Article 5n of Regulation (EU) No 833/2014: which software and which services a company may no longer provide to a customer established in Russia

Key takeaways

• Art. 5n(3) makes it prohibited 'to sell, supply, transfer, export or provide, directly or indirectly, software for the management of enterprises, software for industrial design and manufacture and software with certain uses in the banking and financial sector, as listed in Annex XXXIX, to the Government of Russia or to legal persons, entities or bodies established in Russia'. Annex XXXIX names ERP, CRM, BI, SCM, CMMS, PLM, project management, BIM, CAD, CAM and online-banking and loan-management software.
• Art. 5n(1) prohibits providing services in eight areas, among them accounting, business consulting, advertising, IT consultancy and, under paragraph 8b 'as of 25 November 2025', artificial intelligence services and high-performance computing.
• Art. 5n(3a) extends the prohibition to technical assistance, financing and the licensing of intellectual property rights or trade secrets related to that software.
• The prohibition attaches to establishment in Russia, not to a listing. The Russian subsidiary of an EU group is covered; for it Art. 5n(10)(h) provides only an authorisation ground for the competent authority, not an exemption.
• In Germany, infringing such a prohibition is punishable under § 18(1) AWG with imprisonment of three months to five years; negligent conduct is an administrative offence under § 19(1) AWG with a fine of up to five hundred thousand euros under § 19(6) AWG.
• The Regulation is amended with every sanctions package. This article quotes the consolidated version of 24 October 2025; the version in force at the time has to be checked before every decision.

Why list matching is not enough here

In most companies sanctions screening is understood as matching: customer, shareholders and payees are held against the Union's consolidated sanctions list, and a hit triggers the prohibition on making funds or economic resources available. That is the logic of Regulation (EU) No 269/2014, which attaches to listed persons. Regulation (EU) No 833/2014 works alongside it with a second logic that needs no list: it prohibits certain business with anyone established in Russia. For software companies, consultancies and providers of financial software, Art. 5n is the provision that carries this second logic. A customer who appears on no list can still no longer be a customer.

The wording this article quotes is the consolidated version of the Regulation as of 24 October 2025, as made available by the Publications Office of the Union. The Regulation has been supplemented since 2022 by a long series of amending regulations, and Art. 5n is among the provisions regularly extended in the process. Whoever reads today checks today's version.

Paragraph 3: the software that may no longer be provided

Art. 5n(3) reads: 'It shall be prohibited to sell, supply, transfer, export or provide, directly or indirectly, software for the management of enterprises, software for industrial design and manufacture and software with certain uses in the banking and financial sector, as listed in Annex XXXIX, to the Government of Russia or to legal persons, entities or bodies established in Russia.' The last verb is the one that matters for software-as-a-service: providing presupposes neither a data carrier nor a download. A user account through which a company established in Russia uses the application in the browser is provision.

Annex XXXIX lists the categories covered. Under 'Software for the management of enterprises, i.e. systems that digitally represent and steer all processes happening in an enterprise' it names enterprise resource planning (ERP), customer relationship management (CRM), business intelligence (BI), supply chain management (SCM), enterprise data warehouse (EDW), computerized maintenance management system (CMMS), project management software, product lifecycle management (PLM), and 'typical components of the above-mentioned suites, including software for accounting, fleet management, logistics and human resources'. Under 'Design and Manufacturing Software used in the areas of architecture, engineering, construction, manufacturing, media, education and entertainment' it names building information modelling (BIM), computer aided design (CAD), computer-aided manufacturing (CAM) and engineer to order (ETO). Under software for the banking and financial sector it names online and mobile banking, loan management, automated teller machines (ATM) and point of sale (POS) integration, regulatory reporting and investment banking.

For a German software company the question is therefore not whether the individual customer is listed, but whether its own product falls into one of these categories. A project management tool, an accounting solution, an HR system, a CAD application and a loan-processing platform fall within the wording. The phrase 'typical components of the above-mentioned suites' also captures modules that are not marketed as ERP on their own.

Paragraph 1: the services that may no longer be provided

Art. 5n(1) reads: 'It shall be prohibited to provide, directly or indirectly, the following services to the Government of Russia or to legal persons, entities or bodies established in Russia: (a) legal advisory services; (b) accounting, auditing, including statutory audit, bookkeeping, tax consulting and business and management consulting, or public relations services; (c) construction, architectural, engineering, integrated engineering, urban planning, engineering-related scientific and technical consulting or technical testing and analysis services; (d) advertising, market research or public opinion polling services; (e) IT consultancy services; (f) commercial space-based services consisting of Earth observation or satellite navigation; (g) artificial intelligence services consisting of access to models or to platforms for their training, fine-tuning and inference; (h) high-performance computing, including access to graphic processing unit-accelerated computing, or quantum computing services.'

For the last three areas paragraph 8b fixes the start: 'Paragraph 1, points (f), (g) and (h) shall apply as of 25 November 2025.' Whoever grants a company established in Russia access to a language model, to a platform for its fine-tuning or to GPU-accelerated computing has been providing a prohibited service since that day. Points (a) to (e) have applied for longer; for software companies point (e), IT consultancy, is the area most often affected alongside the product itself: implementation, customisation and support are IT consultancy even where the software itself does not fall under Annex XXXIX.

Paragraph 3a: maintenance, financing, licence

Art. 5n(3a) closes the routes that seemed to remain open under paragraphs 1 and 3. Point (a) prohibits providing 'technical assistance, brokering services or other services related to the services and software referred to in paragraphs 1 and 3'; point (b) prohibits providing 'financing or financial assistance related to the services and software referred to in paragraphs 1 and 3'; and point (c) prohibits to 'sell, license or transfer in any other way intellectual property rights or trade secrets as well as grant rights to access or re-use any material or information protected by means of intellectual property rights or constituting trade secrets related to the software referred to in paragraph 3 and to the provision, manufacture, maintenance and use of that software, directly or indirectly, to the Government of Russia or to any legal person, entity or body established in Russia'.

That also blocks the route through the licence agreement: a software house that does not provide the application itself but grants a partner established in Russia a licence to re-use it, or hands over source code, interface descriptions or configuration know-how, infringes point (c). And the running maintenance contract for an installation delivered earlier is technical assistance within the meaning of point (a).

Who is covered: establishment, not the list

The addressees of the prohibitions are 'legal persons, entities or bodies established in Russia'. Ownership or control is irrelevant to the prohibition. The Russian subsidiary of a German mid-market company is established in Russia and therefore covered. What the Regulation provides for this case is in Art. 5n(10): 'By way of derogation from paragraphs 1, 3 and 3a, the competent authorities may authorise the sale, supply, transfer, export, or provision of the services and software referred to therein, under such conditions as they deem appropriate, after having determined that to do so is necessary for' one of the cases listed there, among them under point (h) 'the exclusive use of legal persons, entities or bodies established in Russia that are owned by, or solely or jointly controlled by, a legal person, entity or body which is incorporated or constituted under the law of a Member State or a partner country as listed in Annex VIII'.

That is an authorisation ground, not an exemption. Whoever wants to keep providing the ERP system to its own Russian subsidiary needs a decision of the competent authority for it, in Germany the Federal Office for Economic Affairs and Export Control (BAFA), and may not provide until it is granted. Further cases in paragraph 10 concern humanitarian purposes, diplomatic representations, the Union's energy supply, the safety of infrastructure and civil nuclear use; paragraph 9b opens an authorisation for the AI and computing services of paragraph 1, points (g) and (h), and the software of paragraph 3 under the conditions stated there. Transitional rules for legacy contracts existed and have expired: paragraph 10a allowed the execution of contracts for banking software concluded before 20 July 2025 only 'until 30 September 2025'.

What is at stake

The sanctions regulations contain no penalties themselves; those sit in national law. In Germany, § 18(1) of the Foreign Trade and Payments Act (AWG) provides that whoever infringes a directly applicable provision of a Union act implementing an economic sanction adopted by the Council under the Common Foreign and Security Policy, by contravening a prohibition named there, is punished with imprisonment of three months to five years, and No. 1 point (d) expressly names the prohibition on providing legal advice, public relations advice, auditing, bookkeeping, tax consultancy, business or management consultancy, IT consultancy, trust services, broadcasting services, architectural or engineering services or a similar service. Point (a) covers the prohibition on trading in, importing, exporting, transferring, supplying, transiting, passing on or transporting goods and on selling or buying goods; point (h) the prohibition on making available funds or economic resources.

Under § 18(6) AWG the attempt is punishable; under paragraph 7 No. 2 the sentence is not less than one year for whoever acts commercially. Whoever commits one of these acts negligently acts as an administrative offence under § 19(1) AWG, with a fine of up to five hundred thousand euros under § 19(6) AWG. For the company itself § 19(7) AWG provides that, in derogation from § 30(2) sentence 1 No. 1 of the Act on Regulatory Offences, the maximum fine in the case of an intentional criminal offence under § 18(1) AWG is forty million euros.

How the check enters operations

The wording yields three questions to be answered before every contract and at every renewal. First: is the customer established in Russia? What counts is the seat of the company, not the nationality of the shareholders and not the list. Second: does the product fall into a category of Annex XXXIX, or is the service one under paragraph 1, in particular IT consultancy, AI model access or computing? Third: is there an authorisation for the specific case under paragraph 9b or paragraph 10, and is it on file? Without a yes to the third question, a yes to the first two leaves only termination.

This check is not an officer-appointment duty; the Regulation prescribes no function. It requires a documented decision per customer and per product, and a repeat as soon as the wording changes. In CIVAC the mapping of the company's own product against Annex XXXIX can be run as a task with resubmission at every sanctions package, the establishment check per customer filed with date and source, and an authorisation decision stored with its conditions and expiry as a deadline.

Where this article ends

CIVAC is not a law firm and provides no legal services within the meaning of the German Legal Services Act (Rechtsdienstleistungsgesetz). This article reproduces the wording of Art. 5n of Regulation (EU) No 833/2014 in the consolidated version of 24 October 2025 and of § 18 AWG. Whether a particular product falls under Annex XXXIX, whether a service is IT consultancy and whether an authorisation under paragraph 9b or paragraph 10 can be granted in the individual case is not decided by this text. The Regulation is amended with every sanctions package; the version in force at the time of provision governs.

Frequently asked questions

May I keep providing my SaaS application to a customer in Russia who is on no sanctions list?

Not if the application falls under Annex XXXIX of Regulation (EU) No 833/2014: Art. 5n(3) prohibits selling, supplying, transferring, exporting or providing such software to legal persons established in Russia, irrespective of a listing. Covered are software for the management of enterprises such as ERP, CRM, BI, SCM, CMMS, PLM and project management including accounting, fleet management, logistics and human resources, design and manufacturing software such as BIM, CAD, CAM and ETO, and certain banking and financial software.

Does the prohibition also apply to the Russian subsidiary of an EU company?

Yes. The addressee is every legal person established in Russia. For companies owned or controlled by a legal person incorporated in a Member State or partner country, Art. 5n(10)(h) provides for an authorisation by the competent authority, in Germany BAFA. Without that decision the prohibition applies.

Since when are AI services and computing covered?

Art. 5n(1)(g) covers artificial intelligence services consisting of access to models or to platforms for their training, fine-tuning and inference; point (h) covers high-performance computing, including access to GPU-accelerated computing, or quantum computing services. Under paragraph 8b, points (f), (g) and (h) apply as of 25 November 2025.

May I keep performing an existing maintenance contract?

Art. 5n(3a)(a) prohibits technical assistance and other services related to the software of paragraph 3; point (c) prohibits licensing and transferring intellectual property rights and trade secrets related to its provision, manufacture, maintenance and use. The transitional period of paragraph 10a for banking software ended on 30 September 2025. Continued performance requires an authorisation under paragraph 9b or paragraph 10.

What penalty applies to an infringement of Art. 5n in Germany?

§ 18(1) AWG threatens the intentional infringement of a prohibition in a Union sanctions act with imprisonment of three months to five years; No. 1 point (d) names IT consultancy and business consultancy expressly. Negligent conduct is an administrative offence under § 19(1) AWG with a fine of up to five hundred thousand euros under § 19(6) AWG. For the company, the maximum fine for an intentional offence under § 18(1) AWG is forty million euros under § 19(7) AWG.