GermanySchutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures)
Urheberrechtsgesetz (UrhG), §§ 95a, 95b
In force since .
A copyright and text and data mining (TDM) rule binding public and private bodies.
- Obligation class
- Access restriction, Prohibition, TDM
- Audit expectation
- none
As of .
What it requires
- Do not circumvent an effective technical measure protecting a work or other protected subject matter without the rightholder's consent, where you know or ought to know that the circumvention is meant to give access to it or to enable its use.NIST AI RMFMAP 4.1
- Do not manufacture, import, distribute, sell, rent, advertise for sale or rental, or possess for commercial purposes, a device, product or component, or provide a service, that is marketed to circumvent effective technical measures, has only a limited commercial purpose beyond circumvention, or is mainly designed or provided to enable or facilitate circumvention.no control in the NIST AI RMF
- Where you apply technical measures to a work, give the beneficiaries of the listed copyright exceptions, including text and data mining under section 44b, who have lawful access to the work, the means needed to use the exception to the extent required; an agreement excluding this duty is void.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text, as of . Also read by: Case C-355/12 Nintendo Co. Ltd and Others v PC Box Srl and 9Net Srl, judgment of (Fourth Chamber) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-10Intellectual Property
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 108b(1): imprisonment of up to one year or a fine for circumventing an effective technical measure without the rightholder's consent, intending to gain access to a protected work or its use for oneself or a third party, unless the act is solely for private use. Section 108b(2): the same penalty for commercially manufacturing, importing, distributing, selling or renting circumvention devices contrary to section 95a(3). Section 108b(3): imprisonment of up to three years or a fine where the offender acts commercially in the cases of paragraph 1.
Penalty structure
Administrative fine of up to EUR 50,000 for selling, renting or distributing circumvention devices contrary to section 95a(3), or for commercially possessing or advertising them or providing services, and for failing to provide a necessary means contrary to section 95b(1); up to EUR 10,000 in the remaining cases of section 111a(1).
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 50,000
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0355
- Case citation
- Case C-355/12 Nintendo Co. Ltd and Others v PC Box Srl and 9Net Srl, judgment of (Fourth Chamber)
- Open questions
- Does a login, a CAPTCHA or a rate limit count as a 'Zugangskontrolle' or 'Schutzmechanismus' that makes a technical measure 'wirksam' under Section 95a(2)?
- Is a measure that blocks only some uses of a protected work 'wirksam' if it must 'die Erreichung des Schutzziels sicherstellen' under Section 95a(2)?
What it makes you log
Logging duty
Section 95a forbids circumventing effective technical measures and trafficking in circumvention devices, and section 95b obliges a rightholder to provide the means to use listed exceptions. Neither imposes a duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Effective technical measures protecting a work or other protected subject matter may not be circumvented without the rightholder's consent where the person knows or ought to know that the circumvention is meant to give access to it or to enable its use. A technical measure is effective where the rightholder controls use of the work through an access control, a protection mechanism such as encryption, distortion or other transformation, or a copy-control mechanism.
Manufacture, import, distribution, sale, rental and advertising for sale or rental, commercial possession of devices, products or components, and the provision of services, are forbidden where they are marketed to circumvent such measures, have only a limited commercial purpose beyond circumvention, or are mainly designed or provided to enable or facilitate it.
A rightholder that applies technical measures must give the beneficiaries of the listed copyright exceptions, which include text and data mining under section 44b, the means to use them to the extent required, where they have lawful access to the work. An agreement excluding that obligation is void.
Circumventing an effective technical measure to gain access to a protected work or its use, other than solely for the offender's own private use, is punishable by imprisonment of up to one year or a fine. Where the offender acts commercially the penalty is imprisonment of up to three years or a fine.
Selling, renting or distributing circumvention devices beyond the offender's personal circle, or possessing or advertising them for commercial purposes, is an administrative offence punishable by a fine of up to EUR 50,000.
When LexLint raises it
When your app profile says your app crawls the web or trains models.