Vatican CityUnauthorised access to a protected computer or telematic system (Legge N. DXXXI, arts. 158 ter-158 quater)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or remain connected to, a Vatican City State computer or telematic system that is protected by a security measure, without the right to do so or against the will of the party entitled to exclude you.NIST AI RMFMAP 4.1
- Do not cause the destruction or damage of a system, or of the data, information, or programs it holds, or interrupt its operation, when you access it; the penalty is higher where the system belongs to the Holy See, Vatican City State, or another public authority.no control in the NIST AI RMF
- Do not obtain, reproduce, disseminate, or supply passwords or other means of accessing a protected system, or instructions for doing so, for profit or to cause harm.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unauthorised access to a security-protected system (art. 158 ter, first paragraph): up to three years' imprisonment. Aggravated where committed by a public official or person entrusted with a public service abusing their position, with violence to persons or property, or causing destruction, damage, or interruption of the system or its data (art. 158 ter, second paragraph): one to five years, rising to three to eight years where the system belongs to the Holy See, Vatican City State, or another public authority. Trafficking in access credentials for profit or to cause harm (art. 158 quater): up to one year.
Who enforces it
Enforcement body
Vatican City State's ordinary criminal justice system; the base offence proceeds only on the victim's complaint, the aggravated forms and offences against Holy See, State, or public-authority systems on the State's own initiative.
What it makes you log
Logging duty
Articles 158 ter and 158 quater make it an offence to enter or remain in a protected computer or telematic system without right, with higher penalties where an official abuses powers, violence is used, the system or its data is damaged, or the system belongs to the Holy See, the State or another public authority, and to obtain or give out access codes for profit or to cause harm. They impose no duty to create, keep, produce or review a log or record and state no territorial clause, so no hook is recorded. Article 18 of the same Law inserts articles 259 bis to 259 decies into the Code of Criminal Procedure, under which the public prosecutor keeps a reserved register of interception orders and the intercepted communications are recorded and kept until the judgment is final; those duties fall on the prosecutor, sit outside the two articles the row cites, and are not borrowed.
- Kind
- None
- As of
What this law does
Legge N. DXXXI of amended Vatican City State's Penal Code, entering into force on (art. 31).
New article 158 ter punishes whoever abusively enters a computer or telematic system protected by security measures, or remains in it against the express or implied will of the person entitled to exclude them, with up to three years' imprisonment; the penalty rises to one to five years where a public official or a person entrusted with a public service commits the offence abusing their powers or duties, or with violence to persons or property, or where the offence causes destruction or damage to the system or an interruption of its operation, or destruction or damage to the data, information, or programs it holds; and it rises further, to three to eight years, where the system belongs to the Holy See, Vatican City State, or another public authority.
The base offence is prosecuted only on the victim's complaint; the aggravated forms proceed on the State's own initiative.
New article 158 quater punishes whoever, to gain a profit or cause harm, abusively procures, reproduces, disseminates, communicates, or supplies passwords, access codes, or other means suited to accessing a protected computer or telematic system, or otherwise supplies instructions for that purpose, with up to one year's imprisonment; this offence too is prosecutable only on complaint where the system belongs to a private party.
Neither provision addresses the status of a public, unauthenticated page carrying no security measure, and no reported Vatican City State case construes either article.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .