Russian telecom and encryption clearances

A connected device going into Russia normally needs more than an EAC declaration. Equipment that attaches to a public communications network takes a conformity document in the communications certification system, generally shortened to FAC. Equipment that transmits on the radio spectrum needs an import conclusion from the radio frequency authority before customs will release it. Anything containing cryptography — which today includes almost any device with Wi-Fi, Bluetooth or an HTTPS client — needs a notification registered in the Eurasian Economic Union register, or, for the categories a notification does not cover, an import licence from the Ministry of Industry and Trade. These are separate permissions from separate authorities and they are obtained in parallel, not in sequence.

Three permissions that answer three different questions

The confusion in this area is almost always a category error. An EAC declaration says the product is electrically and electromagnetically safe. It says nothing about whether the device may attach to the public telephone or data network, nothing about whether it may radiate on a given frequency in Russian territory, and nothing about whether its cryptography may cross the border. Each of those is asked and answered separately.

The communications document — a declaration or a certificate in the communications certification system, depending on the equipment class — is what covers network attachment. Its scope is equipment used in public communications networks, and the classes that require a certificate rather than a declaration are set by regulation rather than chosen.

The radio frequency conclusion is the customs-facing one. Import of radio-electronic equipment and high-frequency devices needs a permissive document from the radio frequency authority, and without it a consignment stops at the border regardless of what else it holds.

The encryption notification catches far more than people expect

The instinct is that cryptography rules apply to security products. They apply to the mass market. A wireless speaker implements WPA2. A fitness tracker pairs over Bluetooth with link-layer encryption. A washing machine with an app talks to a server over TLS. All three contain cryptographic functionality within the meaning of the rules, and all three need the notification.

The notification is a registration rather than an approval. It is prepared for the specific product and its cryptographic functions, submitted to the FSB, and once registered it appears in the Eurasian Economic Union unified register — which means it works for import into any member state and not only Russia. It is the light route, and it is available where the cryptography falls inside the notification categories: standard published algorithms, limited key lengths, functionality that is ancillary to the product rather than the point of it.

Where it does not fall inside those categories the route is heavier: a single-use or general import licence from the Ministry of Industry and Trade, which itself requires an FSB expert conclusion behind it. That is a materially longer project, and the difference between the two routes is decided by the cryptographic specification of the product, which is a question for the firmware engineers and not for the compliance file.

The one thing that reliably goes wrong is timing. The notification is tied to the product and its manufacturer, and it is checked at the border. A device that shipped for two years on a notification, then had its wireless module changed in a cost-down revision, is a different product for this purpose.

Who can hold these, and what that costs later

As with EAC certification and state registration, the applicant has to be established in the union. A foreign manufacturer cannot hold a Russian communications document or a radio frequency conclusion in its own name, so the documents are raised by an importer, a subsidiary or an appointed representative.

The encryption notification is the exception worth knowing about: it is registered against the manufacturer and the product, and it is published, so the same registration supports imports by more than one party. The communications and radio documents are not published in that way and are held by the applicant.

That asymmetry is what usually decides the arrangement. Placing the notification with the manufacturer and the importer-side documents with an independent representative keeps the encryption registration portable while leaving the customs-facing permissions with a party that is not a competitor for the territory.

Each permission has its own page with the scope, the applicant and the failure points: the FAC certificate, the RF approval and the encryption notification.

What each document covers, and when it applies

These stack rather than substitute. A Wi-Fi router typically needs all five: the EAC declaration for safety and EMC, the communications document for network attachment, the frequency conclusion to clear customs, and the notification for its cryptography.