Russia's first GOST standard for secure AI software development enters public discussion
Сбер
Russia's FSTEC, ISP RAS and Sber have developed a draft GOST R standard for developing secure AI software. The public discussion runs until September 17, 2026. The standard supplements existing GOST R 56939-2024 with AI-specific requirements, covering data management, secure training, threat modeling, and model passports.
The draft GOST R standard 'Information protection. Development of secure software implementing artificial intelligence technologies. General requirements' was developed by FSTEC of Russia, the Institute for System Programming of the Russian Academy of Sciences (ISP RAS), and Sber. Public discussion lasts until September 17, 2026. Unlike GOST R 71539-2024 which covers the entire AI system, this standard focuses specifically on software within it, complementing the baseline secure development standard GOST R 56939-2024. It defines 'AI software' as a bundle including the AI model and its weights, interaction software, runtime environment, extension software (like RAG, tool calls), and optionally training software. Models are classified as own, borrowed (with source code/weights or compliance by the original developer), or attracted (used only during development). The standard introduces new terminology such as 'AI model behavior restriction mechanisms', 'data drift', and 'AI model passport'. It lists 27 processes: 10 typical, 15 modified, and 2 fully specific (data set management and secure training of AI models). Data set management requires cross-annotation, addresses threats like data poisoning and leakage, and includes rules for federated learning. Secure training mandates that infrastructure must be located on Russian territory and prohibits involvement of foreign contractors. Threat modeling must consider FSTEC's threat database, OWASP Top-10 for LLM and ML, MITRE ATT&CK/ATLAS, and NIST adversarial ML. Security requirements include data provenance, banned result classes, and content labeling. Testing must include adversarial robustness against prompt injection and data extraction. The standard requires an AI model passport and a machine-readable component list (PPK) for supply chains. Localization requirements for training infrastructure are unconditional, while for data storage they depend on system criticality. The standard explicitly excludes ethical and bias issues.
- Сокращения
- FSTEC = Federal Service for Technical and Export Control of Russia — Федеральная служба по техническому и экспортному контролю России
- ISP RAS = Institute for System Programming of the Russian Academy of Sciences — Институт системного программирования Российской академии наук
- RAG = Retrieval-Augmented Generation — генерация с дополнением по извлечению
- OOD = Out-of-Distribution — данные, распределение которых отличается от обучающего
- OWASP = Open Web Application Security Project — Открытый проект безопасности веб-приложений
- MCP = Model Context Protocol — протокол контекста модели
- MITRE ATT&CK = MITRE Adversarial Tactics, Techniques, and Common Knowledge — матрица тактик, техник и общих знаний MITRE
- MITRE ATLAS = MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems — ландшафт угроз для систем ИИ от MITRE
- NIST = National Institute of Standards and Technology — Национальный институт стандартов и технологий США
- PPK = Program Component List (Перечень программных компонентов) — Перечень программных компонентов
Source: Habr — хаб ИИ —
original