LexLint.ioBeta

Know the law your code answers to.

Law / Comoros

Penal Code, unauthorized access to an information system

Code pénal Loi n° 20-038/AU du 29 décembre 2020, promulguée par Décret n° 21-018/PR du 16 février 2021, Chapitre 4 (De la cybercriminalité), Section 2, art. 451

In force since .

A computer misuse rule binding public and private bodies.

Enforcement body
Ministère Public (public prosecutor), Union of the Comoros
Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not access, or attempt to access, any part of an information system without authorization.
  • Do not remain, or attempt to remain, within an information system once access is no longer authorized.
  • Do not alter, intercept, or use data obtained through unauthorized access to an information system.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Article 451 punishes fraudulent access or attempted access to an information system with one to two years' imprisonment and a fine of 500,000 to 5,000,000 Comorian francs; related articles in the same section (452 through 459) reach fraudulently remaining in a system, hindering or corrupting it, intercepting or altering data, or using fraudulently obtained data, with penalties escalating up to five to ten years' imprisonment and a fine of up to 10,000,000 Comorian francs.

Penalty structure

Figures given are for article 451 (unauthorized access) specifically; other Section 2 offenses (articles 452-459) carry their own, generally higher fixed ranges up to 10,000,000 KMF and are not aggregated into this figure.

Rule
Fixed only
As of
Minimum
500,000
Currency
KMF
Fixed cap
5,000,000

What it makes you log

Logging duty

Article 451 punishes fraudulently accessing or attempting to access all or part of an information system with one to two years of imprisonment and a fine of 500,000 to 5,000,000 Comorian francs. It imposes no duty to create, keep, produce or review a log or record. The Code's general rules on where it applies are not invoked by the article, so no territorial hook is read from it.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 451 of Chapter 4's Section 2 (Infractions spécifiques aux technologies de l'information et de la communication) punishes with one to two years' imprisonment and a fine of 500,000 to 5,000,000 Comorian francs whoever accesses or attempts to access, fraudulently, all or part of an information system.

Article 452 separately punishes fraudulently remaining or attempting to remain within all or part of a system, and articles 453 through 459 punish fraudulently hindering, corrupting, intercepting, altering, or forging data, or knowingly using fraudulently obtained data, or obtaining an advantage by any of those means.

None of these articles carries a public-page or authorization-test exception, so the chapter reads as a general unauthorized-access regime rather than one written with automated collection of published web content in mind.

When LexLint raises it

When your app profile says your app crawls the web.

Back to the example  ·  Lint your app

Page updated .