RussiaCriminal Code Article 272, Unauthorized Access to Computer Information
Criminal Code of the Russian Federation, Art. 272 (No. 63-FZ, 1996)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access computer information protected by Russian law without authorization in a way that destroys, blocks, modifies, or copies it, under Criminal Code Article 272; a version of this offense committed for gain, by a group, or causing grave consequences carries escalating fines up to 500,000 rubles and imprisonment up to 7 years.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorized access causing destruction, blocking, modification, or copying of protected computer information: base offense punishable by a fine up to 200,000 rubles (or income for up to 18 months), corrective labor up to 1 year, restriction of freedom up to 2 years, forced labor up to 2 years, or imprisonment up to 2 years. The same act causing significant damage or committed for mercenary gain: fine of 100,000 to 300,000 rubles (or income for 1 to 2 years), corrective labor 1 to 2 years, restriction of freedom up to 4 years, forced labor up to 4 years, or imprisonment up to 4 years. Committed by a group by prior conspiracy, an organized group, or using an official position: fine up to 500,000 rubles (or income for up to 3 years) with disqualification up to 3 years, restriction of freedom up to 4 years, forced labor up to 5 years, or imprisonment up to 5 years. Any of the above causing grave consequences or the threat of them: imprisonment up to 7 years.
Penalty structure
The four tiers of Criminal Code Article 272 escalate from a fine up to 200,000 rubles (base offense) through 100,000-300,000 rubles (significant damage or mercenary motive), up to 500,000 rubles (group, organized group, or official position, also carrying imprisonment up to 5 years), to imprisonment up to 7 years with no separate fine specified for the grave-consequences tier.
- Rule
- Fixed only
- As of
- Currency
- RUB
- Fixed cap
- 500,000
What it makes you log
Logging duty
Article 272 punishes unlawful access to legally protected computer information that results in its destruction, blocking, modification or copying, with higher penalties for major damage, gain, groups, official position and grave consequences. It states an offence and penalties and imposes no duty to create, keep or produce a log or record. The article names no territorial reach, and the Criminal Code's general rules on where it applies are not cited by this row.
- Kind
- None
- As of
What this law does
Article 272 criminalizes unauthorized access to legally protected computer information where the act causes destruction, blocking, modification, or copying of that information, with four escalating penalty tiers keyed to significant damage or mercenary motive, commission by a group or through an official position, and grave consequences.
The article, as currently in force, dates its main structure to Federal Law No. 420-FZ of and was most recently amended by Federal Law No. 421-FZ of , which excepted conduct already covered by the newer Article 272.1 on unlawful handling of personal data.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .