LexLint.ioBeta

Know the law your code answers to.

Law / Slovenia

Kazenski zakonik (KZ-1, Criminal Code), Art. 221, Napad na informacijski sistem (Attack on an Information System)

KZ-1, Art. 221

In force since .

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not enter or break into an information system without authorization, and do not intercept data without authorization during its non-public transmission into or out of an information system.
  • Do not use, alter, copy, transfer, or destroy data in an information system without authorization, and do not obstruct the transfer of or access to data or the operation of an information system.

These lines are LexLint's reading of the law's text. Also read by: Višje sodišče v Ljubljani, sodba VII Kp 19596/2015 z dne 6. junija 2017 (evidenčna številka VSL00002880) (recorded ).

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Imprisonment up to two years for unauthorized entry into, or interception of data transmitted to or from, an information system (KZ-1 Art. 221(1)); imprisonment up to three years for unauthorized use, alteration, copying, transfer, or destruction of data, or for obstructing the transfer of or access to data or the operation of the system (Art. 221(2)); imprisonment from three months to four years where the paragraph 2 offense, committed with tools of the kind described in Article 306(3), obstructs operation or otherwise affects three or more information systems (Art. 221(3)); and imprisonment from three months to five years where the paragraph 2 offense causes significant damage, is committed in a criminal association, is committed against the information system of a critical infrastructure operator, or is committed against the information system of a person bound by the law on information security (Art. 221(4)).

Who enforces it

Settledness

As of
Case link
https://www.sodnapraksa.si/?q=VII+Kp+19596%2F2015
Case citation
Višje sodišče v Ljubljani, sodba VII Kp 19596/2015 z dne 6. junija 2017 (evidenčna številka VSL00002880)
Open questions
  • Does the first paragraph of Article 221 require that the person entering overcome a technical barrier, as the Higher Court in Ljubljana reasoned in its judgment VII Kp 19596/2015, or does 'neupravičeno vstopi' also reach entry to a publicly available system in breach of the operator's terms?
  • Does automated retrieval that slows a system without disabling it 'ovira ... delovanje informacijskega sistema' under the second paragraph of Article 221?

What it makes you log

Logging duty

Article 221 makes it an offence to enter or break into an information system, to intercept data in non-public transmission, and to use, change, copy, destroy or introduce data or hinder the operation of the system without justification. It imposes no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 221 criminalizes unauthorized entry into, or breaking into, an information system, and unauthorized interception of data during its non-public transmission into or out of the system (paragraph 1); it separately criminalizes the unauthorized use, alteration, copying, transfer, or destruction of data in an information system, unauthorized entry of data into one, or obstructing the transfer of or access to data or the operation of the system (paragraph 2).

Paragraph 3 sets a higher penalty where the paragraph 2 act, committed with tools of the kind described in Article 306(3), obstructs operation or otherwise affects three or more information systems.

Paragraph 4 sets a higher penalty where the paragraph 2 act causes significant damage, is committed in a criminal association (hudodelska združba), is committed against the information system of a critical infrastructure operator, or is committed against the information system of a person bound by the law on information security. The current wording comes from the 2021 amendment KZ-1I (Uradni list RS No. 186/21, Article 29), which changed all four paragraphs.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .