MaliLoi n° 2019-056, accès et maintien frauduleux à un système d'information
Loi n° 2019-056 du 5 décembre 2019 portant répression de la cybercriminalité arts. 4-5 (accès et maintien frauduleux à un système d information)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or attempt to access, an information system by an irregular mode of penetration, and do not remain, or attempt to remain, in an information system once access to it is irregular.
- The statute does not state that unauthorized access must defeat a technical security measure, so reading a public, unauthenticated page could fall inside a broad reading of 'irregular penetration' even without circumventing any access control.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of two months to one year and a fine of 200,000 to 5,000,000 CFA francs, or either penalty, rising to imprisonment of two months to two years and a fine of 1,000,000 to 10,000,000 CFA francs where the access or presence results in deleting or altering data or impairing the system's operation (arts. 4-5).
Penalty structure
Base tier under articles 4 and 5 for a fraudulent access or presence that causes no further harm. The fine rises to 1,000,000-10,000,000 CFA francs, with imprisonment of two months to two years, where the access or presence results in deleting or altering data or impairing the system's operation.
- Rule
- Fixed only
- As of
- Minimum
- 200,000
- Currency
- XOF
- Fixed cap
- 5,000,000
What it makes you log
Logging duty
Articles 4 and 5 punish fraudulent access, or attempted access, to and remaining in an information system (in French: "whoever fraudulently accesses or attempts to access all or part of an information system is punished"). Neither requires a log or record. Other articles of the same law, outside the sections this row cites, require public electronic communication service providers to keep data identifying content contributors (art. 26) and let a prosecutor order data preserved for up to two years (art. 82). Territorial reach comes from the act's own article 2, which applies the law to offences committed in whole or in part on Malian territory by information technology and to offences in cyberspace whose effects occur on national territory.
- Kind
- None
- As of
What this law does
Article 4 punishes anyone who accesses or attempts to access, fraudulently, all or part of an information system, with imprisonment of two months to one year and a fine of 200,000 to 5,000,000 CFA francs, or either penalty, and raises the penalty to two months to two years' imprisonment and a fine of 1,000,000 to 10,000,000 CFA francs where the access results in deleting or altering data or impairing the system's operation.
Article 5 punishes fraudulently remaining or attempting to remain in all or part of an information system on the same terms.
Article 3 defines fraudulent access as any irregular mode of penetration of an automated data-processing system, a definition that does not itself require defeating a technical security measure, so whether it reaches a person who reads a public, unauthenticated page without circumventing any access control turns on how 'irregular' is construed rather than on a stated security-measure element.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .