Cyberbarriers in trade

In May, 2026, the OECD issued a report considering how standards of cybersecurity become barriers for international trade.

Cybersecurity is a set of technologies and measures that prevent unauthorized access to networks, devices, and other digital infrastructure.

The OECD observes that fragmentation of cybersecurity regulation across countries leads to increased compliance costs for companies and reduces level of infrastructure security.

Thus, costs of the European companies for cybersecurity are estimated at EUR 31.2 bn annually. For example, the EU's Network and Information Security Directive (NIS2) has been in effect since 2023, requiring companies in critically important sectors to systematically manage cyber risks, prevent incidents, and promptly report incidents to the regulator. Growth of costs for companies who have already introduced cybersecurity measures is expected by 12%, and by 22% for those who have just come under the new regulation.

It is hard to disagree with the report's key findings. The digitalization of industries has hidden risks: now, a single cyberattack is enough to leave an entire city without power, as happened in Iran.

However, lack of common positions at the international arena can turn cybersecurity requirements into what the OECD calls “paperwork”: businesses are no longer so much concerned with ensuring security, as they are trying to comply with all the requirements. The cost of such compliance is also substantial: the OECD estimates these costs at EUR 200–500.000 per company in the EU. In Russia such costs are estimated at Rb 800.000 annually.

The requirements as such become an instrument of trade protectionism. Thus, the WTO observe that over 1/3 of all new trade disputes currently tackle cybersecurity issues. Therefore, imposition of high cybersecurity standards, including through requirements for equipment and software certification, localization of data storage, etc., may create more significant barriers to entry for foreign companies than direct restrictions on foreign investment. The cost of compliance for a foreign company may exceed the potential benefits of entering the formally open market for foreigners.

For instance, a series of bans imposed on Huawei in the American and European markets is a remarkable case. Restrictions affected government agencies' ability to purchase the Chinese company's equipment, as well as to use Huawei equipment for the development of 5G networks. The basis for restricting access was precisely the cybersecurity requirements that the company did not meet.

China is also not lagging behind in implementing cybersecurity standards, i.e., only in 2018, Technical Committee TC260 issued nearly 300 national cybersecurity standards, including requirements for software, routers, switches, and firewalls. In 2023, standards have been detailed with introduction of additional package of requirements TC260.

In Russia, the issue of international cooperation on cybersecurity is also raised at the EAEU, however, primarily in the context of information exchange within the Union (Article 23 of the EAEU Treaty), i.e., building a state IT infrastructure for interaction, rather than harmonizing requirements for business.

The OECD proposes reducing costs for companies' information security by developing common approaches to regulating the industry.

From the monitoring issue No. 5 (29), May 2026. Download the full issue (PDF) · issue page at the Gaidar Institute