Who is responsible for the sky above the plant?

In the summer of 2026, Russia adopted new rules for protecting facilities from air threats, but they are often explained too simply: the Ministry of Defense will allegedly divide the country into zones and take control of the entire fight against drones.
Federal Law No. 192-FZ of June 26, 2026, expands military capabilities and accelerates the creation of defense systems, but does not appoint a single military commander for each civilian enterprise. Headquarters determine priorities, the military counters the threat, and the owner prepares the facility and restores its operations.
The law gives powers, but does not create a ready-made system
Article 10.3 of the new law regulates the special regime of closed military towns. This includes controlled areas, security zones, and special zones. Article 10.4 permits military personnel to prevent the operation of unmanned aerial vehicles while protecting Armed Forces facilities. These articles do not divide the entire country into security zones.
Article 1 of Federal Law No. 192-FZ, which introduces Articles 10.3 and 10.4, will take effect 180 days after its official publication, i.e., December 24, 2026. Therefore, as of August 31, the legal framework has already been created, but the system has not yet been deployed, and it is too early to assess its effectiveness.
Another part of the law is already in effect. It allows for the faster construction, procurement, and commissioning of active and passive defense systems. This allows for derogations from a number of standard land, urban planning, licensing, customs, and regulatory procedures. Procurement for air defense systems is permitted without competitive bidding.
However, the director cannot initiate a special procedure at will. Work and facilities must be included in a list approved by a single national center, federal, or regional headquarters.
Federal Law No. 192-FZ accelerates construction and procurement. Its Articles 10.3 and 10.4 come into force on December 24, 2026.
Federal Law No. 256-FZ "On the Safety of Fuel and Energy Complex Facilities" has been in effect since 2011. It establishes the categorization of facilities, safety data sheets, and the responsibilities of owners.
Presidential Decree No. 604 has been in effect since August 24, 2026. It allows for the temporary management of property if the owner has failed to take the necessary protective measures.
This was already discussed on VO earlier. Possibilities of combined protection of fuel and energy complex facilities, the question of unity of command and dispersion, the difference between the number of interceptions and the established damageHere we'll look at who makes the decisions, operates on-site, and restores production.
The headquarters determines the priority, the owner is responsible for the enterprise
A civilian plant does not control the airspace above its territory. Its director cannot independently establish procedures for the use of radio jamming, interceptors, or weaponsSuch decisions are linked to the overall air situation and the risk of hitting the wrong target. Therefore, drone strikes must be managed by a coordinated state structure.
The company installs authorized detection and suppression systems, seals off vulnerable areas, disperses critical equipment, and trains personnel. While it has no access to military weapons, it is obligated to prepare the facility for an attack.
Federal Law No. 256-FZ has long been in effect for fuel and energy companies. The owner is obligated to determine the facility's category, compile a safety data sheet, and implement the prescribed measures. This can be done independently, in collaboration with government agencies, or, in certain cases, with federal agencies. These obligations were established long before the decisions of the summer of 2026.
The new law combines the previous owner's responsibility with an accelerated military construction process. The center and headquarters approve lists of works and facilities. The military monitors the air situation, issues target designations, and carries out attacks on targets. Security is responsible for maintaining security on the premises, the industry body establishes requirements, and the owner prepares the enterprise and organizes its restoration.
If one of these functions remains "implied," a dangerous pause occurs. The military may see the target, but the shift will not have time to change the operating mode. A company may purchase equipment but not obtain the necessary authorization to use it. A protective structure may be installed, but access for the maintenance team may not be provided.
Courts are already considering similar cases. In 2024, the technical director of Kostroma's CHPP-1 and CHPP-2 was fined 30 rubles. He failed to comply with the decision of the regional anti-terrorism commission, which, back in December 2023, had demanded the installation of drone countermeasures and protective nets at fuel and energy complex facilities.
In 2026, the general director of Lipetsk Vodokanal received a fine for failing to install protection within the specified deadline. The company stated that it had twice requested the commission determine the level of threat posed by a drone attack, but had received no response. The court rejected this argument.
This is where the system's weakness becomes apparent. The manager's liability is clearly established and backed by a fine. However, the law doesn't equally clearly define the government agency's obligation to promptly transfer threat model data to the enterprise.
In the workflow, the duty shift switches the production to a safe mode, the combat crew receives target assignments, and security clears the way for emergency response units. The director does not command the air battle, but is responsible for preparing the workshop and personnel. Unity of command is essential when repelling an attack, but no single participant can perform and pay for all the work.
There is a whole chain between the order and the shot.
The authority to suppress, damage, or destroy a drone doesn't create a combat crew. The crew must detect the target, receive target designation via radio, and execute it; it also requires trained personnel, ammunition, repairs, and a replacement team. Any one of these links seems secondary until its failure halts the entire chain.
The signal must quickly reach the person authorized to change the facility's operating mode. Security hands over surveillance to the crew, and after the impact, allows emergency services access to the damaged equipment.
According to the Tenderplan system, Russian businesses spent over 440 million rubles on anti-drone systems in the first half of 2026, six and a half times more than the previous year. Demand increased following the President's May order to jointly develop proposals for enterprise protection with businesses.
However, these costs are not yet comparable to the potential losses. Damages to oil companies from strikes on refineries are estimated at over a trillion rubles. The number of refineries targeted in 2026 doubled. After damage to a single primary processing unit, individual plants lost up to 40% of their capacity. The gap between defense costs and the scale of damage remains material, not legal.
Over the past two years, courts have issued at least seven rulings on claims against anti-drone system suppliers for disrupting installation. The awards ranged from 183 to 26 million rubles. Some companies received contracts and certificates, but no functional protection.
Even a comprehensive set of measures doesn't guarantee results. Since the end of July 2026, one large warehouse operator has lost almost a fifth of its space due to attacks. The entire set of measures still needs to work as a unified system.
The expedited procedure allows for construction and procurement to begin sooner. However, along with the timelines, regular approvals are also reduced. If land, construction, fire, sanitary, environmental, and financial inspections are temporarily suspended, the special procedure must ensure quality control.
Anti-fragmentation screens and frames over installations may violate fire safety requirements. Sometimes they are designed as scaffolding. This speeds up the work but leaves the structure with an unclear status and maintenance procedures.
Refusing to participate in the competition also eliminates the need to verify the supplier's ability to perform installation. Without internal control, expedited procurement will reproduce previous problems in a shorter time.
Rapid construction doesn't negate engineering discipline. The site must be connected to the power grid and communication channels, supplied with spare parts, and a replacement shift and repair personnel must be prepared. The screen must not interfere with production, and the temporary structure must be registered.
Defense is also based on simple things: a communication cable, a working control panel, a shift log, and the repair team's route. Together, they allow the task to be completed and the system restored to operational readiness.
Responsibility doesn't end after a raid
Presidential Decree No. 604 of August 24, 2026, added a new consequence to this system. If a business entity fails to take measures to protect critical infrastructure, violates requirements, or creates a threat to the normal operation of the facility, its property may be placed under temporary management. The decree specifically mentions ineffective countermeasures against drone attacks and delayed restoration.
The decision is made by the Government based on a presidential order. Rosimushchestvo becomes the manager. It receives the powers of the owner, in addition to the right to dispose of the property, conducts an inventory, and ensures the safety of the assets.
Ownership rights are not terminated, so the decree does not provide for compensation. This is not a requisition under Article 242 of the Civil Code or nationalization under Article 235. Production assets, shares, and stakes in authorized capital may be placed under management.
The decree does not set a deadline. Management is terminated by a government decision based on a presidential order. The mechanism is similar to Decree No. 302 of April 25, 2023: the same manager, the same scope of authority, and no deadline. However, Decree No. 302 was a response to the seizure of Russian assets abroad, so its practice cannot be directly transferred.
For a company manager, the risk is no longer limited to a fine or an order. They may lose operational control over the asset, and this control will not automatically return on the predetermined date.
The decree doesn't provide any numerical definitions of what constitutes "inefficiency" and "untimely response." It doesn't specify the permissible number of hits, hours of downtime, or a general standard for all industries. Therefore, the manager will have to confirm the operability of the protection system, the training of personnel, and the organization of the restoration.
Evidence will include a threat model, training logs, test reports, and recorded recovery times. The decree itself does not list the required resources. The company selects them within its responsibilities.
The director cannot be required to make decisions they are not authorized to make. However, limiting their authority does not relieve them of their responsibilities for engineering protection, shift preparation, and disaster recovery.
For military headquarters, a raid may end with a target impact report. For a company, it ends after damage assessment, isolation of the hazardous area, and restoration of service or safe shutdown of the line.
What should a manager do?
Three documents outline a procedure that is best completed prior to a state assessment of enterprise security.
- Check whether the facility is included on the approved list of urgent work. If not, contact the regional headquarters with a proposal to include it. Without this, the expedited procedure cannot be used.
- Update the classification and safety data sheet in accordance with Federal Law No. 256-FZ. Verify them with the decisions of the regional anti-terrorism commission.
- Request data for the threat model from the authorized body in writing and retain proof of the request. The Lipetsk case demonstrates that a lack of response does not absolve the manager of liability, but a written request confirms the manager's actions.
- Establish the exact signal path from threat detection to change in process mode: positions, communication channels, control time and backup communication method.
- Conduct a drill for emergency shutdown and safe launch after an air threat. The results must be documented.
- Determine the routes of repair and emergency teams, as well as the procedure for their admission after the immediate threat has been removed.
- Test the purchased equipment. A delivery certificate is not sufficient. The contract with the supplier must stipulate liability for failure to complete the installation.
- Register temporary structures and positions constructed using an accelerated procedure, including those registered as scaffolding.
- Collect documents confirming the facility's readiness: a threat model, an action plan, test reports, training logs, and data on recovery times from previous incidents.
The law empowers and expedites work; headquarters manages the air threat response, the crew carries out the combat mission, and the owner prepares the facility and restores its operations. Protection exists not in the acceptance certificate, but in the working chain from the alarm signal to the facility's return to service.
Information