The European Union’s biggest-ever round of sanctions against Russia’s arms industry may have been drafted with the help of an AI chatbot. An investigation by The Insider, an independent Russian-language outlet, published on October 26, found mixed alphabets inside single words, a web domain that does not exist and identical boilerplate justifications for more than 1,500 listings. The authors say the document “bears signs of having been generated by a large language model.” The EU has not responded, and the claim is unproven. But the errors themselves are documented, and they have real consequences for banks, companies and people with the wrong surname.
A record package aimed at technology suppliers
The EU adopted its 22nd sanctions package on October 12. According to an analysis by the law firm Penningtons Manches Cooper, the legal acts, Council Decision (CFSP) 2026/2279 and Implementing Regulation 2026/2281, freeze the assets of 1,569 targets: 826 companies and 743 individuals, mostly their senior executives. It is the EU’s largest listing exercise against Russia’s military-industrial complex and brings the total under the regime to almost 4,600.
The focus is technology. The listed companies work in semiconductors, microelectronics, communications equipment, radar, aviation, satellite and navigation systems, as well as explosives and optics. The EU estimates they have combined annual revenue above €20 billion and employ more than 250,000 people. Unlike earlier packages, this one adds no new trade or financial restrictions; it is almost entirely a list of names.
What The Insider found
The Insider’s investigators went through the list entry by entry. Their main findings:
- Every listing is justified with one of two standard phrases, where earlier packages gave a specific reason for each target.
- Company names are transliterated inconsistently, almost always without capital letters, in a way that resembles the output of a Python transliteration library with apostrophes stripped out.
- Some names mix Latin and Cyrillic letters within a single word, an error that is hard to make by typing but common in machine-generated text.
- One company’s website is given with a “.rf” domain, which does not exist; the Russian domain is written in Cyrillic.
- Some entities no longer exist in the form listed, such as a plant merged into another organisation in 2021, and some executives are listed in the wrong job.
- None of the 743 individuals has a date of birth or passport number, only Russian tax numbers.
In total the investigators counted at least 25 discrepancies in company names and legal forms. The Insider describes LLM use as “one possible explanation,” not a proven fact. The patterns it lists could also come from automated scripts, rushed copying from Russian registries, or a mix of both.
Why sloppy data matters
Sanctions lists are not read by people first; they are fed into screening software at banks, payment providers and exporters, which compare every customer and transaction against them. Those systems depend on clean identifiers. A list without birth dates or passport numbers forces them to match on names alone, which produces false positives. The Insider says one of its own employees had a salary payment temporarily frozen because they shared a surname with a listed person.
Errors also open the door to legal challenges. Listed people and companies can contest designations in the EU’s General Court, and a vague, copy-paste justification is easier to attack than a specific one. A misspelled company name can let a real supplier slip past screening, while a correct name attached to a defunct entity wastes compliance effort.
The Insider adds a political point: not a single Chinese manufacturer or reseller appears in the package, although Chinese suppliers are a major source of components for Russian weapons. Ukraine’s military intelligence recently reported finding components from U.S., Japanese, Chinese, Swiss and Taiwanese makers inside one Russian anti-jamming system, which shows how global the supply chain is. We looked at how Western restrictions on Chinese technology are playing out in our analysis of the U.S. ban on Chinese technology.
Our take
Using AI to help process thousands of entries is not a scandal in itself; governments will increasingly do it, and done well it could make sanctions faster and more consistent. The problem is publishing machine-quality output as binding law without the checks that legal documents require. Whether or not a chatbot wrote this list, its errors make sanctions easier to challenge and harder to enforce, and they land on innocent people with matching names. If Brussels is using AI tools for this work, it should say so and show how the output is verified.