Ukraine strengthens control over software products

New draft law banning hostile software: Ukraine strengthens control over software products and informatization tools

The Verkhovna Rada of Ukraine has registered a draft Law "On the prohibition of the use and distribution of hostile software products and hostile informatization tools", submitted by People's Deputy O.P. Federatsko (certificate No. 89) and other parliamentarians. This document is aimed at strengthening national security in the digital sphere, in particular by restricting the use of software and equipment linked to aggressor countries. The draft law is a logical continuation of the policy launched earlier, in particular by Decree of the President of Ukraine No. 601/2024, which already recognized BAS software products as russian software and banned their use not only in the public but also in the private sector.

Main provisions of the draft law

According to the draft, the law defines the key terms for regulating this area. "Hostile software product" — software that meets at least one of the criteria set out in Article 3. Similarly, "hostile informatization tool" is defined by the criteria of Article 4. Other terms, such as "author", "computer program", "website", "distribution", use the definitions from the Law of Ukraine "On Copyright and Related Rights". Reference is also made to laws on economic competition, the national informatization program, sanctions, and critical infrastructure.

The scope of the law covers legal relations and restrictions on the use and distribution of such products. In particular, Article 2 defines the legal relations related to the use and distribution of software products and informatization tools that meet the hostility criteria.

Hostility criteria for software products (Article 3):

1. The product is created by or belongs to citizens or legal entities of aggressor countries (e.g., russia), occupying states, or countries subject to sanctions.
2. The author of the computer program is a citizen of such states.
3. The ultimate beneficial owner is linked to these countries.

The National Bank of Ukraine and the Security Service of Ukraine submit proposals to the State Service of Special Communications and Information Protection regarding amendments to the lists of hostile products within their regulatory areas.

Criteria for informatization tools (Article 4):

1. Communication (network) equipment included in the open list of banned equipment in accordance with the Law "On the Fundamentals of National Security of Ukraine".
2. An account on such equipment that provides access to computer programs or equipment with the ability to make changes, additions, deletions, etc.

Similarly, the NBU and the SBU submit proposals regarding the lists.

Prohibitions and restrictions (Article 5):

1. It is prohibited to use hostile products and tools in state bodies, local self-government bodies, military formations, critical infrastructure enterprises, and entities exercising government authority.
2. Individuals and legal entities, business entities (other than state ones) may continue use subject to the restrictions established by this law and the Law "On Sanctions".
3. Business entities providing services to state bodies are also obliged to avoid hostile software.

Liability (Article 6):

1. Business entities that violate the ban on the sale, use, or distribution of hostile products bear liability in accordance with the law.

The draft law provides for amendments to other laws, in particular the laws on the Security Service of Ukraine, the National Bank, and the State Service of Special Communications. The Cabinet of Ministers of Ukraine must bring regulatory acts into compliance within three months after the law enters into force, and by January 1, 2030, inform the Verkhovna Rada about its implementation.

Connection to previous decisions: Decree No. 601/2024 and the ban on BAS

This draft law develops the policy launched by Decree of the President of Ukraine No. 601/2024 of September 2, 2024, which put into effect the decision of the National Security and Defense Council on the application of sanctions. According to the decree, the 1C and BAS software products were recognized as hostile software of russian origin. The sanctions include a ban on state procurement, use, and distribution of these products in Ukraine. Importantly, the ban applies not only to the public sector but also to the private sector: businesses are advised to switch to alternatives to avoid risks to national security.

BAS, as the Ukrainian adaptation of the russian 1C accounting system, came under sanctions due to ties with developers from the russian federation. Experts note that such software may pose a threat due to potential vulnerabilities for cyberattacks or data leaks. The decree has already forced many companies to look for replacements, such as domestic or Western ERP systems.

Consequences for business and society

The adoption of the law could significantly affect Ukraine's IT sector. State institutions and critical infrastructure operators are required to conduct an audit and switch to secure alternatives. For the private sector, although a direct ban does not always apply, recommendations and sanctions create pressure for modernization. Experts predict growing demand for Ukrainian and European software solutions, which will stimulate the local IT market.

However, critics point to possible difficulties: the transition may be costly for small businesses, and vague criteria of "hostility" risk leading to abuse. The draft law still has to go through discussion in the committees of the Verkhovna Rada, where amendments may be made.

In the context of the ongoing war with russia, this law is part of a broader strategy of deoccupying the digital space, similar to the ban on russian social networks in 2017. If the document is adopted, it will become a powerful tool for protection against hybrid threats.