Armenia has no domestic statute imposing AI-transparency or output-labelling duties, AI-risk obligations, training-data duties, prohibited-practices bans, governance duties, or sector-specific AI rules.
Its notable development is signing, alongside roughly a dozen other Council of Europe member and observer states, the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225); the Council of Europe's own overview page lists Armenia among the treaty's signatories and lists only the European Union among the parties that have ratified it, so Armenia has signed the Convention and has not ratified it.
On the Armenian Government approved a Doctrine of Economic and Institutional Transformation that names the development of artificial intelligence technologies as an economic priority and envisages a future national AI policy framework; this is a strategic policy document rather than binding legislation or regulation, and it creates no enforceable behavioural obligation for an AI system, so it is described here rather than recorded as an instrument.
The Law on State Support of the High-Technology Sector, Law No. HO-498-N (2024), is an industrial-policy payroll-tax incentive programme for the high-technology sector generally, researched under this jurisdiction's compute-topic document; it imposes no disclosure, transparency or accountability duty on an AI system.
The Law on Protection of Personal Data's right concerning decisions made on the basis of processing (Art. 16) attaches to the processing of personal data rather than to an AI system as such, and is researched under this jurisdiction's privacy-topic document rather than here.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, opened for signature ; signed by Armenia, not yet ratifiedOfficial description of the Framework Convention on Artificial Intelligence and its list of signatories and parties
Proposed.proposed Not law. It binds no one unless it is enacted.
Signed, with consent not yet expressed, dated , as of .Binds public and private bodies.
What this law does
The Council of Europe's own list of signatories to the Framework Convention on Artificial Intelligence names Armenia as a signatory, and its list of parties that have ratified the Convention names only the European Union, so Armenia has signed the treaty and has not ratified it or given it effect in Armenian domestic law.
As drafted, it would require activities within the lifecycle of an artificial intelligence system to be consistent with human dignity, equality and non-discrimination, privacy, transparency and accountability, including carrying out iterative risk and impact assessments on human rights, democracy and the rule of law and establishing prevention and mitigation measures.
It covers use of an AI system by a public authority, including a private actor acting on the authority's behalf, and by a private actor generally, and it would require giving notice that a person is interacting with an AI system rather than a human being, and providing an effective means to challenge a decision made through, or substantially based on, such a system.
Armenia's Law on Protection of Personal Data, Law No. HO-49-N, in force since , replaced a 2002-era law and is a Convention 108-family statute, not a General Data Protection Regulation (GDPR) transposition: it lacks several GDPR-specific features, and its one breach rule, Art. 21(4), requires a processor to announce a leak of personal data from electronic systems publicly and immediately, reporting it at the same time to the Republic of Armenia police and the authorized body for personal data protection.
Art. 13 gives biometric data a dedicated, if minimal, processing article requiring the data subject's consent except where a law-defined purpose can only be achieved through that processing, distinct from the general special-category rule at Art. 12; Art. 3(13)'s biometric-data definition is bare, with no processing-method or unique-identification qualifier and no named modality, so whether an identifier derived from a recording is included or excluded is not addressed by the statute's text.
Cross-border transfer (Art. 27) runs on an adequacy-list mechanism, consent, or the authorized body's written permission for a contract it has approved as providing adequate safeguards, a real and conditioned regime, more developed than the rest of the Act's brevity would predict. Armenia ratified the Council of Europe's Convention 108+ modernizing protocol in 2022, one of the first roughly 16 states to do so.
Art. 3(13) defines biometric personal data only as information characterizing a person's physical, physiological and biological characteristics, a bare, generic definition with no processing-method qualifier, no unique-identification qualifier, and no named modality such as voice or face.
Art. 13 requires the data subject's consent as the default basis for processing biometric data, except where a law-defined purpose can only be achieved through that processing; no modality-specific variation exists.
Art. 19(6) allows biometric data outside information systems to be used and kept only on material carriers, with technologies or in forms that protect it from unauthorized access, unlawful use, destruction, alteration, blocking, copying, and distribution, and leaves the requirements for those carriers and storage technologies to the autonomous body provided for by the Law on Public Information.
Art. 23(3) additionally requires the processor to notify the authorized body before processing biometric or special-category data of its intent to do so, a pre-processing notification duty. Because the Art. 3(13) definition has no derivation or identification qualifier at all, whether it includes or excludes an identifier derived from a photo, video, or audio recording is not addressed by the statute's text.
Armenia's Law on Protection of Personal Data, Law No. HO-49-N, adopted by the National Assembly on and signed by the President on , took effect (Art. 28), replacing a 2002-era law on the same date. General principles at Arts. 4-8 cover legality, proportionality, accuracy, minimal subject involvement, and lawfulness-of-processing grounds, across 29 articles total, considerably shorter and less elaborated than several of this jurisdiction's regional peers.
Nine amending laws have followed, the latest being Law No. HO-191-N of . All translations of Armenian-language text here are working translations, not an official translation.
Art. 27 permits cross-border transfer with the data subject's consent, or where the transfer follows from or is necessary for the purposes of processing. Absent authorized-body permission, transfer to a state providing an adequate level of protection is permitted where adequacy follows an international treaty or the destination is on the authorized body's officially published list, reviewed at least annually.
Transfer to a non-adequate state requires the authorized body's prior written permission, granted only where a contract provides safeguards the body has itself approved as adequate; the processor must apply in writing before transfer, naming the destination country, recipient, data description, purpose, and the contract or draft contract, and the authority must approve or reject within 30 days.
Personal data held by state bodies may be passed to foreign state bodies only within ratified international treaties, and to non-state bodies in line with Art. 27 itself (Art. 27(6)). No standardized model-contract template mechanism exists, and no data localization is compelled.
Art. 15 gives a data subject the right to obtain information about their own data, to see it, and to require the processor to correct, block or destroy it where it is incomplete, inaccurate, outdated, unlawfully obtained or unnecessary for the purposes of processing (Art. 15(2)).
Art. 16 bars decisions that do not follow from the purposes of processing and that produce legal consequences for the data subject or otherwise affect the data subject's rights and legitimate interests, unless the data subject consents or a law provides for them (Art. 16(2)); its text does not mention automated processing. Art. 17 gives a right to appeal a processor's action or inaction to the Authorized Body or a court.
The Act has no data-portability provision, and its general duty in Art. 19(1) to destroy or block data no longer needed for the lawful purpose operates alongside the Art. 15(2) right.
Art. 24 creates an independent Authorized Body for Personal Data Protection, structured by government resolution, with powers to audit compliance, apply administrative-liability measures established by law, demand suspension or cessation of unlawful processing, demand rectification, blocking, or destruction, block processing following review of a pre-processing notification, maintain a processor registry, inspect devices and documents (other than the state information system and the databases connected to it), apply to court, investigate individual complaints, publish an annual public report, and provide guidance.
Art. 17(2) grants the data subject a right to compensation for damage, in accordance with the procedure established by law; the Act itself states no fine amounts, so no penalty figures are stated. Individual recourse runs through the Art. 17 appeal right to the Authorized Body or the courts, together with the Art. 17(2) compensation right, whose procedure the Act leaves to other law.
Art. 12 sets a single, general condition for special-category processing: processing without the data subject's consent is prohibited except where it is directly provided for by law, and processing must stop immediately once its legal basis or purpose lapses. This is a single ground, consent or a legal provision, considerably thinner than a multi-ground special-category structure.
Art. 3(14) defines special-category data as information on a person's racial or national affiliation or ethnic origin, political views, religious or philosophical beliefs, trade-union membership, health and sex life, and biometric data is instead addressed by a separate, dedicated article (Art. 13), not folded into this general special-category rule.
Armenia has no scraping-specific statute, so general law governs each dimension separately.
The current Criminal Code of the Republic of Armenia, Law No. HO-199-N (adopted 2021, in force since ), Chapter 38, criminalises penetrating a computer, computer system or computer network without permission under an authorisation test framed by law, contract or other legitimate basis (Art. 359), and separately criminalises intercepting or appropriating data not intended for general use without such permission, done for the purpose of using it or making it available to others (Art. 362).
Reading a public, unauthenticated page carries no obvious element of penetrating a protected system or appropriating data withheld from general use, so a plain reading of both articles leaves open-web crawling of a public page outside their reach, though no reported Armenian case has tested the point. The 2021 Code replaced a 2003-era Criminal Code whose Arts. 253 and 254 addressed similar conduct under different numbers; that earlier code is no longer in force.
No Armenian court has ruled on the enforceability of a browsewrap or clickwrap terms of service against a scraper, though Art. 359's authorisation test rests on law, contract, or other legitimate basis as three independent grounds for a right of access, a textual hook a scraper's breach of a website's terms could in principle engage even without technical circumvention; this reading is untested.
The Law on Copyright and Related Rights, Law No. AL-142 (2006, as amended), permits free use of a lawfully published work for quotation, criticism, research or informational purposes, including reproduction of newspaper and magazine extracts in the form of a press summary (Art. 22(2)(a)), but Armenia has not enacted a text-and-data-mining exception distinct from that general, attribution-conditioned, purpose-limited ground, a materially narrower basis for training a model on scraped text than a dedicated text and data mining (TDM) exception would provide.
The same Law confers a sui generis right on the maker of a database to prohibit extraction or re-utilisation of the whole or a substantial part of a database's contents (Arts. 58-59), a genuine database right on the EU model, researched here as its own instrument.
Armenia's Law on Protection of Personal Data, Law No. HO-49-N (2015), researched as this jurisdiction's privacy-topic document, applies to personal data with only a narrow, subject's-own-act publicity ground (Art. 11) rather than a general carve-out for publicly accessible information, and conditions cross-border transfer on an adequacy list, consent, or the data protection authority's approval of a contract (Art. 27); scraping personal data from a public Armenian website therefore remains subject to that Act's lawful-basis and cross-border-transfer duties.
No Armenian statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
The Copyright Law's anti-circumvention provision (Art. 67) attaches copyright-infringement-level liability to circumventing a technological measure protecting copyrighted content, which could reach defeating a paywall or access control to scrape gated content, but no reported case applies it to scraping specifically. All quotations of Armenian-language text here are the researcher's own working translations, not an official or certified translation.
Article 359 criminalises penetrating a computer, computer system or computer network by gaining access without permission, where the person has no such right under law, contract or other legitimate basis, and the act negligently causes destruction, alteration, damage, distortion, blocking, copying of data, or other material harm (base tier, up to one year's imprisonment); an aggravated tier applies where the act circumvents a protective system, uses special technical means, official position, group commission, targets data protected by law, or negligently causes especially large damage (up to two years).
Article 362 separately criminalises intercepting or appropriating data stored on a computer, system, network or other computer equipment that is not intended for general use, without permission under law, contract or other legitimate basis, done for the purpose of using that data or making it available to others (base tier, up to two years' imprisonment), with aggravated tiers up to five years where the act is also accompanied by unauthorised penetration, targets legally protected data, is done for mercenary motive, or intercepts data in transit, and up to six years where committed by a criminal organisation or causing especially large damage.
Because Art. 362's base offence is scoped to data 'not intended for general use', appropriating data a website makes available to the general public sits outside a plain reading of the provision.
Article 58 defines a database as a systematically or methodically arranged collection whose individual elements are separately accessible and whose acquisition, verification or presentation required substantial qualitative or quantitative contribution, and defines the maker of a database as the person on whose initiative and responsibility that contribution was made.
Article 59 gives the maker the right to prohibit extraction or re-utilisation of the whole or a substantial qualitative or quantitative part of the database's contents, a genuine sui generis right modelled on the EU's Database Directive rather than a mere compilation-copyright rule; the maker may transfer or license these rights by contract. Article 60 preserves a lawful user's right to extract or re-utilise insubstantial parts of a database made available to the public, for any purpose. Article 73 brings the Law into force on the tenth day following its official publication.
Armenia has no standalone product-security statute, vulnerability or incident-reporting law, sector cyber-resilience regime naming a digital service, or general reasonable-security baseline statute binding a private business with no sector gate.
The Law on Protection of Personal Data, Law No. HO-49-N (2015), already filed on the privacy topic, contains no breach-notification duty anywhere in its 29 articles; its Art. 19 security-of-processing article is a comprehensive regime's own security clause, Test 2 of the security-privacy seam determination, and stays with privacy rather than moving here.
Criminal Code Arts. 253 and 254 (computer sabotage, illegal appropriation of computer data), already filed on the scraping topic, bind the intruder rather than the operator and do not make a security-topic presence on their own. The Law on State Support of the High-Technology Sector, adopted and read in full for this research, is an industrial-policy and subsidy statute defining the sector and its support mechanisms.
It contains no security requirement, vulnerability-handling duty, or incident-reporting clause despite the sector-adjacent title.
Armenia's Law on Cybersecurity (HO-442-N), in force since , sets security and audit duties and a 24-hour significant-incident notice for operators in the sectors it names, filed as rows of their own.
The Council of Europe's Octopus Cybercrime Community country profile for Armenia states that, as of its most recent coverage, Armenia has no dedicated cybersecurity strategy or action plan and that the National Security Service handles cybersecurity policy and the protection of government networks by default, in the absence of a formal statute. Work toward a Cybersecurity Strategy was described there as ongoing rather than complete.
Freedom House's Freedom on the Net 2024 Armenia report, which discusses cyberattacks against Armenian government sites, banks, and telecommunications operators in detail through mid-2024, names no cybersecurity law, CERT-AM, or incident-reporting regime among Armenia's legal instruments. Its legal-environment sections cover only the Law on Electronic Communication, the Personal Data Protection Law, and the Public Service Regulation Commission's authority.
Whether a cybersecurity or critical-infrastructure statute has been adopted since these sources' coverage windows could not be confirmed. A shared web search allowance had already run out by the time Armenia came up for review, and the Armenian Legal Information System (ARLIS)'s own full-text search runs as a client-side form that posts to the server rather than as a URL a read-only request can drive, so a keyword search of the whole corpus since 2015 was not possible with the tools on hand.
This is a coverage limit rather than a finding about Armenian law, and is left for a later review with search access or an interactive browser rather than filled by inference.
Whether the Central Bank of Armenia has issued a binding information-security or IT-risk regulation for licensed banks or payment-system operators has not been confirmed. The Armenian Law on Cybersecurity, adopted on , entered into force on . Article 9 of that Law requires a service provider to take organisational and technical measures around the clock to detect and manage cyber threats and to prevent, detect, block and resolve cyber incidents.
Article 11 of that Law requires a service provider to notify the Autonomous body of a significant cyber incident immediately and no later than within 24 hours of becoming aware of it.
Article 1(3) extends the Law to legal entities and individual entrepreneurs that carry out activities in one or more vital sectors and operate an information system or critical information infrastructure, and to state and local self-government bodies. Article 1(4) excludes micro and small enterprises unless they operate a critical information infrastructure.
Article 16(4) lists fourteen vital sectors, among them energy, transport, communications, financial services, healthcare and information technology. Article 16(3) deems information systems for qualified trust services, top-level domain registry services, DNS services and, for medium-sized entities, electronic communications or Internet access services to be critical information infrastructures by operation of law.
Article 9(1) requires a service provider to take organisational and technical measures around the clock to detect and manage cyber threats and to prevent, detect, block and resolve cyber incidents. Article 9(2) requires a service provider to have an internal cybersecurity regulation. Article 9(3)(4) requires a service provider to ensure daily monitoring to detect cyberattacks, cyber threats and vulnerabilities.
Article 9(3)(7) requires a service provider to prepare reports on its response to a cyber incident and to retain them for at least three years. Article 9(3)(11) requires a service provider to comply with basic cyberhygiene requirements based on the Zero Trust Principle. Article 20(2) requires a service provider to undergo a cybersecurity audit once every three years unless a standard sets another interval.
Article 25 sets the Law in force on the tenth day after promulgation, except Article 8 and some provisions of Article 9 that start when their secondary legal acts take effect. Article 25(5) gives service providers eighteen months after the Law enters into force to adopt internal regulations, carry out risk assessments and prepare a plan of measures.
Article 25(2) gives operators of critical information infrastructure twenty-four months after the Law enters into force to submit a document certifying compliance with a cybersecurity standard.
Article 11(1) requires a service provider to notify the Autonomous body of a cyber incident immediately upon becoming aware of it, and no later than within 24 hours, where the incident has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or where such an impact cannot yet be assessed but may reasonably be presumed. Article 11(2) sets the conditions under which an incident has a significant impact.
Article 11(4) requires updated information, including the incident's severity and consequences, within 72 hours after becoming aware. Article 11(7) requires the service provider to notify the persons potentially affected by the incident immediately, or within two days where that is not possible. Article 11(9) requires a final report to the Autonomous body within one month after the updated information.
Article 12(1) lets a person that is not a service provider, including a natural person, notify the Autonomous body voluntarily of a cyber incident, cyberattack, cyber threat or vulnerability.
Armenia has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Law on Copyright and Related Rights, Law No. AL-142 (2006, as amended), is the only law reaching an aggregator's reproduction of news content.
Its free-use provision permits, without the author's consent, quotation of a lawfully published extract for scientific, research, polemic, critical or informational purposes, including reproduction of newspaper and magazine extracts in the form of a press summary (Art. 22(2)(a)), and separately permits the press and broadcasters to reproduce lawfully published articles on current economic, political, social or religious issues unless the author has prohibited that use beforehand (Art. 22(2)(c)); both grounds require mention of the author's name and the work's origin and are conditioned on not prejudicing the author's normal exploitation of the work, with no reported Armenian decision applying either to a systematic news aggregator as opposed to an individual quoting a published work.
Article 55 gives a publisher an exclusive right over the typographical arrangement of its editions, that is, the printed layout, but this is not a neighbouring right over the substance of the reported content of the kind the European Union's Digital Single Market Directive Article 15 creates, so no press-publisher right of that kind exists here.
No statute or reported case addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law was located. The Law predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.
All quotations of Armenian-language and English-translated text here are the researcher's own working translations except where quoted from the Intellectual Property Agency's own official English translation.
Article 22(1) defines free use as use of a lawfully made-public work without the author's consent and without remuneration, conditioned on mentioning the author's name and the work's origin and on not prejudicing the normal exploitation of the work or the author's legitimate interests.
Article 22(2)(a) permits, within that framework, quotation of an extract of a lawfully published work for scientific, research, polemic, critical or informational purposes, including the reproduction of extracts from newspaper and magazine articles in the form of a press summary, to the extent justified by the purpose of the quotation.
Article 22(2)(c) separately permits the press and broadcasting organisations to reproduce lawfully published articles on current economic, political, social or religious issues, or broadcast works of the same nature, unless the author has prohibited such use beforehand. Neither provision carries a headline-length or short-extract cap distinct from the purpose-justified and normal-exploitation limits. Article 73 brings the Law into force on the tenth day following its official publication.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Age gating law
Armenia has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
The current Criminal Code, Law No. HO-199-N (2021, in force since ), Article 300 criminalises offering pornographic material to an indefinite circle of persons, or making it accessible through information or communication technologies, or advertising such material to an indefinite circle of persons (Art. 300(1)), and separately, and more heavily, criminalises creating, producing, distributing, advertising, or obtaining access to child pornography, including through information or communication technologies (Art. 300(2)); Article 202 separately criminalises using information or communication technology to offer to meet a person under 16 for a sexual purpose or to create child pornography.
None of these provisions imposes an age-verification or age-gating duty on a service that publishes adult content; distributing pornographic material to the public at all, not merely to a minor, is itself the criminalised conduct under Art. 300(1), with no statutory path by which verifying a user's age would make otherwise-prohibited distribution lawful.
As of .
Case law
No current case law for Armenia AI law
No current case law for Armenia privacy law
No current case law for Armenia scraping law
No current case law for Armenia cybersecurity law
No current case law for Armenia communications law
No current case law for Armenia content moderation law
No current case law for Armenia product and AI liability law
No current case law for Armenia digital accessibility law
No current case law for Armenia age gating law
No current case law for Armenia reuse law
Reporting clocks that run here1 instrument
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Armenia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the Autonomous body immediately upon becoming aware of a cyber incident, and no later than within 24 hours, if it has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or if that impact cannot yet be assessed but may reasonably be presumed; this applies whether you or another person operates or hosts the system (Article 11(1)).
Submit updated information on the incident, including its severity and consequences, to the Autonomous body within 72 hours after becoming aware of it (Article 11(4)).
Notify the persons potentially affected by the incident immediately after becoming aware of it or, if that is not possible, within two days (Article 11(7)).
Submit a final report to the Autonomous body within one month after the updated information, covering the probable causes, the measures applied, the severity, consequences and scope of impact, the time and money spent, and the steps taken to prevent similar incidents (Article 11(9)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
