Russian State Duma Election Set for 18-20 September

The Russian State Duma election runs across three days from 18 to 20 September 2026, the first parliamentary vote since the start of the full-scale invasion of Ukraine. All 450 seats in the chamber’s ninth convocation are contested, and the timing has become an explicit factor in when talks over Ukraine might resume.

Guide to this briefing

The mechanics of the vote

President Vladimir Putin signed the decree setting the election date, naming 20 September 2026, with voting spread across three days from 18 September as has become standard practice.

The State Duma is the lower house of the Federal Assembly and is elected by parallel voting. Half the chamber, 225 deputies, is returned from single-mandate constituencies on a plurality basis. The other 225 are allocated by party-list proportional representation, with parties needing 5 per cent of the national vote to qualify for list seats.

That split matters for outcomes. A party with concentrated regional strength can convert it into constituency seats without clearing the list threshold, while a party with thin national support and no local strongholds gets nothing from either half. The system has historically produced larger majorities than vote shares alone would suggest.

The field going in

United Russia enters as the governing party, having won the 2021 election with 49.8 per cent of the vote and 324 of the 450 seats — a constitutional majority. Interfax reported the decree and the three-day voting arrangement.

Dozens of other contests at regional and local level run on the same days, which compresses the administrative load and the observation effort across the entire country into a single window.

Why the date matters beyond Russia

The election has become a scheduling constraint on diplomacy. Ukrainian President Volodymyr Zelensky has said the first results on the path to peace could come by the end of September. US presidential envoys Steve Witkoff and Jared Kushner said after a visit to Moscow that Russian officials would be ready to resume peace talks after the elections, and that substantive negotiation was unlikely during the campaign.

That places any real movement in the last ten days of September at the earliest. It also means the composition of the new Duma — and the political capital the result is presented as conferring — will be part of the backdrop to whatever follows. Our report on the EU’s renewal of Russia sanctions covers the pressure track running in parallel.

Observation and credibility

Three-day voting, extensive remote electronic voting and the scale of simultaneous regional contests have all been raised by election-monitoring groups as complicating independent observation. The European Platform for Democratic Elections has been publishing updates on preparations for the vote.

Those concerns sit inside a wider picture. International IDEA’s latest democracy assessment, released this week, records severe global declines in the indicators measuring credible elections, freedom of the press and effective parliaments — the three that determine whether a legislative election is a competitive event or a confirmatory one.

After 20 September

Three things to watch once counting ends. Whether United Russia’s constitutional majority holds, since the two-thirds threshold governs what can be changed without cross-party assembly. Whether turnout figures and any reported irregularities become a point of contention domestically. And how quickly the resumption of talks that envoys have trailed actually materialises, given that the post-election window is the one both sides have pointed to.

Elsewhere in Europe, voters have been delivering their own verdicts — see our coverage of Sweden’s 2026 election result — while the multipolar diplomacy running alongside all of this is set out in our report on the BRICS New Delhi declaration.

Your questions on the Duma vote

When is the Russian State Duma election?

Voting runs across three days, 18 to 20 September 2026, with 20 September set by presidential decree as election day.

How many seats are being contested?

All 450 seats in the ninth convocation of the State Duma, the lower house of Russia’s Federal Assembly.

How does the voting system work?

Parallel voting. Half the chamber, 225 seats, is elected in single-mandate constituencies by plurality; the other 225 are allocated by party-list proportional representation with a 5 per cent threshold.

Who holds the majority now?

United Russia, which took 49.8 per cent of the vote and 324 seats at the 2021 election.

Are other elections happening at the same time?

Yes. Dozens of regional and local races across Russian regions are scheduled for the same days.

What does this mean for Ukraine talks?

US envoys said after visiting Moscow that Russian officials indicated readiness to resume talks once the elections are over, which places any substantive negotiation after 20 September.

Also on Tamara News

The Biggest Data Breaches of 2026 and What They Reveal

The biggest data breaches of 2026 have run to a pattern: fewer credit card numbers, far more health records, identity documents and account data, and at least one attack that destroyed systems rather than stealing from them. A roundup published on 15 September by TechCrunch puts the year’s incidents side by side.

Sections

The incidents by scale

Ranked by people affected, four incidents dominate the year so far.

The AI music generation platform Suno exposed information associated with 55.3 million user accounts, the largest account count of the year. Charter Communications lost more than 42 million customer records to an extortion group. The insurer DentaQuest saw health data on 15 million people stolen — the largest confirmed breach of sensitive health information in 2026. The Dutch telecoms operator Odido disclosed an attack affecting up to 6.2 million customers.

The Odido disclosure is instructive about what modern breach data looks like. Investigators found unauthorised access to a customer contact system, from which attackers downloaded varying combinations of names, addresses, email addresses, mobile numbers and personal identification details. None of that is a password. All of it is enough to open an account somewhere else in the victim’s name.

Carnival Corporation notified six million people in May that personal information had been taken in an April intrusion. Independent breach trackers, including public breach lists, record a long tail of smaller incidents behind these.

Why health data keeps topping the list

Health records have been the highest-value category for several years and 2026 has not changed that. The reason is durability. A stolen card is cancelled in a day; a diagnosis history, insurance identifier and date of birth stay valid for life and support both insurance fraud and highly credible phishing.

Healthcare and insurance environments also concentrate risk. They run large third-party ecosystems — claims processors, benefits administrators, imaging providers — each of which holds a copy of the same records. Breach numbers in the sector are frequently a count of one supplier’s customers rather than one hospital’s patients.

The attack that deleted rather than stole

The outlier of the year was at Stryker, the US medical technology company. In March, attackers described in reporting on the incident as Iranian broke in and remotely wiped tens of thousands of employee devices, disrupting the company’s operations for several days.

That attribution is as reported rather than judicially established, and should be read with that caveat. What is not in question is the shape of the attack: the objective was disruption, not extortion. Wiper incidents leave no data to negotiate over and no decryption key to buy, which makes recovery entirely a function of how well an organisation can rebuild from backups.

The most recent disclosure

The newest entry is McKesson, the pharmaceutical distributor, which discovered a cybersecurity incident on 25 August 2026 involving unauthorised access to third-party applications and data exfiltration. On 29 August the company narrowed the scope to a subset of customers within its Oncology and Multispecialty and its Medical-Surgical units.

The four-day gap between discovery and scoping is the part worth noting. Initial breach statements almost always describe a larger blast radius than the final forensic picture, or a smaller one. Early numbers should be treated as provisional in both directions.

Financial services has had its own bad month — see our report on the Revolut data breach — while the software supply chain keeps producing entry points, as our coverage of the VMware Workstation and Fusion flaw sets out.

What actually reduces exposure

For individuals, the realistic assumption is that an email address, phone number and home address are already circulating. The defences that still work are the ones that break the chain between leaked identity data and account takeover: app-based multi-factor authentication rather than SMS codes, which are vulnerable to SIM swapping; unique passwords generated and stored in a manager; and a credit freeze where the jurisdiction offers one.

For organisations, the recurring failure in this year’s list is third-party access. Suno, McKesson and DentaQuest all involve data reachable through a system that was not the company’s core product. Inventorying which suppliers hold customer data, and what each can reach, is duller than threat hunting and has prevented more incidents. Governance frameworks are catching up — our report on Microsoft’s AI code of conduct covers one vendor’s attempt to formalise those commitments.

Breach questions, answered

What is the largest known data breach of 2026?

The theft of health data belonging to 15 million people from the insurer DentaQuest is the largest confirmed breach reported so far this year.

Which incident exposed the most user accounts?

The AI music platform Suno, where information tied to 55.3 million user accounts was exposed.

What happened at Charter Communications?

An extortion group stole more than 42 million customer records, according to reporting on the incident.

What data was taken in the Odido breach?

Attackers reached a customer contact system and downloaded varying combinations of names, addresses, email addresses, mobile numbers and personal identification details for up to 6.2 million customers.

Was any 2026 attack purely destructive?

The March intrusion at the US medical technology firm Stryker was, in that attackers remotely wiped tens of thousands of employee devices and disrupted operations for several days rather than seeking a ransom for data.

What should individuals actually do?

Assume email addresses and phone numbers are already public, turn on app-based multi-factor authentication rather than SMS, use unique passwords through a manager, and freeze credit files where the jurisdiction allows it.

More on security

Airline Fuel Costs Jump to $350bn and Fares Follow

The global airline fuel cost bill is on course to rise from $252 billion in 2025 to $350 billion in 2026, according to the International Air Transport Association — an increase of close to 40 per cent that is already showing up on tickets as carrier-imposed surcharges.

What follows

The numbers behind the fare rises

IATA’s mid-year assessment, published in its June release on industry profitability, put jet fuel at an expected average of $152 a barrel for 2026, up almost 70 per cent on the $90 average of 2025. The underlying crude assumption was Brent at $95 a barrel for the year, up 37 per cent from $69 in 2025.

Because fuel sits at roughly 29 per cent of global airline operating expenses — a share IATA expects to reach 31.4 per cent in 2026 — a move of that size cannot be absorbed in margins. Passenger ticket revenue is forecast at $839 billion in 2026, up 9.2 per cent on $768 billion in 2025, and a good part of that increase is fuel pass-through rather than growth.

These are an industry association’s own projections, and IATA has an interest in framing cost pressure sympathetically. The direction, though, is corroborated by its own jet fuel monitor and by carrier disclosures.

The crack spread problem

Crude is only half the story. The crack spread — the premium refined jet fuel commands over Brent — is expected to average $57 a barrel in 2026, which IATA describes as a historic high.

That matters because hedging programmes are usually built around crude, not the refined product. An airline that hedged Brent well can still be badly exposed if refining margins blow out, which is what a record crack spread means. It also means fares do not fall as fast as crude does when the oil price retreats, because the refining premium is slower to normalise.

How it reaches your ticket

Passengers rarely see a line item called fuel. They see YQ or YR codes, grouped on the fare breakdown under “taxes, fees and carrier-imposed surcharges”. The grouping is misleading: those two codes are set by the airline, not by any government or regulator.

On long-haul premium itineraries the amounts are substantial. On a round trip between London and New York in a premium cabin, carrier-imposed surcharges alone can exceed $700. The effect is sharpest on award bookings, where surcharges are typically payable in cash — so a redemption that cost a fixed number of points last year now carries a much larger cash component.

Two practical checks help. Compare the total, not the headline fare, when the same route is offered by carriers in different jurisdictions, since surcharge practice varies. And on award tickets, price the same route on a partner airline before booking, because surcharge policy differs between partners on identical metal.

Airlines are still profitable

The industry is not in distress. IATA forecasts net profit of $23.0 billion for 2026 — roughly half the previous year’s figure — on operating expenses of $1.117 trillion, with expense growth of 13 per cent outrunning revenue growth.

Halving a margin is painful, and it changes behaviour: thinner routes get cut, frequencies fall on marginal city pairs, and older, less efficient aircraft come out of service faster. Passengers feel that as reduced choice before they feel it as higher headline fares.

The variable nobody controls

Every figure above rests on the crude assumption, and crude has run ahead of it. Brent has traded above $100 a barrel since supply disruption in the Middle East, with the shutdown of a major Saudi export line adding to the pressure — see our reports on the East-West pipeline outage and the resulting price shock across Asia.

If Brent holds above the $95 assumption for the rest of the year, IATA’s profit forecast is optimistic and surcharges have further to run. If the disruption eases, crude falls before the crack spread does, so relief on tickets will lag relief at the pump. Either way, the near-term direction for fares on long-haul routes is up. Operational strain is compounding it, as our coverage of UK airport disruption this month shows.

Questions about fares and surcharges

How much are airline fuel costs rising in 2026?

IATA projects the industry fuel bill rising from $252 billion in 2025 to $350 billion in 2026, an increase of close to 40 per cent.

What is the crack spread and why does it matter?

It is the premium jet fuel commands over crude. IATA expects it to average $57 a barrel in 2026, which it describes as a historic high, meaning airlines pay more than the crude price alone would imply.

What are YQ and YR on a ticket?

They are carrier-imposed surcharge codes shown under taxes, fees and carrier-imposed surcharges. The airline sets the amount, not a government or regulator.

Are airlines losing money?

No. IATA forecasts industry net profit of $23.0 billion in 2026, roughly half the previous year’s level, on operating expenses of $1.117 trillion.

Do surcharges affect points bookings?

Yes. Carrier-imposed surcharges are generally payable in cash even on award tickets, which is why redemption values fall when surcharges rise.

Will fares keep climbing?

That depends on crude. IATA’s forecast assumed Brent averaging $95 a barrel for the year, and prices have traded above $100 since the Middle East supply disruption.

Related business coverage

Canada Express Entry Draw Sends 2,000 Invitations at CRS 519

Canada issued 2,000 invitations to apply for permanent residence in a Canada Express Entry draw held on 15 September 2026, with the Comprehensive Ranking System cut-off for the Canadian Experience Class settling at 519 points — two below the round two weeks earlier.

Quick navigation

The 15 September round

The round was category-restricted to the Canadian Experience Class, the stream for candidates who already hold skilled work experience in Canada. Immigration, Refugees and Citizenship Canada issued 2,000 invitations, with the department’s own timestamp recorded at 10:21:41 UTC.

The tie-breaking rule did significant work in this draw. Where multiple profiles sit exactly on the cut-off, IRCC admits those submitted before a stated date and time. That timestamp reached back to 26 March 2026 — close to six months before the round itself, which indicates a deep pool of profiles clustered at 519.

Specialist trackers including Moving2Canada and Canadian immigration practices reported the same figures independently. IRCC publishes each round on its ministerial instructions page, which is the authoritative record.

Where the CRS line is heading

The Canadian Experience Class threshold peaked at 523 in the 18 August round, the highest of the year. The 1 September round came in at 521, and 15 September at 519. That is a downward drift of four points over a month.

Read carefully, it is a mild trend rather than a door opening. Single rounds are noisy: invitation volume, the mix of categories drawn and the size of the pool all move the line. A candidate sitting at 510 should not read a four-point drift as a forecast. A candidate at 517 or 518 has reason to keep the profile current.

A record year for invitations

Volume, not the threshold, is the more striking number this year. As of the 4 September round, trackers counted 53 Express Entry rounds in 2026 and more than 126,000 invitations issued — a record annual total, with almost four months of the year still to run.

That combination — record invitation volume alongside historically high cut-off scores — tells you the pool has grown faster than the draws. More candidates are competing for a larger number of places, which is why the threshold has held up despite the issuance rate.

How the levels plan shapes the draws

Express Entry rounds are downstream of the Immigration Levels Plan. Canada’s 2026-2028 plan, summarised by practitioners tracking the file, sets a target of 380,000 new permanent residents in 2026, held flat for the following two years.

Within that, the plan allocates 109,000 places to skilled workers in 2026, rising to 111,000 in 2027 and 2028. The plan brings back the Federal High Skilled category, leans harder on the Provincial Nominee Program, and keeps a deliberate focus on helping people already in Canada transition to permanent residence — which is precisely why Canadian Experience Class rounds keep appearing.

The money side of the system also tightened this year. Our report on the revised study permit proof-of-funds requirement covers the change most likely to affect candidates building Canadian experience through study.

Planning around the next round

IRCC does not publish a draw calendar in advance, and the interval between rounds has varied. Candidates within a few points of the line should do three things: confirm language test validity, since expiry silently drops a profile’s score; update work experience the day it crosses a year boundary; and keep an eye on provincial nominations, which the levels plan has made a larger share of the intake.

For comparison across destinations, our coverage of Australia’s visa processing priorities and of green card category retrogression in the United States sets out how the other two large skilled-migration systems are rationing places this year.

Express Entry questions answered

What was the CRS cut-off in the 15 September Express Entry draw?

The Canadian Experience Class round on 15 September 2026 used a Comprehensive Ranking System cut-off of 519 points.

How many candidates were invited?

IRCC issued 2,000 invitations to apply, the same volume as the 1 September round.

What is a tie-breaking timestamp?

Where several profiles sit on the cut-off score, the department admits those submitted before a stated date and time. For this round the timestamp reached back to 26 March 2026.

Is the CRS threshold falling?

The trend has been gently downward since the 18 August round set the year’s high of 523 for the Canadian Experience Class, but two points is a small move and single rounds are noisy.

How many invitations has Canada issued in 2026?

Trackers counted more than 126,000 invitations across 53 rounds as of the 4 September draw, a record annual total.

What does the 2026-2028 levels plan target?

The plan sets 380,000 new permanent residents in 2026 and holds that level for the following two years, with 109,000 places for skilled workers in 2026 and 111,000 in each of 2027 and 2028.

More immigration reporting

EU AI Act High-Risk Deadline Moves to December 2027

The EU AI Act high-risk deadline that was due to bite on 2 August 2026 has moved to 2 December 2027 for standalone systems, and to 2 August 2028 for AI built into products already governed by EU product-safety law. The shift came through Regulation (EU) 2026/1744, the Digital Omnibus package amending the AI Act, which entered into force on 27 July 2026.

On this page

What moved, and to when

The Digital Omnibus was tracked through the European Parliament as a simplification measure and published in the Official Journal on 24 July 2026. Its effect on timing is narrow but consequential.

Annex III covers standalone high-risk systems — the categories such as biometrics, critical infrastructure, education, employment, essential services, law enforcement and administration of justice. Compliance for those moves from 2 August 2026 to 2 December 2027. Annex I covers AI embedded in products already regulated under EU product-safety legislation, and that moves to 2 August 2028.

The obligations themselves are unchanged in substance: risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness, cybersecurity, conformity assessment, post-market monitoring and incident reporting. Only the date on which they become enforceable has moved.

What did not move

This is where several summaries have gone wrong. Three tranches stayed on their original schedule.

Article 5 prohibited practices — the outright bans, including certain biometric categorisation and social scoring — have been in force since February 2025. General-purpose AI provider obligations have applied since August 2025. And Article 50 transparency duties, including the labelling of AI-generated content and disclosure when users are interacting with an AI system, took effect on 2 August 2026 as originally written.

So a provider of a large model selling into the EU gained nothing from the omnibus. A provider of, say, a CV-screening tool gained sixteen months.

The AI Office now has teeth

The other thing that happened on 2 August 2026 is that the European AI Office’s supervision and enforcement powers became exercisable. Analyses from firms advising on the file, including Gibson Dunn, set out the scope: the Office can request information from providers, demand access to models, order mitigation measures, and require withdrawal or recall from the EU market.

Those are enforcement powers attached to obligations that are already live, chiefly the general-purpose AI and transparency provisions. The practical exposure for frontier model developers is therefore now, not December 2027.

The reason given

The justification offered for the deferral is capacity rather than policy reversal: harmonised standards under the Act were not finalised, and notified body capacity to run conformity assessments was not in place. Without a standard to build against and an assessor to certify against it, providers could not have demonstrated compliance on the original date.

Critics read the same facts differently, as evidence that the Act’s conformity architecture was over-specified relative to what European standards bodies could deliver. Both readings are consistent with the text; the Commission’s own framing is the capacity one.

The deferral also lands in a year of hardening technology policy elsewhere. Our coverage of the US chip export bills and of China’s intelligent computing plan to 2030 traces the parallel tracks.

What providers should do with the extra time

The obvious risk of a sixteen-month deferral is that teams stand down. The obligations that arrive in December 2027 are documentation-heavy and retrospective — technical files, data governance records and post-market monitoring plans are easier to build while a system is being developed than to reconstruct afterwards.

Two near-term items remain unavoidable. Transparency labelling is live now for anyone shipping generative output into the EU. And for organisations that also build or deploy general-purpose models, the AI Office’s information-gathering powers are exercisable today. Our report on Microsoft’s AI code of conduct shows how large vendors are documenting these commitments ahead of formal requirements.

What people are asking about the delay

What is the new EU AI Act high-risk deadline?

Compliance for standalone high-risk systems listed in Annex III now falls due on 2 December 2027, moved from 2 August 2026. AI embedded in products already covered by EU product-safety law has until 2 August 2028.

Which obligations were not delayed?

Article 50 transparency and AI-content labelling duties, the general-purpose AI provider obligations in force since August 2025, and the Article 5 prohibited-practices regime in force since February 2025.

What changed on 2 August 2026?

The AI Office’s supervision and enforcement powers became exercisable, alongside the transparency obligations and the penalty framework for the provisions already in force.

Why did the EU postpone the high-risk rules?

The stated reason is that harmonised standards and notified body capacity were not ready in time for providers to demonstrate conformity.

Where is this written down?

Regulation (EU) 2026/1744, the Digital Omnibus simplification package amending the AI Act, published in the Official Journal on 24 July 2026 and in force from 27 July 2026.

Does the delay apply outside the EU?

The AI Act applies to providers placing systems on the EU market regardless of where they are established, so the revised dates matter to non-EU developers selling into Europe.

Further technology coverage