AI Law 243-FZ and contracts with contractors: what to change by 2026

Federal Law of 26.07.2026 No. 243-FZ (“On support for the development of artificial intelligence technologies…”) takes effect on 1 September 2026. For most companies this is not a “ban on ChatGPT”. It is a signal: AI is already in sales, support, marketing, and even in preparing contracts — and responsibility for data, the result, and errors is still on the business. Below is what it makes sense to write into contracts with contractors and vendors, and into user documents.

In short, the law is mainly about large foundation models (from ~1 billion parameters) and support measures. The adopted text has no mandatory labeling of all AI content. The main working risks for a business are still in 152-FZ, copyright, and ordinary civil liability. This is a guide, not a substitute for a lawyer’s advice.

You already have a contract with a contractor for texts, code, support, or “AI implementation”? Run it for risks before September:

Check the contract Create a draft

What to understand before you edit contracts

The law does not regulate every algorithm. It is aimed first of all at large foundation models
An ordinary business remains the personal-data operator, even if a third-party neural network “does the thinking”
A contract between you and the vendor does not remove liability to the client and to Roskomnadzor
If you give users access to a neural network, by 1 March 2027 the user terms must describe the rights to the generated result (Article 10(1) of 243-FZ)

1. A contract with a contractor who “does it with AI”

Marketing, copywriting, support, development, document review — a typical 2026 scenario. Fix in the contract:

Whether generative models may be used, and which ones (corporate / public / on-prem only)
A ban on sending client personal data, trade secrets, and the full text of contracts into the model without anonymisation
Who owns the rights to the result: texts, code, images, prompts, revisions
A duty of the contractor to say if the result was created with AI (if that matters to you for labeling or for the customer)
Warranties: the result does not infringe third-party rights; there are no hidden “borrowings” from other people’s materials
Liability for a model error: who corrects it, who pays a third-party claim

A related frame for contractors: a contract for a freelancer, a contract with a self-employed person.

2. A contract with an AI vendor or integrator

Roles under 152-FZ: you are the operator, the vendor is the processor (or the reverse — if that is how the scheme is built)
An instruction to process personal data, localisation, subprocessors, retention period, and deletion
Whether your data is used to fine-tune the model (by default — prohibit it)
Where inference runs and where logs are stored (Russia / abroad)
Liability caps and insurance — otherwise “we are not liable for the model’s answers” leaves you alone with the client
Incident procedure: a leak, a false answer, a service block

The counterparty sent its own SLA/DPA version? Compare it with yours, or with the previous version:

Compare two contract versions Check the contract

3. Offer, user agreement, consents

If the product gives the user access to a neural network, or automatically processes applications and correspondence:

Who owns the rights to the generated result, and on what terms it may be saved or exported
What counts as the user’s input data, and how it is processed
Consent to automated processing of personal data — in separate, plain wording
Limits: decisions with legal consequences for a person should not be “the algorithm only”, with no human in the loop (the logic of Article 16 of 152-FZ)

4. If AI helps check or prepare contracts

Services such as DocumentCHEK speed up risk screening, but they do not replace a party to the deal or a lawyer. An internal rule, or a contract with a law firm, is worth adding:

Which documents may be uploaded to a cloud AI, and which only after anonymisation
Who makes the final decision on comments in the report
How source files and reports are stored

What is visible in the preview, and where a review cites the wrong article: checking a contract with AI.

A mini-checklist of edits before September

Contracts with contractors have a block on AI, personal data, and rights to the result
The vendor contract prohibits fine-tuning on your data (unless agreed otherwise)
There is an instruction to process personal data / a security annex
The offer/ToS makes the rights to generation clear (especially if you give access to a model)
Consents and the personal-data policy mention automated processing
An internal rule: what must not be fed to public neural networks

Short conclusion

By September 2026 it matters more to close the gaps in contracts than to “learn 243-FZ by heart”: data, rights to the result, liability for a model error, and roles under 152-FZ. The law sets a frame for large models; money and claims are still decided by your wording with contractors and vendors.

Check or assemble a contract for AI risks

DocumentCHEK will help find one-sided terms, vague liability, and gaps on rights to the result — or assemble a draft from a brief.

Check the contract Draft a contract

The counterparty sent edits? Compare two versions.

The AI law (243-FZ) and contracts: what to change in work with contractors by September 2026