If you plan to outsource software development to Ukraine in 2026, the question your CFO, your board or your own gut will ask first is simple: is it safe? The country has been at war since February 2022, its power grid is still under attack, and its engineers live under martial law. At the same time, Ukrainian IT firms have kept shipping code for foreign clients every month of the war, and export revenue in 2026 is growing again.
This guide answers the objection directly. It sets out what has actually happened to Ukrainian delivery since 2022, the risks that remain real today, how established vendors handle them, and the checks and contract terms that let you keep Ukraine on your shortlist with your eyes open.
The Short Answer
Yes, for most software work it is a reasonable choice, provided you pick the vendor carefully and write the contract for the conditions that exist, not the ones you hope for. The risk is not that a mature Ukrainian vendor will vanish overnight. The track record since 2022 argues against that. The risk is uneven: smaller firms with one office, one city and no backup plan carry far more exposure than vendors with distributed teams, independent power and a legal entity in the EU.
So the useful question is not “is it safe to outsource to Ukraine” in general, but whether a specific vendor can keep delivering when a city loses power or a senior engineer is called up.
What Has Happened To Ukrainian IT Delivery Since 2022
The hard numbers come from the National Bank of Ukraine’s export statistics, which industry groups track monthly. According to an analysis published by Lviv IT Cluster in February 2026, Ukraine exported $6.66 billion of computer services in 2025, up 3.3% on 2024, and computer services made up 41.6% of all Ukrainian services exports that year.
The trend into 2026 is modestly positive. Opendatabot data reported by Kurs.com.ua in October 2026 puts IT services exports for January to August 2026 at $4.46 billion, 4% higher than the same period of 2025 and roughly back to the 2023 level, though still about 9% below the 2022 record for those months. The industry took a hit, stabilised, and is now growing slowly.
The client base has stayed largely Western. The IT Ukraine Association’s review of the first half of 2025 showed the United States as the largest buyer of Ukrainian computer services at $1.135 billion for those six months, followed by the United Kingdom, Malta and Cyprus.
Two other signals matter. First, the formal IT sector has kept building inside Ukraine. Diia City, the special legal and tax regime for tech companies, had more than 4,500 resident companies employing over 187,000 specialists by the third quarter of 2026, according to dev.ua (October 2026). Second, staff sentiment has firmed up. A DOU survey reported by dev.ua in September 2026 found that 55% of IT professionals living in Ukraine do not plan to leave, up 7 percentage points on the previous year.
None of this means the war is ending. Peace talks that gained momentum in late 2025 had effectively stalled by March 2026, and forecasters cited by Ukrainian News (July 2026) gave roughly a 15% chance of a ceasefire by the end of 2026. Plan for the war continuing through your contract term.
The Real Risks Of Outsourcing To Ukraine
Some of these risks are specific to Ukraine; others exist with any offshore vendor but are sharper here.
Power And Connectivity
This is the risk you are most likely to feel day to day. Russia has repeatedly targeted the energy system, and it is doing so again this autumn. On 20 October 2026, the Kyiv Independent reported new outages in 12 oblasts, including western regions such as Lviv, Ternopil and Rivne, after strikes that hit 28 substations and other energy facilities. Power limitation schedules for industry applied across the whole country, with hourly outage schedules in some regions.
The practical lesson is that no Ukrainian city is fully immune, including the western ones. What protects your project is not geography alone but backup power and backup internet at the vendor’s offices and at engineers’ homes. Expect occasional shortened days or shifted hours in winter, and ask how the vendor handled the last outage, not how it plans to handle the next one.
Mobilization And Staff Availability
Ukrainian men of military age can be called up, and IT workers are not automatically exempt. Companies with “critical enterprise” status can reserve (book) a share of employees from mobilization, but the rules change often. A legal update from Sayenko Kharitonenko on amendments adopted on 30 May 2026 explains that the minimum salary for a reserved employee rose to UAH 25,941 (three minimum salaries) from 1 September 2026, and that all critical enterprise statuses had to be reconfirmed by that date. Earlier in the year, dev.ua reported that a simplified 24-hour booking procedure expired on 1 February 2026, returning processing through Diia to 72 hours.
Fewer engineers are covered than many buyers assume. In the DOU summer 2025 salary survey of 7,844 IT professionals, reported by dev.ua in November 2025, only 13% of male respondents had a reservation from their main employer, and the figure at outsourcing companies was 8%. Almost half (44%) had no reservation, deferral or exemption. The takeaway: any individual engineer on your team may become unavailable, and the vendor’s answer should be bench depth and knowledge sharing, not a promise that nobody will be called up.
Travel is restricted too. Under martial law most men of military age cannot leave the country freely. Since 28 August 2025, men aged 18 to 22 have been allowed to cross the border, as LIGA.net reported, but you should not plan on flying your Ukrainian tech lead to an onsite workshop. Plan to visit them, meet in a neighbouring country with staff who can travel, or run workshops remotely.
Physical Safety And Relocation
Missile and drone strikes reach cities far from the front, including Kyiv. For a client, the risk is less about an office being hit and more about disruption: air raid alerts that send people to shelters, and teams that move. Firms do move. Opendatabot data reported by DOU counted 308 IT companies that changed their registered location within Ukraine during 2025, with most moves between Kyiv and the large IT regions of Kyiv, Kharkiv, Lviv and Dnipropetrovsk oblasts. For vendors near the front line, such as in Kharkiv or Zaporizhzhia, ask harder questions about where your team actually sits.
Data Protection And IP
Ukraine’s personal data law dates from 2010. A new law intended to bring it closer to European standards, draft No. 8153, passed its first reading in November 2024, as LIGA:ZAKON reported. In the most recent sources we read, from March 2026, it had not yet been adopted in full, so check its status before you sign. Ukraine is not an EU member and does not have an EU adequacy decision, so if you are subject to GDPR, treat a Ukrainian vendor as an international transfer and paper it accordingly.
IP risk is mostly about structure. Many Ukrainian engineers work as individual entrepreneurs or gig specialists rather than employees, so you need a clear chain of assignment from each contributor to the vendor and from the vendor to you. Physical risk to data is the other angle: if laptops or servers could be lost in a strike or a hurried move, your code and credentials should not live only on local machines.
Payments, Sanctions And Compliance
Ukraine itself is not under sanctions, and paying a Ukrainian vendor is routine. The compliance risk sits in the territories Russia occupies. The EU, for example, maintains restrictive measures on Crimea and Sevastopol, which the Council extended in June 2026 until 23 June 2027, according to Mezha. The US and UK have their own regimes covering occupied areas. Your vendor should be able to confirm that no work, staff, subcontractors or payments touch those territories, and that none of its owners or beneficiaries are sanctioned persons. Ask for this in writing; it is a standard question and good vendors answer it quickly.
Contract Jurisdiction
If you contract with a Ukrainian legal entity under Ukrainian law, any dispute ends up in Ukrainian courts or arbitration, during martial law. Many buyers prefer to contract with a vendor’s EU or UK entity, or at least choose a neutral governing law and international arbitration. Whatever the paperwork, enforcing a judgment against assets in a country at war is likely to be slow.
How Established Vendors Mitigate The Risks
Ukrainian firms have had more than four years to build continuity practices, and the better ones now treat them as part of the product. Use the points below as a description of what good looks like, then check whether your shortlisted vendor actually does it.
Distributed Teams
The strongest setup spreads people across several Ukrainian cities, often with a weight toward western Ukraine (Lviv, Ivano-Frankivsk, Ternopil, Chernivtsi, Uzhhorod), plus some staff in EU countries such as Poland, Romania or Portugal. For your project, the question is whether your specific team is spread out, not whether the company as a whole is. A team of six all sitting in one Kyiv office is a single point of failure, however large the vendor is.
Backup Power And Internet
During the 2022 blackouts, larger Ukrainian IT firms equipped offices with generators, Starlink terminals, backup internet providers and shelters, and many subsidised power stations and Starlink for staff at home, as Mind.ua documented at the time. These measures are now a baseline. Ask what fuel reserve the office keeps, how long it can run without grid power, and whether engineers have home backup or a policy of moving to a powered coworking space during outages.
An EU Or UK Contracting Entity
It is common for Ukrainian vendors to invoice through an entity in Poland, Estonia, Cyprus, the UK or the US, while the engineering team sits in Ukraine. This gives you a familiar jurisdiction, simpler payments and, sometimes, easier compliance sign-off. It does not change where the work is done, so it complements the other measures rather than replacing them.
Client-Controlled Access And Escrow
The safest arrangement is one where your code, environments and credentials live in systems you own: your Git organisation, your cloud accounts, your identity provider with SSO and multi-factor authentication. Engineers get access through your accounts, and you can revoke it in minutes. Where the vendor builds a product it hosts, source code escrow or regular repository mirroring to your storage gives you a fallback if the vendor cannot continue.
Bench Depth And Documentation
Because any engineer can be mobilized, mature vendors avoid single points of knowledge: pairing, code review across the team, written architecture notes and runbooks, and a named backup for each key role. Ask how quickly they last replaced someone who left suddenly.
A Due-Diligence Checklist For Software Outsourcing In Ukraine
Copy this into your vendor questionnaire. Ask for evidence, not just yes or no answers.
- Where will each member of my team physically work (city and country), and where are their named backups?
- What backup power and internet does each office have, how many hours can it run off-grid, and what is the home-working policy during outages?
- Describe the most recent outage or air raid disruption and its actual effect on delivery hours.
- Does the company hold critical enterprise status, how many staff on my team are reserved, and how is that kept current as the rules change?
- What is the replacement plan and timeline if a team member is mobilized or leaves?
- Which legal entity will I contract with, in which country, and which entity employs or engages the engineers?
- How are contributors engaged (employee, individual entrepreneur, gig contract), and how is IP assigned from each of them to the vendor and on to me?
- Will all code, environments and credentials sit in accounts I own? Do you support SSO, MFA and immediate access revocation?
- Do you hold, or follow, a recognised security framework such as ISO 27001 or SOC 2? Please share the certificate or report.
- Can you confirm in writing that no staff, subcontractors, owners or payments are connected to occupied territories or sanctioned persons?
- What is your written business continuity plan, and when was it last tested?
- Can I speak to two current clients who have worked with you through at least one winter since 2022?
Contract Clauses Worth Adding
These additions are reasonable to request, and an established vendor should be comfortable discussing each of them.
A Specific Force Majeure Clause
The war has been ongoing since 2022, so a vendor should not be able to treat it as an unforeseeable event that excuses all performance. Define which events count (for example, prolonged grid failure in a city, or mandatory evacuation), require prompt notice, require the vendor to activate its continuity plan first, and set a time limit after which you can terminate without penalty.
Continuity And Key Person Commitments
Attach the business continuity plan as a schedule and make compliance a contractual obligation. Add a replacement commitment for key roles (for example, a qualified replacement proposed within ten business days) and a requirement for a knowledge handover at the vendor’s cost.
IP, Data And Escrow
Require present assignment of IP on creation, with the vendor warranting back-to-back assignments from every contributor. Add a data processing agreement and, if GDPR applies, standard contractual clauses for the transfer to Ukraine. Require code to be committed daily to your repositories, or to escrow if the vendor hosts it.
Governing Law, Sanctions And Exit
Choose a governing law and dispute forum outside Ukraine where you can, such as English law with arbitration in London or Vienna. Include a sanctions compliance warranty with a right to terminate immediately on breach. Finally, write an exit and transition clause so that, if things go wrong, you get your code, documentation and reasonable cooperation for a handover to another team.
How Ukraine Compares With Poland And Romania
Poland and Romania are the two most common alternatives buyers weigh against Ukraine. Both are EU and NATO members, so they avoid the war-related risks above entirely: there is no mobilization of your team, no air raids, and GDPR applies directly. That is a real advantage, and for regulated workloads or projects where any disruption is unacceptable, it may decide the question.
Ukraine’s case rests on the depth of its engineering pool, its long track record with Western clients and, in many cases, on price. Many buyers end up with a blended model: an EU-based core with a Ukrainian extension team, or a Ukrainian vendor whose team is split between Ukraine and an EU office. For a fuller side-by-side view of cost, talent and risk, see our guide to Poland vs Ukraine vs Romania for nearshore development.
Is It Safe To Outsource Software Development To Ukraine For Your Project?
Match the risk to the work. Ukraine is a strong fit for product development, web and mobile apps, QA, data engineering and long-running dedicated teams, where a lost day can be absorbed and continuity depends on the team as a whole. It is a harder fit for work that needs 24/7 on-call coverage from a single location, onsite presence, or handling of highly sensitive regulated data without strong client-side controls. For those cases, either keep the critical piece in-house or with an EU team, or insist on a vendor with genuine multi-country coverage.
A sensible way to start is a paid pilot of two to three months over a period that includes some winter weather. You will see how the team handles real disruption before you commit to a larger scope.
Frequently Asked Questions
Is it safe to outsource to Ukraine while the war continues?
For most software projects, yes, with the right vendor. Ukrainian IT exports reached $6.66 billion in 2025 and grew again in the first eight months of 2026, which shows that foreign clients continue to receive delivery. The risk is concentrated in vendors without distributed teams, backup power or a clear plan for staff who are mobilized.
Are western Ukrainian cities like Lviv safe from power outages?
Not completely. Western regions are generally further from the front and see fewer strikes, but the October 2026 outages affected Lviv, Ternopil and Rivne oblasts as well as eastern and central regions. Backup power and internet at the vendor’s offices and engineers’ homes matter more than the city name.
What is Diia City and does it matter to me as a client?
Diia City is Ukraine’s special legal and tax regime for tech companies. Residents can pay 5% personal income tax plus a 1.5% military levy for specialists, and choose between 9% tax on distributed capital or 18% corporate profit tax, according to the American Chamber of Commerce in Ukraine (2024). For you, residency mainly signals a formally registered tech company that meets the regime’s requirements, which are subject to audit. It does not, on its own, protect your project from war-related disruption.
Conclusion
Outsourcing to Ukraine in 2026 is not risk-free, and anyone who says it is has not read the news this month. But the risks are known, they can be checked, and the better Ukrainian vendors have spent four years building the practices that contain them. If you choose a vendor with a distributed team, independent power, client-controlled access and a contract written for current conditions, Ukraine can stay on your shortlist on its merits.
When you are ready to compare vendors, start with our list of top IT companies in Ukraine, look at dedicated development teams in Ukraine if you want a long-running extension of your own team, or browse nearshore software development companies in Ukraine if time zone overlap with Europe matters most. Then run each candidate through the checklist above before you sign.
