Ukraine: technology regulation at a glance

Framework: Law of Ukraine 'On Virtual Assets' No. 2074-IX (2022, adopted but not yet in force) and pending Draft Law No. 10225-d (MiCA-aligned) — supervised by the National Bank of Ukraine (NBU) and the National Securities and Stock Market Commission (NSSMC); AML/CFT rules under Law No. 361-IX apply to VASPs.

Crypto is legal to hold and trade in Ukraine, but a comprehensive licensing regime for virtual asset service providers is not yet in force. The 2022 'On Virtual Assets' law never entered into force because it required Tax Code amendments; a MiCA-aligned replacement bill (No. 10225-d) passed first reading in the Verkhovna Rada in 2025 and is being finalized, with authorities targeting full implementation during 2026. AML/KYC obligations for VASPs have applied since 2020, and Ukraine explicitly rules out crypto as legal tender — the hryvnia remains the sole legal tender.

Framework: Cabinet of Ministers Concept for AI Development (Decree No. 1556-r, 2 December 2020); Ministry of Digital Transformation White Paper on AI Regulation (2023); Action Plan for AI Concept Implementation 2025-2026

Ukraine has no binding AI-specific statute in force. Its current governance rests on a Cabinet-approved Concept for AI Development (2020), a voluntary White Paper on AI regulation from the Ministry of Digital Transformation, and a two-phase roadmap moving from soft guidelines toward a binding EU AI Act-aligned law expected to be introduced to the Verkhovna Rada in Q4 2026. Ukraine signed the Council of Europe Framework Convention on AI (CETS 225) on 15 May 2025, but ratification by parliament is still pending.

Framework: Law of Ukraine No. 2297-VI "On Personal Data Protection" (adopted 1 June 2010, in force since 1 January 2011), supervised by the Ukrainian Parliament Commissioner for Human Rights (Ombudsman). A GDPR-aligned overhaul (Draft Law No. 8153) passed first reading on 20 Nov 2024 but is not yet enacted.

Ukraine has a comprehensive, cross-sectoral personal-data protection law in force, Law No. 2297-VI of 2010, that applies to automated and structured manual processing, grounded in Council of Europe Convention 108. Oversight rests with the Parliament Commissioner for Human Rights (Ombudsman) rather than a dedicated independent regulator. A major GDPR/Convention 108+ alignment reform (Draft Law No. 8153) is pending in Parliament after a first reading in November 2024.

Framework: Law of Ukraine 'On Payment Services' (No. 1591-IX, adopted 30 June 2021, in force 1 August 2022); administered by the National Bank of Ukraine (NBU)

Ukraine operates a comprehensive licensing regime for payment services, anchored by the 2022 Law on Payment Services which is closely aligned with the EU's PSD2 directive. The National Bank of Ukraine (NBU) is the sole regulator, maintaining a Register of Payment Infrastructure and licensing nine categories of payment service providers including payment institutions and e-money institutions. Open banking went live on 1 August 2025, and an ISO 20022-based instant payment rail (SEP 4.1) launched in December 2024 with SEPA-compatible architecture.

Framework: Law of Ukraine 'On the Legal Status of Foreigners and Stateless Persons'; State Migration Service of Ukraine (DMSU) administers temporary and permanent residence permits; State Employment Service of Ukraine issues work permits

Ukraine has no dedicated digital nomad or remote-work visa. Foreign remote workers may enter visa-free (up to 90 days, 87 countries) or via e-Visa (up to 30 days), and can pursue longer-term residence by obtaining a temporary residence permit anchored to Ukrainian employment, self-employment via a registered business, or other qualifying grounds. Ukraine has operated under martial law since February 2022, extended through at least early 2026, which adds practical travel considerations but does not bar foreign entry.

Framework: Law of Ukraine 'On Media' (March 2023); National Council on Television and Radio Broadcasting (NRADA); NCON website-blocking powers under martial law; Draft Law No. 11115 on information-sharing platforms (pending)

Ukraine regulates online content primarily through the 2023 Law on Media, which extended the National Council's remit to online media and platforms and authorised blocking without a court order. Wartime martial law has further expanded executive website-blocking powers via the National Centre for Operational Management of Telecommunications Networks (NCON). A DSA-inspired draft law on shared-access information platforms (No. 11115) remained stalled in parliament as of December 2025, leaving comprehensive platform-liability rules unfinished.

Framework: Law of Ukraine No. 2163-VIII 'On the Basic Principles of Ensuring Cyber Security of Ukraine' (2017), substantially reformed by Law No. 4336-IX (in force 20 April 2025); supervised by the State Service of Special Communications and Information Protection (SSSCIP) with CERT-UA as the national incident response authority

Ukraine has a comprehensive national cybersecurity regime anchored in the 2017 foundational law and a sweeping April 2025 reform (Law No. 4336-IX) that explicitly aligns the framework with the EU NIS2 Directive. The 2025 law replaces the outdated certification-based Comprehensive Information Security System model with a lifecycle risk-based approach and mandates designated cybersecurity officers across government bodies and critical information infrastructure (CII) operators. Incident reporting to CERT-UA is mandatory for CII operators, and a multi-tiered National Cyber Incident Response System has been formally established.

Framework: Law of Ukraine No. 2275-VIII 'On Limited Liability and Additional Liability Companies' (2018); state registration administered by the Ministry of Justice via state registrars and notaries; National Bank of Ukraine (NBU) governs wartime currency controls

Ukraine permits 100% foreign ownership of Limited Liability Companies (LLCs) with no statutory minimum capital and a registration timeline of 1-3 business days. The overall framework is accessible, but ongoing martial law (in force since February 24, 2022) adds material constraints, including NBU-imposed caps on dividend repatriation and operational uncertainty, moderating the overall ease of business formation for foreign investors.