Industry

AI and information security for the public sector

RESTART implements AI services for government agencies, subordinate institutions and companies with state participation. The platform, integrations and information security are in the customer’s secure environment.

Discuss the challenge Case studies

Hero-picture for the page “AI and information security for the public sector”

Sovereign AI for Government

Government bodies, subordinate institutions and companies with state participation are moving from experiments with AI to applied services. For the state environment, such services have three mandatory conditions - Russian models, work within the customer’s perimeter and demonstrable compliance with information security requirements.

Artificial intelligence for the public sector helps to check documents, prepare draft responses to citizens and find information in departmental knowledge bases. RESTART AI Enterprise Platform combines these services with Russian models, access roles and request and response logs.

Information security of the public sector is part of the same project: protection of GIS, CII and personal data, design and implementation of security measures. Decisions affecting citizens are approved by the employee.

Download presentation (PDF)

AI in public administration is a government priority

State agenda

“To achieve frontal implementation in industry, transport, healthcare, government administration, and other sectors.”
Vladimir Putin · AI Journey conference · 11/19/2025 · >Speech on kremlin.ru

“The pace of implementation of these technologies in the regions should become the most important indicator of the annual digital transformation ranking.”
Vladimir Putin · AI Journey · 11/19/2025 · >Speech on kremlin.ru

“...there are areas of activity, partly public administration, partly the work of special services, the work of law enforcement agencies, where we must rely exclusively on our own basic developments.”
Vladimir Putin · AI Journey · 11/19/2025 · >Speech on kremlin.ru

What does this mean in practice?

National AI Implementation Plan
In sectors of the economy, social sphere and public administration, at the federal level and at the level of constituent entities. Instruction Pr-22, clause 1b, deadline - 06/01/2026.
Rating of digital transformation of regions
By the end of 2026, the parameter characterizing the development and use of AI is taken into account as a priority. Pr-22, item 1c.
Law No. 243-FZ
“On supporting the development of artificial intelligence technologies in the Russian Federation” - entered into force on September 1, 2026; introduces the concepts of sovereign and national AI models.
FSTEC Order 117: trusted AI technologies
Order of the FSTEC of Russia No. 117 dated 04/11/2025 is valid from 03/01/2026 for information systems of government agencies, enterprises and institutions: AI technologies as part of the IS must be trusted; the rules for requests and responses and acceptable topics are determined.

Sources: >list of instructions Pr-22 dated 01/03/2026; >243-FZ dated July 26, 2026; FSTEC of Russia - order No. 117 dated 04/11/2025.

Government Apparatus Pilot

Based on the results of the six-month pilot, about 80% of participants actively used AI services; services are scalable to all departments and will become available to federal and regional authorities through the State Automated System “Management”. 40 AI services are in operation.

Sources: Kommersant, 06/15/2026; "Vedomosti", 07/07/2026.

Demand has shifted from experiments to applied services - on Russian models, in a protected environment and with a measurable contribution to performance.

Seven directions of tasks

From checking documents when providing services to protecting information systems. For each direction - applied problems and RESTART solutions.

Capability 1

AI document verification

Verification of documents on the regional government services portal and upon admission to the MFC.
Verification of documents in social security, educational services and for the “Resident Card”.
Verification as a service: API for any GIS region.

What we decide: Document AI recognizes the document type, extracts details and tabular parts, checks data against registers and checks the completeness of the package. Refers doubtful cases to an employee with an explanation of the reason; connects to any GIS via the MCP server API.

We start with a pilot on one type of service with measurable criteria.

Capability 2

Citizens' appeals, speech and knowledge

Analytics of requests: subject, priority, route, frequency.
Draft answers to regulatory documents and knowledge base with reference to the source; The final answer is approved by the employee.
Speech analytics for System-112 and MFC call centers: speech recognition, call topics, script control.
Search by regulations indicating the document and version.

What we decide: AI Service Desk — analytics of requests; VoiceHelp - speech; Knowledge AI And Ragify — answers from knowledge bases.

Capability 3

Documents, archives and data

Recognition of primary documents, for example in RGIS ESUP: extraction of attributes and transfer to accounting systems.
Digitization and indexing of archives; handwritten text - through pilot and spot check by human.
Forecast of the load on the MFC and departments based on data from past periods.
Proactive services based on data from the register of beneficiaries and the “Resident Card”: AI prepares an offer to the citizen, the decision is made by the employee.
Minutes of meetings: decisions, responsible persons and deadlines.

What we decide: Document AI — primary documents; Data, BI, DWH — working with data and analytics; Restart AI Enterprise Platform — AI scenarios; Meeting Hub — automatic recording of decisions, responsibilities and deadlines.

Capability 4

Personal data

Audit of PD processing and register of processes.
Destruction of personal data at the request of a citizen and upon expiration of the storage period.
Depersonalization, requests from personal data subjects and notifications from the regulator.

What we decide: diagnostics CII / Federal Law No. 152-FZ provides a systems map, a requirements applicability matrix, a nonconformity register, and a draft threat model. Masking and depersonalization are applied before data is transferred to the model and test environments. Security & GRC AI helps maintain a register of processes, monitor deadlines and prepare draft responses to subjects. Basis of work - protection of ISPDn according to Federal Law No. 152-FZ.

Capability 5

Managed IP Landscape

Inventory and certification of information systems.
Register of regional information systems.
IP life cycle regulations and standard requirements for contractors.

What we decide: diagnostics CII / Federal Law No. 152-FZ — map of systems and requirements; IS compliance — regulatory requirements and documentation. AI certification assistant for RESTART platform prepares draft IP passports based on documentation and inventory data.

Capability 6

Protection of GIS and CII

Survey, threat model, HLD/LLD design, implementation of information security and cryptographic information protection systems.
Preparation for the requirements of FSTEC order No. 117 and Federal Law No. 187-FZ.
Monitoring, checklists, reporting and incident analysis.

What we decide: GIS protection, protection CII / Federal Law No. 187-FZ, design of SZI / HLD and LLD And supply of information security and cryptographic information protection systems. Security & GRC AI — checklists, reporting and incident analysis.

Capability 7

Property and assignments

Accounting for state property.
Document flow and electronic approval.
Control and executive discipline: decisions, responsibilities and deadlines.

What we decide: ERP, 1C and SAP — accounting environment; development and integration — departmental systems and document flow; Meeting Hub — minutes of meetings and instructions. If the loop uses SAP, transition to 1C includes working with historical data, integrations, access rights and control procedures.

A single platform for departmental AI services

In the RESTART AI Enterprise Platform, models, knowledge base, agents, integrations and auditing run on top of a common core. Each AI service knows its data sources, user roles, access restrictions, and process owner. The platform includes 10 modules: knowledge bases, requests, documents, finance, contracts, information security, HR and industry scenarios.

Within the customer's perimeter

On-premise, private cloud or hybrid; the data does not leave the loop.

Model selection

GigaChat, YandexGPT or open-source models in the perimeter. The model is selected in the control panel.

Control and audit

Roles, log of every request and response, human review for decisions affecting citizens.

Settings in the browser

The customer's team downloads regulatory documents and regulations, sets up example phrases, switches models and marks unsuccessful answers.

EDMS, GIS, registers, public services portal, 1C, System-112 and archives are connected as MCP server tools. Access rights, confirmation of actions and audit trail pass through one point of control; new systems can be connected without reworking the kernel.

Learn more about RESTART AI Enterprise Platform

Trusted AI: from requirement to implementation

Requirements and ways to ensure them in the AI environment
Requirement	How provided
243-FZ - sovereign and national models	Russian models or open-source in the perimeter; selection in the control panel.
FSTEC Order No. 117 - trusted AI technologies, rules for requests and responses, acceptable topics	Answers only from the approved knowledge base; templates for typical operations; topic limitation; log of requests and responses.
Federal Law No. 152-FZ - personal data	Masking before transfer to the model; access roles; removal upon request.
Federal Law No. 187-FZ - CII	Placement in the perimeter; AI loop threat model; HLD/LLD.
Decisions affecting citizens	Human verification: AI prepares, employee approves.

For a specific system, we determine the applicability of the requirements. The CII/Federal Law No. 152-FZ diagnostic includes a systems map, an applicability matrix, a register of nonconformities, and a draft threat model.

Licenses and statuses

The RESTART group has been operating since 2015: 100+ specialists, 50+ projects. RESTART LLC is responsible for AI platforms, information security, integration and development; Invent LLC - for 1C, 1C-Bitrix, ERP and SAP → 1C migration; Innostaff - for engineering and dedicated teams, R&D.

License of FSTEC of Russia No. L024-00107-77/06731588 dated 09/07/2026, indefinitely - technical protection of confidential information. Types of work d1, e4, e5, e6: protected design; installation, commissioning, testing of information security equipment.
License of the FSB of Russia No. L051-00105-00/05918757 dated 08/07/2026 - activities related to encryption (cryptographic) means.
State IT accreditation by the Ministry of Digital Development of Russia — confirmed 08/28/2026.
ISO 9001:2015 (GOST R ISO 9001-2015), software development - certificate No. FSK.RU.0002.F00043950, until 07/16/2029.
Accredited private employment agency — registration number A006-00124-77/05592414.
Authorized partner of SafeTech Lab for corporate PKI - certificate No. 2026-010.
Partner 1C and 1C-Bitrix - Invent LLC.

Statuses are checked in open registers. Certification tests of informatization objects are carried out by an organization with an appropriate license; We are preparing the object for certification.

Licenses and supporting documents

Experience in government and regulated environments

Administration of the President of the Russian Federation — automated system for managing federal property objects.
Ministry of Defense of Russia · JSC "Slavyanka" — a unified register of military camps, execution of government contracts.
State Corporation "Rosatom" — management of non-core assets, planning of real estate transactions.
Post office — AS UNIP and real estate management regulations.
Federal executive authorities — EDI subsystem: control and execution discipline, electronic approval.
Federal operator of digital marking — static analysis of the code of the OS being certified.
JSC "UEC" Sber, VTB, Rosselkhozbank — property, financial and accounting contours of companies with state participation.
Rostelecom — Tessa EDI subsystem: approvals, incoming and outgoing documents, route control.
VTB: ALM platform and support service — managed development and support, transparency of work and change control.

Industrial AI: bank from the top 5 of Uzbekistan

AI agent platform: 3 knowledge bases, 6 access channels. Pilot for 2 months, then commercial operation.

Case of an AI agent platform for a bank

Start format: four entry packages

We select a package for the initial task: define AI scenarios, examine a protected environment, check an AI already in use, or launch a knowledge base. Budgets are indicated without VAT.

Deadline, budget and result of the input package
Plastic bag	Term	Budget without VAT	Result or task
AI-discovery	10 working days	600 thousand – 1.2 million ₽	Registry of AI scenarios, data and information security readiness, pilot concept, decision to “launch or not.”
Diagnostics CII / Federal Law No. 152-FZ	10–15 working days	750K – 1.5M rubles	Systems map, requirements applicability matrix, nonconformity register, draft threat model.
Secure AI audit	10 working days	700 thousand – 1.4 million ₽	Audit if AI is already in use.
RAG pilot	4–6 weeks	700 thousand – 3 million ₽	Knowledge base based on real documents.

After the entrance stage

Pilot on one service

2 months on the selected process.

Measuring the effect

Comparison with baseline indicators.

Replication

Expansion to departments and municipalities.

Frequently asked questions

Is it possible to use AI with data from government systems?

Yes, if the service operates within the customer’s perimeter, on trusted technologies and with specified request and response rules, as required by FSTEC Order No. 117. The platform is hosted on-premise, in a private cloud or hybrid; the data does not leave the loop.

What models can be used?

GigaChat, YandexGPT or open-source models in the perimeter. Connecting and switching models is available to the customer’s team in the control panel without developers.

Who approves the response to the citizen?

Employee. AI prepares a draft response based on regulatory documents and knowledge base with reference to the source. Decisions affecting citizens are subject to human review.

Can existing departmental systems be connected?

EDMS, GIS and regional registers, public services portal, 1C, System-112, call centers and archives are connected as MCP server tools. New systems are connected without reworking the kernel, AI actions pass through one control point.

Does RESTART conduct qualification tests?

RESTART prepares the object for certification. Certification tests of informatization objects are carried out by an organization with an appropriate license.

What to prepare for the first conversation?

Description of systems, process owners, current problems, security restrictions and desired results. Then we agree on the project boundaries, data, roles, deadlines and acceptance procedures.

Let's discuss priority service

We will show the platform on a demonstration environment, select one service for the pilot and fix the criteria for the effect.

Discuss the challenge with RESTART