
AI law signed: regulatory threshold set at 1 billion parameters
The law was signed on 26 July. It is Russia's first standalone federal law on AI, and it defines a new category — a large foundation model, meaning any program with at least 1 billion parameters.
Which models fall under the definition
Almost every modern LLM qualifies, including the models behind AI agents and RAG systems. The law sets out the principles for regulating such models but stops short of spelling out obligations and penalties: those are left to secondary legislation. Any company that develops or uses such a model needs to establish whether its product falls within scope, and someone inside the company must be named accountable for compliance.
Why the threshold sits at 1 billion parameters
The number was not chosen at random. It screens out small classifiers and recommendation models while leaving large language and multimodal systems under regulation. The law covers both model developers and companies that embed someone else's model in their own product. The threshold applies to the model itself, regardless of the size of the company using it.
What to check before a pilot starts
For business, this is a new line item. A legal review of the product and a named compliance owner are needed well before a pilot reaches production. Three things get checked before the start: the model's parameter count, the accountable person inside the company, and the budget for this work. Any estimate of what an AI rollout costs is worth recalculating with this step included — regardless of whether an agent pays for itself on a given task.
What becomes clearer once secondary legislation lands
Still unknown: the date the law takes effect, the specific obligations and penalties for companies, the set of secondary regulations, and how enforcement will work in practice. Clarity arrives with the secondary legislation.
Let’s discuss your project?
Tell us about your process — we’ll suggest where AI pays off fastest.
Related articles

What a company perimeter is, and when data never leaves it
A company perimeter is the boundary inside which data and computation stay under the company's control: its own servers, its own networks, its own accounts.

Non-determinism: what it means in plain terms
Non-determinism is a language model's tendency to answer the same request differently each time; the spread is narrowed by a fixed response format, a quality threshold, and sample-based acceptance testing.