Liability in the Field of Cybersecurity: Amendments to the Code of Administrative Offences

The amendments made to the Code of Administrative Offences of the Republic of Azerbaijan on 02.09.2026 established violations of the requirements of normative legal acts in the field of cybersecurity as administrative offences.

In particular, newly added Article 371-2 identifies computer incident response centres, security operations centres, information infrastructure entities, owners of Internet information resources, Internet providers and hosting providers as subjects of the administrative offence.

At the same time, the legislator has also identified, in the form of a “Note” to the Article, persons falling outside the scope of these subjects. Thus, the requirements of Article 371-2 do not apply to critical information infrastructure, state bodies (institutions), the Central Bank of the Republic of Azerbaijan, intelligence and counter-intelligence activity entities, entities subject to supervision in financial markets (banks, insurers, reinsurers, persons licensed to operate in the securities market, joint-stock investment funds, investment fund managers, payment service providers, etc.), as well as the information infrastructure of protected persons, protected and strategic facilities. At the same time, computer incident response centres and security operations centres established by the body (institution) designated by the relevant executive authority and by the Central Bank of the Republic of Azerbaijan are also excluded from the scope of this Article.

The Article identifies 6 acts (omissions) giving rise to an administrative offence:

• Failure to comply with instructions of the relevant authority concerning ensuring cybersecurity and conducting digital forensics;
• Failure to immediately provide information on cyber threats, cyberattacks, cyber incidents and the results of investigations;
• Failure to respond to relevant requests within the prescribed periods (24 hours or 5 business days);
• Failure to carry out continuous monitoring of cyber incidents and cyberattacks and to take initial technical response measures;
• Violation of the general and specific requirements for the cybersecurity of information infrastructure;
• Failure to facilitate digital investigations and violation of the integrity of information obtained as a result of such investigations.

Officials shall be fined in the amount of AZN 1,000 to AZN 1,500, while legal entities shall be fined in the amount of AZN 1,500 to AZN 2,500.

It should also be noted that Article 371-2 constitutes a sanction provision for certain obligations set out in Chapter V-II, which was added to the Law of the Republic of Azerbaijan “On Information, Informatization and Protection of Information” on 10.08.2026.