SerbiaCriminal Code, Offences Against the Security of Computer Data
Krivicni zakonik (Criminal Code), Official Gazette RS No. 85/2005 et seq., Arts. 298-304a
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer, computer network, or electronic data processing system by circumventing a protection measure, without authorisation.NIST AI RMFMAP 4.1
- Do not use, record, or further distribute data obtained by circumventing a protection measure without authorisation.NIST AI RMFMAP 4.1
- Do not delete, alter, damage, or conceal computer data or a program without authorisation.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unauthorised access under Art. 302(1) carries a fine or imprisonment up to six months, rising to up to two years for using the data obtained (Art. 302(2)) and up to five years for a hold-up, serious malfunction, or other grave consequence (Art. 302(3)).
What it makes you log
Logging duty
Chapter Twenty Seven's articles 298 to 304 criminalize damaging computer data and programs, computer sabotage, creating and introducing computer viruses, computer fraud, unauthorised access to a computer, computer network or electronic data processing, preventing access to a public network, and unauthorised use of a computer or network. Each states an offence and a penalty and none requires anyone to create, keep or produce a log or record. The chapter names no territorial reach of its own.
- Kind
- None
- As of
What this law does
Article 302 punishes whoever, by circumventing protection measures, accesses a computer, computer network, or electronic data processing without authorisation, with a fine or imprisonment up to six months, rising to up to two years for using data obtained that way, and up to five years where the offence causes a hold-up or serious malfunction.
Article 298 separately punishes unauthorised deletion, alteration, damage or concealment of computer data or a program, and Article 304a punishes producing, procuring, or distributing devices or access codes designed for committing an offence under Arts. 298 to 303. Because Article 302's offence is triggered by circumventing a protection measure, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
The consolidated Criminal Code, per the WIPO Lex record's own metadata, entered into force on ; the chapter has since been carried through further gazetted amendments up to 94/2016.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .