How Rosatom purchased AI tools through unofficial channels

The author of a Habr article dedicated a publication to a story about how at Rosatom, according to the headline "How Rosatom Bought AI Tools Through Unofficial Channels," some of such tools were procured bypassing standard procurement procedures. The text opens not with a dry exposition of facts, but with a series of proverbs in different languages about the same phenomenon: saving on important things ultimately leads to much greater losses — "cutting corners leads to even bigger problems" in Russian, "Tanie mięso psy jedzą" ("cheap meat dogs eat") in Polish and "Penny wise, pound foolish" in the British tradition.

What the author warns about at the beginning of the article

• Article headline — "How Rosatom Bought AI Tools Through Unofficial Channels"
• Source — Habr AI section
• Proverbs in three languages — Russian, Polish and English versions of the same thought about deceptive savings
• Key quote — the Latin question "Quis custodiet ipsos custodes?" ("who will guard the guardians themselves?")
• Stated theme — savings on SMM staff as the starting point of the story

Further in the text, the author refers to the classic Latin question "Quis custodiet ipsos custodes?" and connects it to savings on SMM staff, which, according to the publication's formulation, led to the subsequent events. This rhetorical device sets the frame for the material: it is not just about a violation of internal procurement procedures, but about a situation in which the absence of internal control allowed the practice implemented outside official channels to remain unnoticed until the consequences became obvious to a wider audience, including readers of specialized publications.

Why unofficial AI tool purchases are a systemic risk?

The general problem raised by the article's headline is broader than one specific case. In large regulated organizations — state corporations, banks, industrial holdings — the procurement of software and subscriptions to AI services is centralized precisely so that the supplier passes verification, and the order of data processing, license legitimacy and security requirements are confirmed before the tool gains access to corporate accounts or information. When individual departments or contractors bypass this process — often for the sake of saving time or money, for example by using unofficial resellers or personal accounts for marketing and SMM tools — the organization loses visibility of what exactly has gained access to its systems, and cannot verify that the tool meets security and compliance standards.

This class of problems, which in corporate practice is usually called "shadow IT," has intensified as AI tools have begun to appear and spread faster than formal approval procedures can keep up with — the temptation to bypass a long chain of approvals for quick results grows along with the number of available AI services on the market.

What this means for large organizations

Stories like the one described by the author usually become indicative cases of why managing the purchase and use of AI tools — supplier verification, clear definition of who is authorized to approve purchases, and accounting for which tools have access to what data — is important for the AI age to the same extent it has always been important for traditional software. For organizations working with sensitive or regulated information, the rhetorical question "who will guard the guardians themselves," which the author opens the article with, reads not as a detached quote, but as a direct indication of the absence of internal control over who and how makes procurement decisions for new digital tools on the ground.

The choice of precisely a three-language collection of proverbs — Russian, Polish and English — also works toward the overall message: the author shows that the phenomenon that will be discussed is not unique to one country or one industry, but is a universal management trap that organizations all over the world fall into when they decide to save on control procedures for short-term gain. That is precisely why the article's headline is presented as an analysis of a specific case, but in fact raises an issue relevant to any large structure purchasing digital tools outside a single center of responsibility.