BelgiumCode pénal, Livre II, articles 524 à 533, accès non autorisé et sabotage dans un système informatique
Code pénal Livre II, arts. 524-533 (accès non autorisé et sabotage dans un système informatique), inséré par la loi du 29 février 2024 introduisant le livre II du Code pénal; peines fixées au Livre Ier, art. 36 et 38
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/02/29/2024002088/justelIn force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access or remain in a computer system knowing you are not authorised to do so.NIST AI RMFMAP 4.1
- Do not exceed your own access rights to a computer system with a fraudulent intent or an intent to harm.NIST AI RMFMAP 4.1
- Do not retrieve data, use a third party's system, or cause any damage in the course of an unauthorised access; doing so raises the offence to the aggravated tier.NIST AI RMFMAP 4.1
- Do not, knowing you are not authorized, introduce, modify or erase data in a computer system, or change the normal use of data in it by any technological means.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Six months to three years' imprisonment for unauthorised access under Article 524 or 525 (peine de niveau 2), rising to three to five years where the offender also retrieves data, uses the system, or causes damage under Article 526 (peine de niveau 3); attempt is punished the same as the completed offence under Article 527. Computer sabotage under Article 531 draws the same level-2 penalty, and level 3 where aggravated under Article 532; possessing or making available a device designed for it is punished at level 2 under Article 533.
Penalty structure
Corporate-liability cap for the base offence (peine de niveau 2, Book I Article 38): a legal person faces a fine of more than 20,000 to 360,000 euros. A natural person instead faces imprisonment of six months to three years at this level (Book I Article 36), with no equivalent monetary cap. The aggravated offence (Article 526) reaches peine de niveau 3, raising the corporate fine to more than 360,000 to 600,000 euros and the natural-person term to three to five years.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 360,000
Who enforces it
Settledness
- As of
- Open questions
- Does a person who requests pages from a public website 'accède' to a computer system 'sachant qu'elle n'y est pas autorisée' under Article 524 when the operator's terms of use forbid automated access but no technical barrier stands in the way?
- Does a user who exceeds the rate limit or the scope of an account 'outrepasse son pouvoir d'accès' with 'intention frauduleuse ou dans le dessein de nuire' under Article 525?
What it makes you log
Logging duty
Articles 524 to 533 define offences of unauthorized access to a computer system and of computer sabotage, with the possession of tools for either. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Belgium's new Penal Code Book II criminalises accessing or remaining in a computer system without authorisation (Article 524, external access) and, separately, exceeding one's own access rights with fraudulent intent or intent to harm (Article 525, internal access), each punished at sentencing level 2. The offence is aggravated to level 3 under Article 526 where the offender also retrieves the system's data, uses a third party's system, or causes any damage.
Attempt is punished the same as the completed offence (Article 527), and possessing or supplying a device designed to enable the offence (Article 528) or inciting its commission (Article 529) are separate offences; knowingly holding or disclosing data obtained through the offence is a further offence under Article 530.
Computer sabotage consists of knowingly, without authorization, introducing, modifying or erasing data in a computer system, or changing the normal use of data in it by any technological means (Article 531). It is punished at sentencing level 2, and an attempt is punished the same as the completed offense. It is aggravated to level 3 under Article 532 where the offender acts with fraudulent intent or intent to harm, or commits it against the computer system of a critical infrastructure.
Level 3 also applies under Article 532 where the offender damages data in the system concerned or in another system, or prevents the system concerned or another system from working correctly, in whole or in part. Possessing or making available a device designed or adapted to commit computer sabotage is a further offense punished at level 2 (Article 533).
The access provisions replace Article 550bis of the 1867 Penal Code, which had criminalized the same conduct in materially the same terms since . The sabotage provisions correspond to Article 550ter of that Code, which punished introducing, modifying or erasing data in a computer system without authorization from the same day.
Article 524 turns on the actor knowingly lacking authorisation to access the system; its text does not add a separate requirement that a technical security measure be defeated.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .