Polygraph Testing in Defence Companies: How to Do It Lawfully

In 2026 the polygraph is being discussed in Ukraine’s defence sector more often than ever. On 23 September NV published an interview with Volodymyr Zinovskyi, CEO of TAF Industries, a company that is launching drone production in Germany, Denmark and Poland. He explained why Ukrainians are hired more readily for the sites abroad: it is not possible to transfer every security protocol to the EU. In his words, “sending Europeans for a polygraph… is considerably harder than sending fellow Ukrainians”.

That was not the only mention over the summer. On 11 June Interfax-Ukraine reported that at the Ministry of Defence, staff of the procurement department are being sent for a polygraph test one after another, and then for interviews. On 16 July Apostrophe wrote that after one of the defence contracts was cancelled, those responsible for the information leak were identified precisely with the help of a polygraph.

Update, 3 October 2026. On 2 October the Ukrainian public broadcaster Suspilne published an interview with polygraph examiner Maryna Lysevska. According to her, the number of requests from defence companies has tripled; IT companies are asking for tests as well. The reason is the same: the risk of information leaks.

What has actually changed and what has not

Practice has changed. The polygraph has become a routine tool across the state defence hierarchy, and private manufacturers now speak about it publicly as part of their security protocol.

The law for private companies has not changed. A headline is circulating online again saying that the Cabinet of Ministers has added lie detector tests to the reform plan for the defence industry. That is a news item from 8 April 2019. It concerned the management of Ukroboronprom and of state enterprises in which the state holds more than 50%. That decision did not apply to private companies. We were unable to find any new government act from 2026 that would oblige private miltech companies to test people on a polygraph.

Ukraine still has no dedicated law on the polygraph. A private defence company therefore operates under the general rules — the same ones that apply to any other employer.

What this means for an owner and a head of security

Testing in a private company is lawful on one condition: the person has given voluntary written consent. The Constitution prohibits experiments on a person without their free consent, as well as collecting confidential information about them without permission. The Law “On Personal Data Protection” requires consent to be voluntary and informed.

The second rule: you cannot dismiss someone for refusing. Article 40 of the Labour Code contains an exhaustive list of grounds for dismissal, and refusing a polygraph test is not among them. The same applies to the result: a polygraph examiner’s report is grounds for an internal investigation, not a ready-made decision about the person. On its own it is not evidence in court; a court requires a forensic psychophysiological examination.

The rules are covered in detail in our article on polygraph law in Ukraine. This text is not legal advice: the documents for your company should be prepared by a lawyer.

What is tested in a defence company

Polygraph questions must be specific and concern facts, not opinions or character. For a defence manufacturer these are usually:

• information leaks: passing drawings, site addresses, or data on customers and supplies to outsiders;
• links with the aggressor state: contacts with its intelligence services, concealed family or business ties, work commissioned from there;
• theft: components, finished products, kickbacks from suppliers;
• concealed circumstances that could be used to blackmail the person: large debts, addictions.

No questions are asked about religion, political views or intimate life. No method is 100% accurate: the classic polygraph is 85–89% accurate (American Polygraph Association meta-analysis, 2011). Beating it is practically impossible — the polygraph examiner usually sees attempts at countermeasures — but an error is possible too. That is why the result is always compared with other information.

How to organise testing: practical steps

1. Define the list of positions with access to sensitive information and test everyone on it, not selectively.
2. Provide for the possibility of testing in your internal documents, and obtain written consent separately before each test.
3. Warn people in advance and explain which topics will be covered. The less that is unknown, the calmer the test.
4. Agree on who will see the result. Testing is confidential: the report goes to the client, not to the whole department.

The format depends on where the people are.

In Lviv. A classic polygraph test takes 1.5–3 hours and costs 3,000–8,000 UAH (≈ €59–160). For groups, EyeDetect is more convenient: a test with the result takes up to 45 minutes, accuracy is 86–90% (Converus data), from 5,500 UAH (≈ €110). It is available only at the station in Lviv.

In other cities and abroad. Andriy Maryniak conducts in-person tests only in Lviv. For remote employees there is the online test VerifEye: taken on a smartphone, 10–25 minutes, accuracy 84–89% (developer’s data), from 2,500 UAH (≈ €50). If you specifically need a classic polygraph test in another city or country, you can turn to a fellow polygraph examiner whom we will recommend.

Employees who are EU citizens. Here the rules are different, and they depend on the country. Before offering a test, consult a local lawyer specialising in employment law and personal data protection.

More on testing for the industry is on the page polygraph for miltech companies.

A practitioner’s comment

I have been conducting tests since 2012, more than 6,000 of them in that time. The most common mistake a client makes is to come with the request “check whether this person is reliable”. The polygraph does not answer that. It answers a question about a specific act: did they pass it on or not, did they take it or not. The more precisely the topic is worded, the more useful the result.

FAQ

Can an employee who refused a polygraph test be dismissed?

No. The Labour Code contains no such ground. Refusing is a person’s right, and on its own it proves nothing.

Can a person be tested without their knowledge?

No. Any test — whether on a classic polygraph or online — is conducted only with voluntary written consent.

How long does it take to test a team?

It depends on the method. A classic polygraph takes 1.5–3 hours per person, EyeDetect up to 45 minutes, VerifEye 10–25 minutes. The schedule and cost for a group are agreed separately.