In a panel discussion devoted to legislative initiatives to combat cybercrime, experts concluded that the rapid development of technologies (including AI, deepfakes, and phishing attacks) requires a shift from piecemeal prohibitions to the creation of a coherent regulatory architecture that ensures a balance between technological progress and citizens’ security.

One of the key problems identified is the low effectiveness of recovering stolen funds. According to the data cited, of RUB 7.4 billion stolen across 495 thousand incidents, only about RUB 420 million (5–6%) was returned, indicating that existing mechanisms for compensating losses are not working.

Proposed solutions include expanding the practice of provisional seizure of assets at early stages, creating compensation funds from assets confiscated under Article 104.1 of the Criminal Code of the Russian Federation, and shifting the priority toward the unavoidable real-time blocking of fund-withdrawal chains.

Experts highly rated the first package of anti-fraud measures (Federal Law No. 41-FZ of 01.04.2025), which established a self-ban on entering into telecommunications contracts without in-person presence, a ban on transferring SIM cards to third parties (except close relatives), a self-ban on spam calls, and mandatory labeling of calls from organizations. The «white lists» mechanism via the Unified Public Services Portal or a telecom operator, with the burden of proof placed on the call initiator, was recognized as an implementation of the constitutional right to privacy (Article 23 of the Constitution of the Russian Federation). The second package of measures (adopted in June 2026) introduced quantitative limits on debit cards (no more than five at one bank and no more than twenty in total per citizen), which is viewed as a direct tool to counter dropper schemes.

At the same time, the issue of end-to-end identification of ultimate users of corporate SIM cards remains unsettled. It was proposed to require legal entities by law to maintain a register of actual users with access provided to law enforcement agencies, and also to consider the possibility of joint and several liability for harm caused using such SIM cards.

In connection with the shutdown of illegal aggregators («Glaz Boga», «Solaris», and others), widespread violations of the Federal Law «On Personal Data» were identified. Draft bill No. 502104-8 to the Code of Administrative Offenses of the Russian Federation has been developed, providing for tougher liability for violations in this sphere, including turnover-based fines of up to 3% of annual revenue, and, for a data leak affecting more than 100 thousand data subjects, a fine of up to RUB 15 million. In parallel, the introduction of criminal liability for the unlawful collection, storage, and dissemination of personal data is being worked out.

Particular attention was paid to deepfakes: the current provisions (Article 159 of the Criminal Code of the Russian Federation, Article 152.1 of the Civil Code of the Russian Federation) do not take into account the specifics of voice and video synthesis. The participants proposed criminalizing the use of deepfakes for unlawful purposes, requiring the labeling of synthesized content, and treating the «digital persona» as a distinct protected intangible good.

The most heated debate concerned the limits of using AI in judicial proceedings. It was noted that neural networks are prone to «hallucinations», which calls into question the legal force of their conclusions. The administration of justice with the help of AI would directly contradict the principle of judicial independence (Article 120 of the Constitution of the Russian Federation, Article 17 of the Code of Criminal Procedure of the Russian Federation). Examples were cited from Western jurisdictions where, based on AI-generated conclusions, the status of judges and lawyers was terminated. The experts unanimously agreed that AI is permissible solely as an auxiliary analytical tool trained on verified court decisions, but not as a substitute for judicial discretion. The discussion recorded a shift from fragmented prohibitions to a coherent system for combating cybercrime.

The second package of measures adopted in June 2026 creates the necessary foundation; however, key challenges remain unresolved: the low effectiveness of recovering stolen funds, the absence of special regulation of deepfakes, and the risk of substituting judicial discretion with AI algorithms. Work on the relevant legislative solutions will continue.