RomaniaCod penal, Art. 360-366, Infracțiuni contra siguranței și integrității sistemelor și datelor informatice (Offences Against the Security and Integrity of Computer Systems and Data)
Codul penal (Legea nr. 286/2009), art. 360-366
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/223635In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system in Romania without a right to do so, including for the purpose of obtaining data or where the system's access is technically restricted to certain users, per Cod penal art. 360.NIST AI RMFMAP 4.1
- Do not intercept, alter, or disrupt computer data or a computer system's functioning, and do not transfer data out of a computer system without authorization, per Cod penal arts. 361-364.NIST AI RMFMAP 4.1
- Do not produce, distribute, or possess a device, program, password, or access code intended to commit one of these offences, per Cod penal art. 365.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorized access to a computer system carries 3 months to 3 years' imprisonment or a fine, rising to 6 months to 5 years where the access was for obtaining data and to 2 to 7 years where the system was access-restricted (art. 360). Illegal interception, data-integrity alteration, and unauthorized data transfer each carry 1 to 5 years (arts. 361, 362, 364); disrupting a system's functioning carries 2 to 7 years (art. 363); dealing in an access-defeating device, program, password or code carries 6 months to 3 years' imprisonment or a fine, and possession for that purpose carries 3 months to 2 years' imprisonment or a fine (art. 365); attempt is punishable (art. 366).
Who enforces it
Settledness
- As of
- Open questions
- Does a person who requests pages from a server open to the public act 'fără drept' under Article 360(1) when the operator has granted no permission but has set no restriction?
- Does an IP block or a CAPTCHA make a system one 'la care, prin intermediul unor proceduri, dispozitive sau programe specializate, accesul este restricționat' under Article 360(3)?
What it makes you log
Logging duty
Articles 360 to 366 define offences of illegal access to a computer system, illegal interception, alteration of data, disruption of a system, illegal operations with devices and programs, and punish the attempt. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Unauthorized access to a computer system is punishable by 3 months to 3 years' imprisonment or a fine, rising to 6 months to 5 years where the access aimed at obtaining data and to 2 to 7 years where the system's access was technically restricted to certain categories of users, per art. 360.
Illegal interception of a non-public data transmission, alteration of the integrity of computer data, and unauthorized transfer of data from a computer system each carry 1 to 5 years' imprisonment, per arts. 361, 362 and 364. Disrupting a computer system's functioning carries 2 to 7 years, per art. 363.
Producing, importing, distributing or making available a device, program, password or access code for the purpose of committing one of these offences carries 6 months to 3 years' imprisonment or a fine, and mere possession of one of these items for that purpose carries 3 months to 2 years' imprisonment or a fine, per art. 365; an attempt at any of these offences is itself punishable, per art. 366.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .