MonacoTechnological Crime Law: Vital-Importance Operator Incident Reporting
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the same vital-importance operators as the security regime of Articles 26 to 29 of the Loi: an operator designated as being of vital importance, reached by declaring that you operate an essential service.
- Notify the Agence Monégasque de Sécurité Numérique without delay of any incident with a significant impact on the service your vital information system provides, on the Annex III declaration form (Article 4 of Arrêté ministériel n° 2018-1053); the text states no number of hours.
- Inform the Minister of State without delay of incidents affecting the functioning or security of your information systems (Article 28 of the Loi).
- Tell the recipients of your services who are potentially affected by a significant cyber threat, without delay, of the measures or corrections they can apply in response, and of the threat itself (Article 4).
- Notify the Direction de la Sûreté Publique without delay, with the technical evidence of compromise, where there is reason to suspect that the incident originates in an offence under the Code pénal (Article 4-1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 29 of the Loi punishes the directors of a vital-importance operator with a fine of 150,000 euros for failing to inform the Minister of State of incidents affecting its information systems; a corporate entity found responsible incurs a fine of five times that amount, which is 750,000 euros.
Penalty structure
Article 29 of the Loi, as amended by Loi n° 1.578 du 1er juillet 2025, sets a fine of 150,000 euros on the directors of a vital-importance operator for failing to report an incident, and a fine of five times that amount, 750,000 euros, on a corporate entity found responsible.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 750,000
Who enforces it
Enforcement body
The Agence Monégasque de Sécurité Numérique, which receives the notifications, with the Minister of State and, for incidents suspected to be offences, the Direction de la Sûreté Publique.
Settledness
- As of
- Open questions
- How many hours is sans délai (without delay) in Article 4 of Arrêté ministériel n° 2018-1053, which states no number of hours?
What this law does
Article 28 of the Loi requires a vital-importance operator to inform the Minister of State without delay of incidents affecting the functioning or security of its information systems. Article 4 of Arrêté ministériel n° 2018-1053, as replaced by Arrêté ministériel n° 2023-556, requires the operator to notify the Agence Monégasque de Sécurité Numérique without delay of any incident with a significant impact on the service its vital information system provides, on the form in Annex III.
Article 4 treats an incident as significant if it caused or is likely to cause serious operational disruption or financial loss, or considerable harm to other persons, or if it falls within a type of incident listed in Annex VII. Article 4 also requires the operator to tell the recipients of its services who are potentially affected by a significant cyber threat, without delay, of the measures or corrections they can apply in response.
Article 4-1 requires the operator to notify the Direction de la Sûreté Publique without delay where there is reason to suspect that the incident originates in an offence under the Code pénal. Article 4-1 lets the Agency, after consulting the entity concerned, inform the public of the incident or require the entity to do so.
Article 4-2, created by Arrêté ministériel n° 2025-533, makes an operator that has not met the duties in the first paragraphs of Articles 4 and 4-1 liable to the sanctions of Article 29 of the Loi. Article 29 of the Loi fines the directors of a vital-importance operator 150,000 euros for failing to inform the Minister of State of such incidents.
When LexLint raises it
When your app profile says your app runs an essential service.