it anyway |
The real market numbers for 2026
According to market surveys, around 57 percent of Russian companies have already replaced at least one foreign service or product with a domestic alternative, regardless of whether they are legally required to. This is not purely a consequence of regulatory pressure tied to КИИ, it is the accumulated effect of several years of foreign vendors exiting the market, support and licences lapsing, and a deliberate preference for more predictable suppliers.
The Russian software registry maintained by the Ministry of Digital Development held around 21,000 software products at the time this material was prepared, ranging from operating systems and office suites to narrow, industry-specific tools. The scale of the registry matters in its own right: replacing foreign software in 2026 increasingly means choosing among ready, vetted options rather than searching from a blank page.
Where substitution is actually happening: product categories
Substitution concentrates in a few clear categories. Operating systems and office suites: businesses have accumulated real migration experience here over the past few years, products such as Astra Linux and MyOffice have moved from experimental pilots to production deployments at scale. Databases: Russian distributions built on PostgreSQL have taken up a meaningful share of the space left by departing foreign vendors. Information security: Russian solutions were already strong here well before any of this, one of the few categories where switching is often an upgrade rather than a compromise.
ERP and CRM deserve a note of their own, because it touches systems people often do not even think about in an import-substitution context: amoCRM and Bitrix24, the two most widely used CRM platforms on the Russian market, are Russian products from the start. For a company already running one of them, the substitution question is already settled by the platform choice itself. Cloud infrastructure is its own category too: Yandex Cloud, VK Cloud and Selectel cover the same ground as foreign cloud providers, with the difference that the data physically sits inside Russia.
A practical framework for businesses that are not required to switch, but want to plan ahead
The first step is inventory: a complete list of systems and services actually in use, marked by foreign or domestic origin and by how critically the business depends on each one. This sounds obvious, but in a mid-sized company such a list usually does not exist in one place until somebody deliberately sits down and builds it.
The second step is classifying by risk: what is easy to replace (an office suite, where retraining takes days) and what is critical and hard (an ERP system with a decade of custom logic baked in, where replacement is effectively a new implementation project). The third step is a pilot: replacing one system, not the most critical one, before a full switch, to see how the data migrates, how the team responds, and how long adaptation genuinely takes before risking core infrastructure on it.
The fourth step is budgeting for the transition period itself, not just the end state: until the new system has proven stable, both systems typically run in parallel, which means double licensing or hosting costs, team time spent on data migration, and a temporary dip in productivity. This is a real cost, not a minor footnote, and it needs to be planned for up front rather than discovered partway through.
The connection to AI decisions: where the data actually lives
The import-substitution conversation connects directly to infrastructure choices for AI, even though the two are formally separate questions. If an AI-based solution processes personal data, it matters where the requests physically go: calling a foreign API means the data leaves Russian territory, which runs straight into the personal data localisation requirements under 152-FZ.
Hence the growing interest in models hosted on Russian infrastructure, GigaChat and YandexGPT as ready services, or open models self-hosted on Yandex Cloud, VK Cloud or Selectel, where the data stays under local jurisdiction and physically inside the country. This is not a blanket rule that domestic always beats foreign, it is a concrete technical criterion worth building into the architecture of any AI solution from the outset, whenever it touches sensitive data.
Frequently asked questions
What is a significant КИИ object, and how do we know if our system qualifies?
A significant КИИ object is a specific information system, not the entire company, that has gone through the categorisation procedure under the critical infrastructure security law and been formally entered into the registry. If a company operates in one of the listed sectors (banking, telecom, energy, transport, healthcare, government services and a few others) and is unsure of its status, only the formal categorisation procedure gives a definitive answer, not a guess based on industry alone.
What exact date did the foreign software ban take effect?
As of 1 January 2026, significant objects of critical information infrastructure are fully banned from running foreign software, with fines up to 500,000 RUB and the risk of systems being blocked during an inspection. The requirement applies specifically to significant КИИ objects, not automatically to every information system a company in one of the listed sectors happens to run.
Is small business legally required to switch to Russian software?
No, if a company is not a КИИ subject, no legal requirement to switch to Russian software applies. The decision stays voluntary and is usually made for practical reasons: the risk of losing access to a foreign service, a lack of updates and support, requirements from a major partner, or the terms of a specific tender. Around 57 percent of companies on the market have already made at least one such switch for exactly these reasons, not because the law required it.
What if a critical system runs on foreign software and there is no budget for replacement yet?
Start with inventory and risk classification, not the migration itself: understand exactly what the system does, what happens if access or support stops suddenly, and how technically complex a replacement actually is. Then run a pilot on a less critical system to build real experience and get an honest read on timeline and cost before touching the riskiest part of the stack. Waiting with no plan at all is the worst option. A plan with no immediate execution budget attached is a perfectly workable one.
Are amoCRM and Bitrix24 really Russian products?
Yes, both platforms are Russian from the ground up and listed in the domestic software registry. For a company already running sales on one of them, the CRM substitution question in an import-substitution context is already settled, by the platform choice itself. It is one of the few categories where mainstream market choice already lined up with localisation requirements before those requirements became a talking point.
Where can the Russian software registry be checked?
The registry is maintained by the Ministry of Digital Development, Communications and Mass Media of Russia, and at the time this material was prepared it held around 21,000 software products, from operating systems to narrow, industry-specific tools. Before starting the replacement of a specific system, it is worth checking the registry directly, a given category may have expanded considerably over the past year, and there are usually more options available than it first appears.
Need a hand with this?
We do this work, not just write about it. Describe the task and we will scope it and send a staged estimate.
Related services
- IT consulting and product auditThe most expensive mistakes in software happen before the first line of code: a misread problem, a stack chosen out of a contractor’s habit, and a specification that does not exist. Consulting exists to settle all of that before the development meter starts running: what to build, out of what, at what cost and in which order. The result is a document, not an opinion on a call.
- CRM implementation and sales automationEnquiries from messengers, email and calls get lost when the only place tracking them is a sales manager’s memory. A CRM fixes this, but only when it is configured around your actual sales process rather than left as the out-of-the-box default. We implement amoCRM and Bitrix24, set up automation, and connect everything to the website, telephony and analytics.
- AI strategy consultingMost companies have already run at least one AI pilot. A minority have taken even one pilot to stable, ongoing use. The gap usually is not the model, it is whether the process had a measurable payoff and whether the real running cost was worked out before starting. We help pick the right entry point so budget does not disappear into a demo that stays a demo.
Read next
- How to Choose a Tech Stack: Criteria That Outlive the HypeA stack is a five-year commitment usually made in a single call. Here is the order the decisions should be taken in, the criteria that carry real weight, working stacks for six project archetypes and what a wrong choice costs.
- Where AI and ML Actually Pay Off in a Business, and Where They Are Expensive HypeMachine learning pays off where there is a repeated decision, a lot of similar data and tolerance for error. Missing any one of the three means do not. Here are the use cases that work, their realistic accuracy, the running costs and how to run a four to six week pilot.
- AmoCRM or Bitrix24: Choosing a CRM for Your Sales Team in 2026AmoCRM and Bitrix24 are not a better-or-worse comparison, they fit different business structures. A side-by-side look at pipelines, automation, cost and the learning curve, built to save you a costly switch in a year.