Ukraine’s digital sovereignty gap is hiding in the back office

The most useful way to understand Ukraine’s 1C/BAS problem is to separate the technology citizens see from the technology institutions use to run themselves. Ukraine’s public digital services have moved quickly. Accounting systems, financial records and enterprise workflows move more slowly. Job advertisements published in 2026 show the resulting gap.

Military Unit A5118 advertised for an accountant in March and listed 1C, 1C Accounting and BAS skills. Military Unit A4640 sought a leader for its accounting and reporting group with experience in the same ecosystem. A Kyiv regional territorial recruitment and social support center described familiarity with accounting programs such as 1C as an advantage. These are concrete examples of legacy ERP knowledge remaining relevant within defense-related administration.

A job advertisement is not the same thing as a technical audit. It cannot establish the number of installations, the data handled by a system or whether a migration is in progress. It does establish that the employer expects the knowledge to be useful. In an accounting role, that can mean active operation, maintenance of historical data, transition work or interaction with systems built around familiar data structures and workflows.

Diia provides an especially instructive case. A June 25 vacancy in its finance and economics team expected high-level proficiency in 1C, BAS or analogous programs. The superficial reading is that Ukraine’s flagship digital-government app “runs on 1C.” The evidence does not support that. The vacancy is for financial calculations inside the organization, while separate Diia postings cover mobile development, DevOps, APIs, system analysis and application security.

The distinction matters because digital transformation often creates two organizations at once. The visible layer changes rapidly: a new app, a redesigned website, an API gateway. The administrative layer changes slowly because it contains years of accounting history, payroll rules, contracts and reporting logic. A government can therefore be digitally advanced at the point of citizen interaction while still carrying legacy systems in its internal operations.

Ukraine’s sanctions and cybersecurity framework now makes those internal systems a policy issue. SSSCIP, the country’s cyber and communications security authority, explicitly discusses 1C and BAS in guidance for its prohibited-software list. The agency says their inclusion is tied to the sanctioned rights holder, 1C LLC. It also emphasizes that the list is a legal sanctions instrument rather than a technical performance or vulnerability ranking.

That nuance should not be confused with leniency. Covered systems may not use listed products when they process state information resources, official information, state secrets or form part of critical information infrastructure. SSSCIP says an air gap is not an exception. A prohibited component can make a system ineligible for security authorization and can trigger replacement requirements when found during an inspection.

The policy is broadening. On July 17, SSSCIP expanded the prohibited list from 1,079 to 1,341 entries. As the list grows, compliance becomes less about memorizing a few notorious brands and more about software supply-chain governance. Institutions need inventories, ownership data, dependency maps and clear responsibility for remediation.

Migration is the missing middle between prohibition and compliance. ERP systems are unusually sticky because they encode both data and organizational behavior. A replacement project must carry forward balances, invoices, payroll, reporting structures, tax configurations and custom integrations. It must also retrain the people who know how work gets done. Turning off the old system before those pieces are reconciled can create operational errors more immediate than the risk the migration was meant to solve.

This is why financial assistance is entering the policy. On July 28, IT Ukraine and Germany’s GIZ announced another voucher round for Ukrainian micro and small businesses replacing 1C/BAS with modern ERP systems. That program makes the implicit economics explicit: the country benefits when businesses remove risky technological dependencies, but individual firms face the cost of conversion.

The original material also named Fire Point. Public information confirms Fire Point is a major Ukrainian defense-tech company, but MAIR did not find independent 1C/BAS evidence in the indexed Fire Point vacancies reviewed. That part of the claim remains unverified. It is a useful reminder that a broad structural problem does not justify attaching every prominent company name to it.

The core story is therefore not that Ukraine’s celebrated digital state is secretly built on obsolete Russian software. It is that modernization has reached different layers at different speeds. The visible layer moved first. The back office is now being forced to catch up, under the combined pressure of war, sanctions, cybersecurity rules and the economic reality of enterprise-system migration.