LexLint.ioBeta

Know the law your code answers to.

Law / Andorra

Penal Code, Attacks on Information Systems

Codi penal, Llei 9/2005, del 21 de febrer, qualificada del Codi penal, as consolidated, art. 225 (Atacs contra els sistemes d'informació)

In force since .

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not access all or part of an information system by defeating a security measure, without authorization, when the result is serious.NIST AI RMFMAP 4.1
  • Do not obstruct or interrupt a network or information system, or delete, damage, alter, or make inaccessible data within one, without authorization.no control in the NIST AI RMF
  • Do not intercept non-public data transmissions to, from, or within an information system without authorization.NIST AI RMFMAP 4.1
  • Reading a public, unauthenticated page without defeating any security measure has not itself been held to violate this article.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Imprisonment from three months to three years for unauthorized access defeating a security measure, obstructing a network or system, damaging or intercepting data, or supplying tools for those offences (art. 225(1)-(5)); imprisonment from three to six years plus a fine of up to four times the damage caused where the offence is committed by an organized group, causes especially serious damage, seriously harms an essential public service or critical infrastructure, or creates a serious danger to State security (art. 225(6)).

What it makes you log

Logging duty

Article 225 defines offences of accessing an information system in breach of a security measure, obstructing a network or system, deleting or altering data, intercepting non-public transmissions and supplying tools for those acts, with aggravated penalties. It imposes no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 225 of the qualified Penal Code punishes with imprisonment from three months to three years whoever, by any means, intentionally and without authorization, accesses all or part of an information system in violation of at least one security measure, when the result is serious; the same range of imprisonment applies to intentionally and without authorization obstructing or interrupting the operation of a network or information system, deleting, damaging, or altering data within an information system, intercepting non-public data transmissions, and producing, selling, or distributing hacking tools or access codes for those purposes.

Imprisonment of three to six years plus a fine of up to four times the damage caused applies where the conduct is committed by an organized group, causes especially serious damage, seriously harms an essential public service or critical infrastructure, or creates a serious danger to State security. Paragraph 1 reaches access to an information system only where it is made in violation of at least one security measure, and paragraphs 2 to 5 each require that the conduct be without authorization.

Article 225 in its present wording was set out anew by article 26 of Llei 45/2022, del 22 de desembre, qualificada de modificació de la Llei 9/2005. That law enters into force the day after its publication in the Butlletí Oficial del Principat d'Andorra.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .