MonacoTechnological Crime Law: Vital-Importance Operator Information-Systems Security Regime
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a vital-importance operator (opérateur d'importance vitale), a public or private operator designated as being of vital importance because it is active in a sector essential to Monaco's institutions, public services or economic activity, or because it operates establishments or installations whose unavailability would risk significantly affecting those interests; it is reached by declaring that you operate an essential service.
- Apply, at your own expense, the security rules that the Minister of State sets by arrêté ministériel for the protection of your information systems (Article 28 of the Loi).
- Draw up, keep current and implement an information-systems security policy that covers your vital information systems, and carry out the security accreditation of each of them (Annex I, rules 1 and 2, of Arrêté ministériel n° 2018-1053).
- Send the Agence Monégasque de Sécurité Numérique, within three months of your designation, the list of your vital information systems with the declaration form for each (Article 2 of that arrêté).
- Send the Agency each year the updates to that list and, by 31 December, the tables assessing the security level of each vital information system (Articles 3 and 3-1 of that arrêté).
- When the Minister of State asks, submit your information systems to the checks that the Agency carries out to verify the level of security and compliance with the rules, at your own cost (Article 28 of the Loi).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 29 of the Loi punishes the directors of a vital-importance operator with a fine of 150,000 euros for each of the failures it lists, among them failing to apply the security rules required by Article 28 and failing to submit to the checks Article 28 provides for; a corporate entity found responsible incurs a fine of five times that amount, which is 750,000 euros.
Penalty structure
Article 29 of the Loi, as amended by Loi n° 1.578 du 1er juillet 2025, sets a fine of 150,000 euros on the directors of a vital-importance operator for each listed failure, and a fine of five times that amount, 750,000 euros, on a corporate entity found responsible.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 750,000
Who enforces it
Enforcement body
The Agence Monégasque de Sécurité Numérique, the specialised administrative authority created under Article 24 of the Loi, which receives the declarations and carries out the checks, with the Minister of State setting the rules and issuing formal notices.
Settledness
- As of
- Open questions
- Which operators are designated, given that the list is notified only to the persons who need to know it and is not published?
- What do the sector-specific annexes V to VII of Arrêté ministériel n° 2018-1053 require, given that they are notified to each operator and not published?
What this law does
Article 27 of the Loi requires the Minister of State to set, by arrêté ministériel, the security rules needed to protect the information systems of vital-importance operators.
Article 27 defines a vital-importance operator as a public or private operator active in a sector essential to the functioning of institutions and public services, to economic activity or to life in the Principality, or operating establishments or installations whose unavailability would risk significantly affecting those interests.
Article 2 of Arrêté ministériel n° 2023-394 treats an operator as of vital importance when it is the only provider of a service essential to critical societal or economic activities, when a disruption of its service could seriously affect public security, public safety or public health, when a disruption could induce a significant systemic risk, or when the operator is nationally important for its sector or for interdependent sectors.
Article 3 of that arrêté provides that the list of vital-importance operators is not published and is notified only to the persons who need to know it. Article 28 of the Loi requires a vital-importance operator to apply the security rules at its own expense. Article 28 of the Loi requires a vital-importance operator, when the Minister of State asks, to submit its information systems to checks by the specialised authority at its own cost.
Article 2 of Arrêté ministériel n° 2018-1053 requires each vital-importance operator to send the Agence Monégasque de Sécurité Numérique, within three months of its designation, the list of its vital information systems with a declaration form for each. Article 3-1 of that arrêté, created by Arrêté ministériel n° 2025-533, requires the operator to send the Agency each year, by 31 December, the tables assessing the security level of each of its vital information systems.
Rule 1 of Annex I to that arrêté requires the operator to draw up, keep current and implement an information-systems security policy covering its vital information systems. Rule 2 of Annex I requires the operator to carry out the security accreditation of each vital information system.
Article 1 of that arrêté provides that an operator that has not applied the security rules receives a formal notice from the Minister of State fixing a deadline, and that missing the new deadline is punishable under Article 29 of the Loi. Article 29 of the Loi, as amended by Loi n° 1.578 du 1er juillet 2025, fines the directors of a vital-importance operator 150,000 euros for failing to apply the security rules required by Article 28.
Article 29 of the Loi sets the fine for a corporate entity found responsible at five times the amount set for the directors.
When LexLint raises it
When your app profile says your app runs an essential service.