RussiaCriminal Code Article 274.1, Unlawful Impact on Critical Information Infrastructure
Criminal Code of the Russian Federation, Art. 274.1 (added 2017)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Security
- Audit expectation
- none
What it requires
- Do not create, distribute, or use malicious computer programs, or gain unauthorized access to protected information, aimed at Russia's critical information infrastructure, under Criminal Code Article 274.1; a version committed by a group or causing grave consequences carries imprisonment up to 10 years.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Creation, distribution, or use of malware aimed at critical information infrastructure: forced labor up to 5 years (with or without restriction of freedom up to 2 years) or imprisonment 2 to 5 years, plus a fine of 500,000 rubles to 1,000,000 rubles (or income for 1 to 3 years). Unauthorized access to protected information in critical information infrastructure causing destruction, blocking, modification, or copying: forced labor up to 5 years with the same fine, or imprisonment 2 to 6 years with the same fine. Violation of operating or access rules causing the same result: forced labor up to 5 years with optional disqualification up to 3 years, or imprisonment up to 6 years with the same disqualification. Committed by a group, organized group, or using an official position: imprisonment 3 to 8 years with optional disqualification up to 3 years. Any tier causing grave consequences: imprisonment 5 to 10 years with optional disqualification up to 5 years.
Penalty structure
Fine tiers run 500,000 to 1,000,000 rubles for the malware and unauthorized-access offenses (parts 1-2), alongside imprisonment ranging 2 years up to a maximum of 10 years for the grave-consequences tier (part 5), which carries no separate fine.
- Rule
- Fixed only
- As of
- Currency
- RUB
- Fixed cap
- 1,000,000
What it makes you log
Logging duty
Article 274.1 punishes creating or using programs aimed at the critical information infrastructure, unlawful access to protected information held in it, and breaking the operating and access rules for its systems, with higher penalties for groups, official position and grave consequences. It states offences and penalties and imposes no duty to create, keep or produce a log or record. The note to the article releases a person who committed the part 3 offence from liability if they actively helped detect and investigate it, including by taking the necessary measures to preserve the traces of the unlawful impact on the infrastructure; that is a condition of release, not a duty on anyone, and it sets no period or form. The article names no territorial reach.
- Kind
- None
- As of
What this law does
Article 274.1, added by Federal Law No. 194-FZ of , criminalizes creating or using malicious software aimed at Russia's critical information infrastructure, unlawful access to protected information held in it, and violating the operating or access rules for systems classified as critical information infrastructure, across five escalating tiers running from forced labor up to five years to imprisonment of five to ten years for grave consequences.
A 2026 amendment added a cooperation-based exemption from liability for a person who actively assists the investigation.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .