Ley No. 1042, interference with and damage to computer systems, as reformed by Ley No. 1219
Ley No. 1042, as reformed by Ley No. 1219 (2024), arts. 8-10
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not interfere with, alter, damage, or disable a computer system or the data it holds.no control in the NIST AI RMF
- Do not violate a computer system's security to destroy, alter, duplicate, or damage the data, processes, or their integrity, availability, or confidentiality.NIST AI RMFMAP 4.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 8: imprisonment of four to seven years and 300 to 600 day-fines, rising to seven to fifteen years and 600 to 1,000 day-fines for a State or critical-service system. Article 9: imprisonment of seven to fifteen years and 600 to 1,000 day-fines. Article 10: imprisonment of four to seven years and 300 to 600 day-fines, rising to seven to fifteen years and 600 to 1,000 day-fines where the target holds personal or sensitive personal data.
What it makes you log
Logging duty
Los articulos 8, 9 y 10 tipifican la interferencia con el funcionamiento de un sistema informatico o sus datos, la alteracion o dano de datos y el dano a sistemas informaticos; no imponen deber alguno de crear, conservar, exhibir o revisar un registro. In English: articles 8, 9 and 10 define the offences of interfering with a computer system or its data, altering or damaging data, and damaging computer systems, and impose no duty to create, keep, produce or review a log or record. The reformed article 2 applies the Act to offences committed within or outside the national territory under the principle of universality without naming a presence or effects test, so no hook value is set.
- Kind
- None
- As of
What this law does
As reformed by Ley No. 1219, article 8 punishes intentionally interfering with or altering the operation of a computer system or its data, temporarily or permanently, with imprisonment of four to seven years and 300 to 600 day-fines, rising to seven to fifteen years and 600 to 1,000 day-fines where the target is a State system or one serving health, communications, financial, energy, water, transport, port, airport, public-safety, social-security, or education services.
Article 9 punishes violating a computer system's security to destroy, alter, duplicate, disable, or damage its data, processes, or their integrity, availability, or confidentiality, with imprisonment of seven to fifteen years and 600 to 1,000 day-fines.
Article 10 punishes destroying, damaging, modifying, or disabling a computer system or its components, with imprisonment of four to seven years and 300 to 600 day-fines (six months to one year and 200 to 500 day-fines where committed recklessly), rising to seven to fifteen years and 600 to 1,000 day-fines where the target serves public or financial services or holds personal data, sensitive personal data, or reserved information.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .