BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or remain present in, a computer system without right; the penalty escalates where the access or presence is aggravated by fraudulent intent, exceeds an authorized level of access with fraudulent intent or intent to harm, results in data being suppressed or modified, or is committed in violation of the system's security measures.NIST AI RMFMAP 4.1
- Do not intercept, divulge, use, alter, or misappropriate computer data during its non-public transmission to, from, or within a computer system.NIST AI RMFMAP 4.1
- Do not cause an interruption of a computer system's normal operation, or damage, delete, deteriorate, alter, or suppress computer data, without right.no control in the NIST AI RMF
- Do not produce, sell, obtain for use, import, export, distribute, or otherwise make available a device, including computer data or computer programs, principally designed or adapted to permit the commission of an offense in Title I of this Book.no control in the NIST AI RMF
- Do not falsify computer data by introducing, modifying, altering, or erasing data stored, processed, or transmitted by a computer system.no control in the NIST AI RMF
- A search-engine provider that wants the Code's liability exemption must not originate the transmission, select its recipient, or select or modify the information in it; a host that wants it must either promptly inform the police or judicial services of specific illegal information or activity it knows of, or promptly remove or disable access after receiving a removal injunction from them.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Base offense (Art. 507 alinéa 1, unauthorized access or continued unauthorized presence): one to five years' imprisonment and a fine of 500,000 to 1,000,000 CFA francs, or either penalty alone. The aggravated forms (alinéa 2, fraudulent intent; alinéa 3, exceeding an authorized access level with fraudulent intent or intent to harm) draw two to five years' imprisonment and a fine of 500,000 to 2,000,000 CFA francs, or either penalty alone. Where any of these three forms results in the suppression, obtaining, or modification of the system's data, or an alteration of the system's operation, the penalty just described is doubled (alinéa 4). Independently, where any of the three base forms is committed in violation of the system's own security measures, the penalty is instead ten to twenty years' imprisonment (réclusion criminelle) and a fine of 5,000,000 to 500,000,000 CFA francs (alinéa 5); this is the instrument's statutory ceiling.
Penalty structure
Art. 507 is tiered: the base offense (alinéa 1, unauthorized access or continued presence) draws 500,000 to 1,000,000 CFA francs; the aggravated forms (alinéa 2, fraudulent intent; alinéa 3, exceeding an authorized access level with fraudulent intent or intent to harm) draw 500,000 to 2,000,000 CFA francs; any of these three forms resulting in data suppression, obtaining, modification, or system alteration doubles the fine just described (alinéa 4, up to 4,000,000 CFA francs); and any of the three base forms committed in violation of the system's security measures instead draws 5,000,000 to 500,000,000 CFA francs (alinéa 5), the instrument's ceiling. Each tier carries a matching imprisonment range.
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- XOF
- Fixed cap
- 500,000,000
Who enforces it
Enforcement body
Beninese public prosecution and the criminal courts, with the Agence Nationale de Sécurité des Systèmes d'Information (ANSSI-Bénin) responsible for overseeing information-systems security
Settledness
- As of
- Open questions
- Does a website operator's refusal in its terms of use or in robots.txt withhold the "autorisation en vertu d’une loi, d’un contrat et/ou de l’entité privée ou publique compétente" (authorization under a law, a contract and/or by the competent private or public entity) that the Code's definition of "sans droit" turns on, so that an automated request for a publicly accessible page is access "sans droit" under Article 507?
- Does an automated request that exceeds a site's published rate limits "outrepasse son pouvoir d'accès légal" (exceed one's lawful power of access) under the third paragraph of Article 507, or does that phrase reach only an authorized user who goes beyond the privileges granted?
What it makes you log
Logging duty
Articles 505 to 512 of Book VI set the search-engine and host liability conditions and define the offences of unlawful access, data and system interference, device misuse and computer forgery. They impose no duty to create, keep, produce or review a log or record. Article 495 (online service providers keep identification data of content contributors) and Article 500 (access providers and online services report illegal activity and publish the means they devote to the fight) sit in the same Book but are not provisions this row covers.
- Kind
- None
- As of
What this law does
Benin's general computer-misuse title, part of the cybercriminality and cybersecurity Book of the Digital Code.
Article 507 punishes intentionally and without right accessing or remaining present in all or part of a computer system with one to five years' imprisonment and a fine of 500,000 to 1,000,000 CFA francs, or either penalty alone; the aggravated form committed with fraudulent intent, and exceeding one's lawful power of access to a computer system with fraudulent intent or intent to harm, are each punished at two to five years' imprisonment and a fine of 500,000 to 2,000,000 CFA francs, or either penalty alone.
Where any of these three forms results in the suppression, obtaining, or modification of the system's data, or an alteration of the system's operation, the penalty just described is doubled; where instead any of the three is committed in violation of the system's own security measures, the offense draws a separate, harsher penalty of ten to twenty years' imprisonment (réclusion criminelle) and a fine of 5,000,000 to 500,000,000 CFA francs (Art. 507).
Article 508 separately punishes intercepting, divulging, using, altering, or misappropriating computer data during its non-public transmission; Article 509 punishes causing an interruption of a computer system's normal operation; Article 510 punishes damaging, deleting, deteriorating, altering, or suppressing computer data; Article 511 punishes producing, selling, obtaining for use, importing, exporting, distributing, or otherwise making available a device, including computer data or computer programs, principally designed or adapted to permit the commission of one or more offenses in Title I of this Book; Article 512 punishes falsifying computer data by introducing, modifying, altering, or erasing it.
Two liability exemptions sit earlier in the same Book: a provider of a search engine or content index is not liable for its search results, provided it does not originate the transmission, does not select its recipient, and does not select or modify the information in it (Article 505); and an online host is not liable for information stored at a user's request, provided that either it promptly informs the police or judicial services when it learns of specific illegal information or activity, taking only measures that prevent access until they decide, or it promptly removes or disables access after receiving a removal injunction from those services, the exemption not applying where the recipient of the service acts under the host's authority or control (Article 506).
The title does not define "without right" for a public, unauthenticated web page specifically, and no Beninese court decision construing these articles in that context was located. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .