BulgariaCriminal Code (Nakazatelen kodeks), Art. 319a, Unauthorized Access to an Information System
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not unlawfully access an information system or a part of it; a non-immaterial unauthorized access carries imprisonment of up to six years under Article 319a(1), rising with aggravating circumstances.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of up to six years and a fine of up to BGN 3,000 for unlawful access in a non-immaterial case (para. 1); imprisonment of up to six years and a fine of up to BGN 5,000 where committed by prior agreement of two or more people (para. 2); imprisonment of up to seven years and a fine of up to BGN 20,000 for a repeat act or one involving electronic-signature data (para. 3); imprisonment of four to eight years where the information is a state secret or otherwise legally protected, or the system is part of critical infrastructure, unless a heavier punishment applies (para. 4); imprisonment of five to twelve years where grave consequences occur (para. 5).
Who enforces it
Settledness
- As of
- Open questions
- Is collecting data from a public website against its terms of use 'неправомерно' obtaining access ('достъп') to an information system under Article 319a(1) when no security measure is overcome?
- What makes a case 'немаловажен случай' under Article 319a(1) when automated requests are repeated but do not damage the system?
What it makes you log
Logging duty
Article 319a defines the offence of unlawful access to an information system. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Unlawfully accessing an information system or a part of it, in a case that is not immaterial, carries imprisonment of up to six years and a fine of up to BGN 3,000. Where two or more people acted by prior agreement, the punishment is imprisonment of up to six years and a fine of up to BGN 5,000. Where the act is repeated, or targets data for creating an electronic signature, the punishment rises to imprisonment of up to seven years and a fine of up to BGN 20,000.
Where the information is a state secret or otherwise legally protected, or the system is part of critical infrastructure, the punishment is imprisonment of four to eight years, unless a heavier punishment applies. Where grave consequences result, the punishment is imprisonment of five to twelve years. Article 319a was added in 2002 and its first paragraph was amended in 2007, 2017 and 2022.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .