Canada expands Russia sanctions to cybersecurity, AI and data firms
Canada has added Russian cybersecurity, software, artificial intelligence and digital infrastructure companies to its sanctions list, in a package announced Feb. 24, the fourth anniversary of Russia's full-scale invasion of Ukraine. The amendments to the Special Economic Measures (Russia) Regulations took effect Feb. 19.
The move extends Canada's sanctions beyond banks, energy and arms makers into the technology firms that support Russia's hybrid warfare, including offensive cyber capabilities. It follows Ottawa's first-ever listings of cyber infrastructure suppliers in November 2025.
What changed
According to a summary by law firm Baker McKenzie, the most notable additions were to Part 2 of Schedule 1, which targets entities tied to Russia's military and hybrid-warfare activity. New listings include AI research institutes and alliances, technology firms supporting drone production and battlefield surveillance, cybersecurity and software companies involved in defensive and offensive digital capabilities, and digital infrastructure providers, including data-processing and cryptocurrency-related firms. Individuals tied to financial and procurement networks and dual-use technology were added to Part 1.
The package also listed 100 more shadow fleet vessels and lowered the price cap on Russian crude oil, the firm said.
Building on November
On Nov. 12, 2025, Foreign Affairs Minister Anita Anand announced sanctions on 13 individuals and 11 entities, including, for the first time, entities that supply "the cyber infrastructure used in Russian hybrid strategies against Ukraine," according to the Global Affairs Canada release. That release did not name the cyber-related entities or give a separate count. Anand said Canada would keep intensifying pressure in co-ordination with allies until Russia ends the invasion.
What it means
Listed persons are subject to a dealings prohibition, which effectively freezes any assets they hold in Canada. Canadians and people in Canada also have disclosure duties for certain property held by listed parties, Baker McKenzie noted.
For Canadian technology companies, that means checking resellers, software vendors, hosting providers and cloud partners against the updated schedule.
What we don't know yet
Public summaries of the February package do not give the full list of names or the number of technology entities added. Compliance teams should consult the official amended schedule rather than secondary summaries.
What to do
- Screen suppliers, resellers and partners, including software and hosting vendors, against the Consolidated Canadian Autonomous Sanctions List.
- Review any use of Russian-made security or data-processing products and get legal advice on existing contracts.
- Check whether you hold property of a listed person, which triggers disclosure duties under the regulations.
