A Standards Body for an Unstandardized System
On April 19, 2026, Moscow's Department of Information Technology and the city's newly established Unified Center for Biometric Testing (Единый центр биометрических испытаний, ECBI) ran the first formal benchmark of domestic Russian facial-recognition algorithms. Seven solutions from five companies — four Moscow firms and one from Chelyabinsk — were measured against a 750,000-image reference database using live feeds from city CCTV, evaluated for performance on faces in glasses, half-turn poses, and false-positive rates. Deputy DIT head Dmitry Golovin said the test was conducted in "real, not laboratory conditions," and that ECBI would run such tests regularly going forward. ECBI itself was formally stood up in March 2025 as a joint operation between the Moscow DIT and the non-profit Russian Biometric Society, with a mandate to develop testing methods aligned with national standards and publish the results openly. In March 2026, the same coalition shepherded through Russia's first national GOST standard for rating biometric algorithms, designed to let buyers "objectively compare different vendors' solutions."
The Steelman: Public Benchmarks Are Not the Problem
Standardized, transparent algorithm testing — done well — is one of the more defensible interventions a state can make in this market. Civil-liberties groups have long argued that the most common operational harm from facial recognition is misidentification: a false match leading to a wrongful detention. A published technical floor, comparable across vendors, makes that harm easier to measure and easier to litigate. NIST's Face Recognition Vendor Test plays the same role in the United States and is routinely cited by privacy advocates who otherwise oppose police use of the technology. A public benchmark also makes it harder for a vendor to oversell — useful for the market and useful for the courts that increasingly admit algorithmic identifications as evidence. The instinct to professionalize the procurement layer of an existing surveillance system is not, in isolation, an authoritarian move.
But Standardization Is Not Accountability
The problem is the layer the new standard does not touch. Russia operates one of the world's largest facial-recognition deployments, with the federal AI-surveillance build-out budgeted at 11.2 billion rubles (~€111 million) for 2024–2026 and the camera network projected to approach five million devices by 2030. The legal framework governing how that footage may be searched, retained, or used as evidence is materially thinner than the technical framework now being layered on top of it. Russia's 2017 Federal Law No. 482-FZ and the 2022 Unified Biometric System reforms cover identification for banking and government services, but neither imposes a warrant requirement, a meaningful retention limit, nor a judicial-oversight layer on the use of facial recognition against people moving through public space — a gap that a peer-reviewed 2022 analysis in European Proceedings flagged as a direct contradiction with Russia's own personal-data principles.
The operational record of the last two years is the strongest evidence of that gap. After Alexei Navalny's funeral on March 1, 2024, multiple attendees were arrested in the following days — detentions that Russian rights groups attributed to Moscow's CCTV-and-FRT pipeline. In October 2025, the Civil Alliance of Russia documented police using facial recognition in the Moscow Metro to detain men who had filed court challenges against their conscription orders, with enlistment offices flagging the challengers' data so that any camera hit triggered an automatic stop. Human Rights Watch had already characterized this trajectory five years ago, warning that Russian law "does not regulate the use of such technology, except in banking" and calling for the public-space rollout to halt until basic safeguards were in place. The 2026 ECBI tests close a quality-assurance gap on top of an unresolved rights gap.
What Proportionate Regulation Would Actually Look Like
A pro-innovation framework for this technology does not require banning it; several democracies that have deployed FRT — including the UK, France's experimental Olympic-period regime, and several US states — have begun to converge on a core checklist. Independent statutory authorization, not just an administrative order, for any operational use against the public. A warrant or judicial-officer sign-off threshold before retrospective searches of stored footage. Hard retention limits on raw video and on match logs. Mandatory transparency reports — how many searches were run, how many produced matches, how many ended in detentions, how many of those detentions were later released without charge. Carve-outs that explicitly forbid use against constitutionally protected activity such as peaceful assembly, religious gatherings, or legal proceedings against the state. A judicially reviewable mechanism for individuals to challenge their inclusion in any reference database. ECBI's accuracy benchmarks are necessary; none of these protections are present in the new regime.
The Wider Lesson
The Russian case is an unusually clean illustration of a problem that is creeping into more permissive jurisdictions as well: when the technical-governance institutions of an AI system mature faster than the rights-governance institutions, the former end up legitimizing the latter by default. A vendor that has cleared ECBI's published threshold can credibly market its algorithm as state-certified, even if the deployment context — open access to live feeds with no judicial check — is the actual source of the harm. The same dynamic is visible in Russia's parallel plan, reported in late 2024, to wire the Unified Biometric System into CCTV for automated enforcement of petty administrative offences. With roughly 75 million biometric samples already on file in the UBS, the procurement-quality layer is racing ahead of the rules-of-use layer.
The April 19 tests are best read as a procurement reform, not a governance reform. They tell Moscow's buyers which algorithm is most accurate; they say nothing about who may run it against whom, for what purpose, or with what recourse. For other governments watching Russia's playbook — and there are several — the lesson is straightforward: standardizing the model without standardizing the rules around its use is not modernization, it is consolidation.