New developments in AI regulation in Ukraine: cybersecurity recommendations for AI-powered systems
Oleksandr Kozhukhar
AVELLUM, Kyiv
okozhukhar@avelum.com
Olha Rudevych
AVELLUM, Kyiv
orudevych@avellum.com
Mariia Hrusheva
AVELLUM, Kyiv
mhrusheva@avellum.com
Diana Nykyforchyn
AVELLUM, Kyiv
dnykyforchyn@avellum.com
Introduction
Ukraine is still shaping its artificial intelligence (AI) legislation, with the first steps in that direction already well underway.
On 23 February 2026, the State Service of Special Communications and Information Protection of Ukraine approved recommendations on cybersecurity for information and communication systems that use AI technologies.[1] The recommendations were developed pursuant to the government’s roadmap for the 2025–2026 AI Development Concept, approved by the Cabinet of Ministers in May 2025.
This marks another step in building Ukraine’s regulatory framework for AI. Although the recommendations are advisory in nature and do not have binding force, they help shape the framework for general AI regulation before binding AI legislation comes into force.
Scope of application
The recommendations are addressed to the owners and/or operators of information, electronic communication, information and communication systems and technological systems in the public and private sectors that use AI. They are recommended for use when identifying and assessing cybersecurity risks, as well as when developing cybersecurity plans.
Key takeaways
The recommendations are comprehensive in scope. They cover both preparatory organisational measures to be taken before deploying AI systems and a detailed taxonomy of cyber threats, together with corresponding mitigation measures for each category.
Preparatory measures
Before implementing cybersecurity measures, the recommendations suggest that the objectives of using AI should be defined and its effectiveness should be benchmarked against alternatives that do not rely on AI; that qualified specialists should be engaged to carry out the relevant administration, regular testing and updating of AI models; that data quality and relevance should be ensured through the use of appropriate metrics and audit procedures; and an AI usage policy should be developed based on ethical principles in compliance with the applicable legal requirements.
Threat taxonomy
The document identifies seven categories of cyber threats specific to AI-powered information communication systems, including attacks on AI technology supply chains, prompt injection attacks designed to bypass safeguards, data leaks and unauthorised access to models or training data. The recommendations propose a set of mitigation measures for each category of threats.
Status and outlook
As of now, the recommendations do not have the force of a binding legal act and are purely informational and advisory in nature. They do not establish legal obligations and are voluntary in regard to their use. The document is recommended to be applied in conjunction with specialised international AI risk management standards, such as ISO/IEC 23894:2023, ISO/IEC 42001:2023, NIST SP 800-218A and the US Department of Commerce National Institute of Standards and Technology’s AI Risk Management Framework.
The recommendations are a telling example of how Ukraine’s regulatory landscape for AI is gradually taking shape. Although their application is voluntary, adherence to such standards can help a company not only prepare for any future binding requirements, but also build a strong culture of AI and cybersecurity risk management today, demonstrating a company’s alignment with recognised international best practices in risk management, responsible use of AI technologies and the implementation of a systematic approach to ensuring the safety and reliability of AI systems.