Determine applicable obligations
Legal and security owners should document purpose, data categories, users, integrations and regulated processes. Federal Law No. 187-FZ and amendments to the Personal Data Law apply under different conditions, as do rules for government systems and regulated sectors.
Classification must distinguish personal data, government information systems, CII and sector obligations because each has different triggers.
Assign governance
The National AI Strategy calls on state-owned organisations to account for AI development in their strategies. A specific project still needs a defined objective and named owners for process, data, model and operations, including authority to approve sources, actions, release and shutdown.
Name owners for process, data, model, security and operation, including authority to approve a new source or stop the system.
Choose a bounded pilot
Begin with cited search, drafting or classification with human confirmation. Avoid irreversible actions, critical control and decisions affecting a person as a first use case.
Start with cited retrieval or drafting under human confirmation rather than irreversible actions or decisions affecting an individual.
Accept documented evidence
Require boundaries, component and licence inventory, access matrix, test results, changes, updates, backup, deletion and incident handling. Exact legal controls require case-specific classification and current advice.
Acceptance evidence should include boundaries, licences, permissions, tests, updates, deletion, recovery and incident handling for the classified system.