PolandKodeks karny, Unauthorized Access to Information and Computer-Misuse Offenses
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19970880553/U/D19970553Lj.pdfIn force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Prohibition
- Audit expectation
- none
What it requires
- Do not bypass or circumvent an electronic, technical, magnetic, IT, or other special security measure to access data or an IT system not intended for you; unauthorized access under Kodeks karny Art. 267 carries a fine, restriction of liberty, or imprisonment up to 2 years.NIST AI RMFMAP 4.1
- Do not produce, obtain, sell, or supply a device, computer program, password, or access code adapted to commit an Art. 267, 268a, 269, or 269a offense; doing so is a separate offense under Art. 269b carrying imprisonment up to 5 years, unless you act solely to secure a system or to develop a securing method.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Art. 267(1)-(2): fine, restriction of liberty, or imprisonment up to 2 years for unauthorized access to information or to an IT system. Art. 268(1)-(2): fine, restriction of liberty, or imprisonment up to 2 years for destroying, damaging, deleting, or altering a record of significant information, rising to imprisonment up to 3 years where the record is on an IT data carrier; Art. 268(3) raises this to imprisonment from 3 months to 5 years where the act causes significant property damage. Art. 268a(1)-(2): imprisonment up to 3 years for destroying, damaging, deleting, altering, or hindering access to IT data or disrupting its automated processing, rising to imprisonment from 3 months to 5 years for significant property damage. Art. 269(1)-(2): imprisonment from 6 months to 8 years for the same conduct against IT data of special significance for national defense, communications security, or government or local-government functioning. Art. 269a: imprisonment from 3 months to 5 years for materially disrupting an IT system's or network's operation. Art. 269b(1): imprisonment from 3 months to 5 years for producing, obtaining, selling, or supplying a device, program, password, or access code adapted to commit the listed offenses; Art. 269b(1a) exempts a person acting solely to secure a system or develop a securing method. Prosecution of Arts. 267, 268, and 268a requires the victim's motion (wniosek) under Arts. 267(5), 268(4), and 268a(3); Arts. 269, 269a, and 269b are prosecuted without one.
Who enforces it
Settledness
- As of
- Open questions
- Does the retrieval of pages from a server that is open to the public, in breach of a ban on automated access in the operator's terms, amount to uzyskanie dostępu 'bez uprawnienia' to 'całości lub części systemu informatycznego' under Article 267 § 2?
- Does Article 267 § 2 require, as § 1 does, that a safeguard be 'przełamując albo omijając', or does it also reach access to a system that has no safeguard at all?
What it makes you log
Logging duty
Articles 267 to 269c define offences of unauthorised access to information and interference with data and systems. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 267 criminalizes obtaining unauthorized access to information not intended for the accessor by opening a sealed letter, connecting to a telecommunications network, or bypassing or circumventing an electronic, magnetic, IT, or other special safeguard protecting it, and separately criminalizes unauthorized access to the whole or part of an IT system, planting or using an eavesdropping, visual, or other device or software to obtain information, and disclosing information obtained that way.
Article 268 and 268a criminalize destroying, damaging, deleting, or altering a record of significant information or IT data, or hindering a person's or a system's ability to use it. Article 269 raises the penalty where the IT data affects national defense, communications security, or government or local-government functioning.
Article 269a criminalizes materially disrupting an IT system's or network's operation through unauthorized transmission, destruction, deletion, damage, hindrance, or alteration of data.
Article 269b criminalizes producing, obtaining, selling, or making available a device or computer program adapted to commit the offenses in Articles 165(1)(4), 267(1) to (3), 268a, 269, 269a, 270, or 270a, or a password, access code, or other data enabling unauthorized access to an IT system or network, with an exemption at Article 269b(1a) for a person acting solely to secure a system or to develop a securing method.
Article 269c exempts from punishment under Article 267(2) or Article 269a a person who acts solely to secure a system or to develop a securing method, promptly notifies the system's operator of the threats found, and neither harms a public or private interest nor causes damage. The Code took effect on . The Act of inserted Article 268a. That Act set out Article 269 anew. That Act also inserted Articles 269a and 269b. That Act took effect on .
The Act of set out Article 267 anew. That Act also set out Article 269a anew. That Act took effect on . The Act of inserted Article 269c. That Act took effect on .
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .