Russian President Vladimir Putin signed Decree No. 802 on November 2, requiring private data centers in the country to reserve 10% of their space and computing capacity, to be called on at a time chosen by a newly created government subcommittee. The decree took effect on publication and gives operators 10 days to complete the reservation. State bodies, municipal bodies and the enterprises and institutions under them are exempt.
A reservation is not the same as leaving capacity idle. Several Russian outlets that summarized the decree note that data centers can still use this capacity themselves in normal times. Once the subcommittee makes a decision, however, the operator must hand it over to designated Russian information resources within 24 hours. The capacity is not requisitioned for free, nor at market rates: the subcommittee sets a price cap, and the actual figure has not been published.
The same decree opens another door: the temporary use of computing capacity outside Russia. That requires a subcommittee decision and agreement with the Federal Security Service (FSB). The Ministry of Digital Development, for its part, is to take stock of idle space and computing capacity in data centers across the country, and then set mandatory requirements for reliability and uninterrupted operation.
October's attacks and August's order
Lining up the milestones of the past three months makes the origin of the decree fairly clear.
- August 24: Putin signed Decree No. 604 to strengthen the security of critical infrastructure, covering commercial and departmental data centers as well. Companies that fail to protect or restore their facilities can have their property temporarily placed under state management.
- October 8, 9 and 11: Yandex data centers in Sasovo, Kaluga and Vladimir were hit by drone attacks, disrupting some services and Russian-language web resources.
- October 14: A Sber data center in Balakovo, Saratov region, was attacked; the company said its systems were running normally. The same day, Digital Development Minister Shadayev said the ministry was helping Yandex find backup sites to move critical systems.
- October 18: A VK data center in the Leningrad region was attacked.
- November 2: Decree No. 802 was published.
Russian media also reported that the Ministry of Digital Development has recommended building critical data centers underground to "reduce the chance of detection from the air." Rostelecom has already begun, and experts estimate the cost is 30% to 40% higher. Going underground will take years; the 10% reservation is the faster fix for now.
The overseas clause meets data localization
Current Russian law requires services that collect citizens' personal data to use databases located in Russia. According to Novaya Gazeta, an e-commerce association whose members include Ozon and Wildberries had earlier asked for permission to move critical systems of affected services to data centers abroad.
The decree cites "unfriendly actions by certain foreign states" as its rationale and states that foreign capacity may only be used temporarily. How long "temporary" means, which countries are eligible, and whether the localization requirements for personal data will be relaxed at the same time have not been addressed in any of the reports so far.
Do large AI models count as the "most important resources"?
Of the three companies hit, Yandex and Sber are also leading players in Russian large language models, with YandexGPT and GigaChat respectively. In the publicly available summaries, the capacity to be called on is described only as "Russian information resources"; there is no distinction between general-purpose compute and GPU clusters, and nothing on where model inference and training workloads would rank.
For private operators, the difficulty is that the reserved portion normally still runs customer workloads. Once a decision arrives, it must be freed up within a day, and the summaries do not say how contracts with existing customers would be handled or who would bear compensation. The government must also separately draw up the subcommittee's rules of procedure and decision-making process. Until those details appear, the only things operators can be sure of are the 10% and the 24 hours.
Sources: Reuters, RBC, CocoLoop, Novaya Gazeta, Expert, vc.ru. Decree provisions are as summarized by the outlets above; reports of the attacks come from Russian media and statements by the companies concerned.