Penny Wise, Pound Foolish: How Casual ChatGPT Use Turns into Heavy Fines

The article describes common workplace scenarios where employees upload personal data to foreign AI chatbots: a sales manager sends a CSV export from 1C to ChatGPT for analytics, an HR specialist uploads resumes to a chatbot for candidate selection, and a developer uses Claude Code to debug production issues. All these actions constitute administrative violations under Russia's 152-FZ personal data law, specifically violating cross-border transfer rules (Article 12) and localization requirements (Article 18). The article notes that fines for data leaks range from 300,000 rubles for up to 1,000 people to 15 million rubles for over 100,000 people, with turnover fines of 1-3% of annual revenue for repeated violations. However, in 2025, actual enforcement was lenient: only about 500 court decisions on Article 13.11 of the Administrative Code were issued, 60% of which were just warnings, and the maximum fine for a Russian company was 150,000 rubles (paid by Russian Railways and Russian Post). The largest fine of 17 million rubles was imposed on WhatsApp for localization violations. The article outlines phases of enforcement, predicting that starting in 2026, Russian companies will face much higher fines under new rates, and the first turnover fines could appear by late 2026 or early 2027. It advises companies to take compliance seriously, as casual AI use with personal data can lead to fines up to 6 million rubles for cross-border transfer, up to 15 million for leaks, plus additional fines for not notifying Roskomnadzor within 24 hours.