San MarinoComputer Crimes Law, Unlawful Access to Computer or Telematics Systems
Legge 23 agosto 2016 n. 114 (Computer Crimes), art. 2, inserting art. 182-bis of the Criminal Code
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not unlawfully enter, or remain against the will of the party entitled to exclude you in, a computer or telematics system protected by a security measure, under Criminal Code art. 182-bis.NIST AI RMFMAP 4.1
- Reading a public, unauthenticated page without defeating any security measure has not itself been held to violate this provision.
- Do not hold or access tools suited to enter a security-measure-protected system, or equipment or programmes designed to alter such a system or its data, without justified reason.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Art. 182-bis: base unauthorised-access offence is second-degree imprisonment (imprisonment only, no separate fine), rising to third-degree for a public official, private investigator or system operator, or where violence or data destruction is involved, and to third or fourth-degree for a system of public interest. Holding or accessing means to enter a protected system for undue profit or to cause damage is separately punished by first-degree imprisonment and a fine up to 5,500.00 euro (second-degree imprisonment and a fine from 5,500.00 to 10,500.00 euro where the public-official/operator aggravating circumstance applies). Holding or accessing, without justified reason, equipment or programmes designed to alter a system or its data is punished by second-degree imprisonment and a fine up to 10,500.00 euro.
Penalty structure
The base unauthorised-access offence under art. 182-bis carries imprisonment only, with no separate monetary fine. Two ancillary paragraphs of the same article carry fines: up to EUR 5,500 (rising to a EUR 5,500-10,500 range where an aggravating circumstance applies) for holding or accessing means to enter a protected system for undue profit or to cause damage, and up to EUR 10,500 for holding or accessing, without justified reason, equipment or programmes designed to alter a system or its data. EUR 10,500 is the highest fine figure stated in the article.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 10,500
What it makes you log
Logging duty
Article 182-bis, inserted by article 2, creates the offence of unlawfully entering, or remaining in, a computer or telematics system protected by security measures, with aggravations and a separate offence of holding means to enter such systems. It states no duty to create, keep, produce or review a log or record, and the article carries no territorial clause.
- Kind
- None
- As of
What this law does
Law No. 114 of introduced criminal-law protection against computer crimes by inserting new articles into the Criminal Code.
Article 182-bis punishes anyone who unlawfully enters a computer or telematics system protected by security measures, or remains there against the express or tacit will of the person entitled to exclude them, with second-degree imprisonment; the punishment rises to third-degree imprisonment for a public official, a private investigator, a system operator, or where violence or destruction of data is involved, and to third or fourth-degree imprisonment where the system is one of public interest.
A separate paragraph punishes, with first-degree imprisonment and a fine of up to 5,500.00 euro, anyone who holds or has access to means suited to enter a protected system in order to obtain an undue profit or cause damage, rising to second-degree imprisonment and a fine from 5,500.00 to 10,500.00 euro where the public-official or system-operator aggravating circumstance applies; a further paragraph punishes, with second-degree imprisonment and a fine of up to 10,500.00 euro, anyone holding or accessing without justified reason equipment or programmes designed to alter a system or its data.
Because the core offence's trigger is defeating a security measure or exceeding an express or tacit exclusion, a plain reading does not reach reading a public, unauthenticated page. The same law separately inserted an interception offence (art. 190-bis), a data and system damage offence (art. 203-bis), and a computer fraud offence (art. 204-ter) into the Criminal Code, not further detailed on this instrument.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .