BermudaComputer Misuse Act 1996, unauthorised access and modification offences
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not cause a computer to perform any function to secure access to a program or data without being entitled to control that access or having the consent of someone who is, and knowing the access is unauthorised.NIST AI RMFMAP 4.1
- Do not modify computer material, or cause a computer to cease to function, without authorisation.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorised access (section 3) is liable on summary conviction to imprisonment for six months or a fine of $6,000, or both. Unauthorised access with intent to commit a further offence (section 4), unauthorised modification (section 5), and causing a computer to cease to function (section 6A) are each liable on summary conviction to imprisonment for six months or a fine of $6,000, or both, and on conviction on indictment to imprisonment for five years or a fine of $20,000, or both.
Penalty structure
Sections 4, 5 and 6A cap a fine at $20,000 (five years' imprisonment) on conviction on indictment; the base unauthorised-access offence under section 3 carries a lower $6,000 summary-only cap (six months' imprisonment).
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 20,000
What it makes you log
Logging duty
Sections 3 to 6A define the offences of unauthorised access, access with intent to commit a further offence, unauthorised modification and causing a computer to cease to function. They impose no duty to create, keep, produce or review a log or record. Section 7 gives the Act effect where the accused was in Bermuda or the computer was in Bermuda; the limb that turns on where the computer sits is not coded.
- Kind
- None
- As of
What this law does
Section 3 makes it an offence for a person, knowing the access is unauthorised, to cause a computer to perform any function with intent to secure access to a program or data held in any computer, whether or not the intent is directed at a particular program, data or computer. Access is unauthorised only if the person is not entitled to control access of that kind and lacks the consent of someone who is, so authorisation rather than a technical measure is what the Act tests.
Section 4 aggravates the offence where the unauthorised access is committed with intent to commit or facilitate a further indictable offence. Section 5 separately criminalises unauthorised modification of computer material, and section 6A unauthorised conduct causing a computer to cease to function permanently or temporarily. The provisions this entry describes came into force on different days. Its date of assent is recorded as .
The Interpretation Act 1951 provides that, absent an express commencement date or a commencement notice, an Act comes into operation on the day it is assented to.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .