As in previous years, Ukraine’s TMT regulatory framework continues to evolve, even amid the wartime challenges. The overarching legislative objective remains largely the same – alignment of Ukrainian law with the EU legal framework, particularly in areas shaped by digital transformation and technological advancement.
In many respects, Ukraine is uniquely positioned to observe how long-standing EU regulations function in practice. This helps Ukrainian policymakers to implement similar rules with the benefit of hindsight – tailoring them to local needs and mitigating unintended consequences. This approach is already evident in Ukraine’s strategy toward AI regulation, and we expect a similar trajectory in the planned data protection reform. Notably, the contemplated data protection law may go even further than the EU acquis by addressing areas the GDPR leaves unregulated.
These developments require close and continuous monitoring to anticipate likely implementation timelines and the direction of future reforms.
- Data protection
The key legislative act governing data protection in Ukraine continues to be Law of Ukraine “On Personal Data Protection” No. 2297-VI. This law was adopted over a decade ago and is based on the now-outdated EU Directive 95/46. Ukraine is now in the process of a major legislative overhaul to align its data protection standards with the GDPR. A new draft law No. 8153, which aims to implement its principles, has been adopted in the first reading and is awaiting further parliamentary review.
Under the current data protection framework, the processing of personal data must comply with certain general data protection principles, including lawfulness and transparency. Accordingly, one of the key obligations for data controllers includes ensuring a valid legal ground for processing (such as the individual's consent, the performance of a contract, or compliance with a legal obligation).
The adoption of the new law will introduce significant changes, including mandatory data breach notifications to both the regulator and affected individuals, requirements for data protection impact assessments, and substantially higher fines for non-compliance.
- E-communications
The electronic communications sector in Ukraine is now regulated by Law of Ukraine “On Electronic Communications” No. 1089-IX (the “EC Law”), which entered into force on 1 January 2022. The EC law establishes a modern regulatory framework with a primary goal of aligning Ukrainian legislation with the European Electronic Communications Code.
A significant reform introduced by the EC Law is the shift from a licensing-based system to a simpler general authorisation model. Businesses seeking to provide electronic communications services are now only required to submit a notification to the national regulator upon commencing their activities.
In addition to this major shift, the EC Law establishes several other key principles and requirements, including:
- an obligation for access and interconnection, requiring service providers to negotiate the interconnection of their networks to ensure end-to-end connectivity. The regulator is empowered to intervene and mandate fair terms if parties cannot reach an agreement;
- strengthened consumer rights, granting end-users the right to receive comprehensive pre‑contractual information, retain their phone number when switching providers (number portability), and be protected from unsolicited messages (spam); and
- a modern approach to spectrum management, implementing principles such as technological neutrality and the ability to transfer spectrum usage rights between providers (known as spectrum trading).
It is also important to note that the functioning of the e-communications framework is currently impacted by the special legal regime of martial law. Under these conditions, a central operational body (NTNOC) is vested with broad powers to manage all public networks, including issuing binding orders to providers to prioritise traffic for defence needs or restrict access to certain internet resources.
- Consumer protection
On 10 June 2023, the Parliament of Ukraine adopted Law of Ukraine “On Consumer Protection” No. 3153‑IX (the “CP Law”), which aims to harmonise Ukrainian consumer protection laws with the EU standards and is meant to replace the current consumer protection law adopted back in 1991.
The CP Law expressly imposes consumer protection requirements (which include specific pre-contractual information obligations) on key e-commerce players – marketplaces, classifieds and price aggregators.
The CP Law also lays down the framework for establishing the Unified State Web Portal for Consumers in E-Commerce (the “E‑Consumer Portal”), which is expected to be launched by 2026. The E-Consumer Portal will be a publicly available online platform designed to, among others, facilitate interactions among consumers, traders and consumer protection authority. For example, via the E-Consumer Portal, consumers will be able to file complaints if their rights are violated in e-commerce transactions. They will be able to track the progress and outcomes of their complaints through that Portal.
In addition to strengthening consumer protections in the e-commerce sector, the CP Law:
- introduces mandatory guarantee periods depending on the category of the purchased goods (e.g., two years for new goods, including digital products). Traders can also provide commercial guarantees;
- offers significant safeguards against unfair commercial practices (the activities that hinder consumers from making fully informed and free decisions); and
- grants the consumer protection authority additional powers to address violations of consumer rights. For instance, the relevant authority can request internet service providers to restrict access to websites of traders that fail to disclose their name and/or location.
Most provisions of the CP Law will become effective after the date of termination or cancellation of martial law in Ukraine. Provisions regulating E‑Consumer Portal will apply after such Portal is launched.
In parallel, on 2 March 2024, Law of Ukraine “On Digital Content and Digital Services” No. 3321-IX (the “Digital Content Law”) entered into force. It implements EU Directive 2019/770 and shares its key objectives – to enhance consumer protection in the context of agreements with traders regarding digital services or content (such as mobile applications, electronic games, and e-books). To achieve this, the Digital Content Law establishes rules on conformity of digital content and services with contractual terms, remedies available in cases of non-conformity, and parameters for the modification of digital content and services.
Pursuant to the Digital Content Law, the trader must supply the consumer with the digital content or service within a reasonable period of time without undue delay after the conclusion of the contract (unless agreed otherwise). The digital content or service must meet certain subjective and objective requirements in relation to its quantity, quality, and functionality. The trader must also ensure that the content or service does not violate any rights of third parties, including intellectual property rights.
The Digital Content Law stipulates that all traders must undergo mandatory registration procedures with the E‑Consumer Portal, which, as we mentioned earlier, is expected to begin operating by 2026. Once the E‑Consumer Portal is launched, the trader will be bound to ensure that the information on the trader included there remains up-to-date, while the consumers will be able to file a complaint via it if their rights arising from the receipt of digital content or digital services are violated.
In addition to the CP and Digital Content Law requirements, it is mandatory to use the Ukrainian language as the primary language for customer-facing communication and providing product-related information pursuant to Law of Ukraine “On Ensuring the Functioning of the Ukrainian Language as the State Language” No. 2704-VIII. Specifically, all businesses, including e-commerce operators, must serve customers and provide information about goods and services (including via online stores and e-catalogues) in Ukrainian. This includes advertisement, product details, pricing, manuals, labels, and contract terms.
Ukrainian must be the default language across all customer-facing content, which means that digital interfaces, mobile apps, streaming platforms, and e-commerce sites are subject to language requirements. Importantly, the text in Ukrainian may be duplicated in other languages, such as English, provided that the Ukrainian version is not less complete than the version in the foreign language(s).
- Artificial intelligence
Ukraine is committed to following the EU approach to AI regulation and, at some stage, plans to introduce a substantially similar framework as the one introduced by the EU’s AI Act.
For now, Ukraine has not introduced specific binding regulations applicable to the deployment and use of AI systems, except for limited sui generis protections provided to AI outputs. For now, Ukraine adopted or published, where applicable:
- the Roadmap of Artificial Intelligence Regulation in Ukraine;
- the Concept of the Development of Artificial Intelligence in Ukraine;
- the White Book on the Regulation of Artificial Intelligence in Ukraine; and
- non-binding guidelines on the use of AI in specific sectors, such as media, education, and marketing, as well as general recommendations for developers of AI systems. These guidelines are aligned with international best practices and emphasise the key principles governing the use of AI, such as lawfulness, transparency, responsibility, monitoring of an AI system.
In addition, on 15 May 2025, Ukraine has joined the Council of Europe’s Framework Convention on AI, Human Rights, Democracy, and Rule of Law (yet to be ratified). The Framework Convention represents the first-ever international legally binding agreement designed to ensure that the deployment and use of AI systems remain fully aligned with core democratic values, human rights, and the rule of law. In particular, the document defines the principles that the state must adhere to when developing legislation and applying AI products in the public sector: respect for human dignity, transparency, non-discrimination, protection of privacy, reliability and security.
By Andriy Romanchuk, Partner, Oleksandr Kozhukhar, Managing Associate, and Olha Rudevych, Associate, Avellum
