GeorgiaCriminal Code, unauthorised access and interference with computer data and systems
Criminal Code of Georgia, Chapter XXXV (Cybercrime), Arts. 284-286
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system, or copy, alter, or output data from it, without authorisation from the person who holds the right to grant that access.
- Whether reading a public, unauthenticated page without registration or login falls within this offence is unsettled under Georgian law; treat a target that is a critical information system subject as carrying materially higher exposure.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Articles 284 and 286 carry a base tier of a fine, corrective labour up to two years, or imprisonment for the same term; Article 285's base tier adds imprisonment up to three years. Each article's aggravated tier (group, official position, repetition, or substantial damage) reaches imprisonment of two to five years (Art. 284), three to six years (Art. 285), or three to five years (Art. 286); each article's critical-information-system-subject tier reaches imprisonment of three to six years (Art. 284), four to seven years (Art. 285), or four to seven years (Art. 286).
What it makes you log
Logging duty
Article 284 punishes unauthorised access to a computer system, with higher terms for a group, an official position, repetition, substantial damage or a critical information system subject. Article 285 covers unauthorised making, purchase, storage, sale or dissemination of tools and access codes for these crimes, and Article 286 covers damaging, deleting, modifying or concealing computer data. None of the three requires a log or record to be made, kept, produced or reviewed, and the articles state no territorial clause of their own.
- Kind
- None
- As of
What this law does
Article 284 punishes unauthorised access to a computer system by a fine or corrective labour of up to two years, or imprisonment for the same term, rising to imprisonment of two to five years for access committed by a group, using an official position, repeatedly, or resulting in substantial damage (over GEL 2,000), and to imprisonment of three to six years where the target is a critical information system subject.
Article 285 punishes unauthorised making, purchase, storage, sale, or dissemination of software, a password, an access code, or similar data for the purpose of committing a Chapter XXXV offence, by a fine or corrective labour of up to two years and/or imprisonment of up to three years, rising to three to six years for the aggravating circumstances listed above and to four to seven years against a critical information system subject.
Article 286 punishes unauthorised damage, deletion, modification, or concealment of computer data by a fine or corrective labour of up to two years and/or imprisonment for the same term, rising through the same aggravating tiers to three to five years and, against a critical information system subject, four to seven years.
The chapter's own note defines 'unauthorised' as illegal access or use, including where the right holder has not directly or indirectly transferred the right, without requiring that a technical security measure be defeated; because of that, and because no reported Georgian case addresses the point, whether reading a public, unauthenticated page without registration or login falls within these offences is unsettled rather than settled either way.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .