# When an AI security scan becomes an exploit: EU law

By Devekko · Published 2026-11-03

EU cyber crime law asks about intent. GDPR treats an accident as a personal data breach.

A platform runs an AI agent to look for security flaws in the systems of its customers. The agent finds a flaw, uses it, and reaches production data. This guide explains how EU law treats that event when nobody meant harm. It is for the people who run security, legal, and incident response at the platform.

**Limits of this guide.** This guide is research and not legal advice. It states the law as of November 3, 2026. We found no court or regulator decision on these exact facts, so each application to this scenario is our reading. Ask a lawyer in each Member State where you operate.

This guide uses three terms. The "operator" runs the platform and the scan. The "customer" is the tenant whose system the agent reaches. The "agent" is the AI system.

## See the rules and their time limits

EU cyber crime law asks about intent. GDPR does not. Use this table to give each rule an owner.

| Rule | Who it binds | What starts it | Time limit | Record to prepare |
| --- | --- | --- | --- | --- |
| Directive 2013/40/EU, Arts 3 to 6 | Member States must criminalize conduct by persons, and by companies under Art 10 | An intentional act without right | None. This is a criminal rule | Customer mandate that names the test |
| Dutch Criminal Code, Arts 350b and 161septies | Conduct under Dutch law | Fault that causes data damage or system disruption | None. This is a criminal rule | Agent limits and test records |
| GDPR Art 33(2) | Processor | The processor becomes aware of a personal data breach | Without undue delay. The text states no hours | Time when staff learned of the access |
| GDPR Art 33(1) | Controller | Awareness of a breach, unless a risk is unlikely | 72 hours where feasible | Risk assessment |
| NIS2 Art 23(4) | In-scope cloud, data center, and managed service providers | A significant incident | 24 hours, 72 hours, and one month | Incident classification |
| DORA and Regulation 2025/301 | Financial customer | A major ICT-related incident | 4 hours after classification, and no later than 24 hours after awareness. If classification comes after the first 24 hours, 4 hours from classification | Customer notice contacts |

## Cyber crime law needs intent, and national law can add more

[Directive 2013/40/EU](https://publications.europa.eu/resource/celex/32013L0040) is the EU baseline. Art 3 covers illegal access "when committed intentionally". Arts 4 to 6 cover system interference, data interference, and interception "intentionally and without right". Art 2(d) defines "without right" as conduct "not authorised by the owner or by another right holder".

Recital 17 helps a true accident. It says that the Directive imposes no criminal liability for acts "committed without criminal intent". Its examples include a person who "does not know that access was unauthorised" and "mandated testing" that a company or vendor assigns. Recitals guide interpretation, and [academic commentary](https://academic.oup.com/cybersecurity/article/12/1/tyag002/8449232) notes that recitals do not bind.

Art 1 sets minimum rules, so national law can go further. Art 10 reaches a company if a person in a leading position commits the offense for its benefit. It also reaches a company if a lack of supervision allowed the offense.

The Member States differ:

- **Netherlands.** [Art 350b](https://wetten.overheid.nl/BWBR0001854/) is a negligence offense for data damage that causes serious harm. Art 161septies is a fault-based offense for system disruption.
- **Germany.** [StGB § 202a](https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html) requires circumvention of access protection. Liability requires intent unless the law states negligence. A 2024 draft for a research exception is not law.
- **Belgium.** [Commentary from KU Leuven](https://www.law.kuleuven.be/citip/blog/ethical-hacking-under-the-belgian-nis2-law-still-a-safe-haven/) describes a conditional exemption. Testing must be "necessary and proportionate". The guidance of the Belgian cyber security authority also bars data deletion.
- **Portugal.** [A press report](https://www.bleepingcomputer.com/news/security/portugal-updates-cybercrime-law-to-exempt-security-researchers/) describes an exemption for access and interception only. It requires an immediate report, no disruption, and no data change.

Good faith alone did not protect a German programmer in the Modern Solution case. The programmer found a password during client work and reported the flaw. Courts confirmed an offense, and the [Federal Constitutional Court declined the complaint](https://www.heise.de/en/news/Federal-Constitutional-Court-rejects-appeal-in-Modern-Solution-case-10663687.html) in September 2025.

**Our reading.** A true accident falls outside Arts 3 to 6 at EU level, but it can still meet a national fault offense. "Without right" is the main contest, because the customer may be the right holder of its application and data. A customer mandate fits Recital 17 well. A scan for the operator's own purposes fits less well. An agent that changes data may fail the Belgian and Portuguese conditions.

## GDPR treats an accident as a breach

[GDPR Art 4(12)](https://publications.europa.eu/resource/celex/32016R0679) covers a breach of security that leads to "accidental or unlawful" destruction, loss, alteration, unauthorised disclosure of, or access to personal data. [EDPB Guidelines 9/2022](https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf) say that a security incident includes incidents from internal processing. Neither text requires an outside attacker or bad intent.

The operator is usually a processor for hosting. Art 33(2) tells it to notify the controller without undue delay. The EDPB says that a processor need not assess the risk first. It also says that the controller is "in principle" aware once the processor informs it, so your notice can start the customer's 72 hours.

An operator can also become a controller. Art 28(3)(a) limits a processor to documented instructions, and Art 28(10) makes it a controller if it decides purposes and means. The Court of Justice says in [C-683/21](https://publications.europa.eu/resource/celex/62021CJ0683) that a processor that acts "for its own purposes" must be considered a controller.

Other judgments limit the excuses:

- [C-340/21](https://publications.europa.eu/resource/celex/62021CJ0340): in an Art 82 damages action, the controller has the burden of proof on its security measures.
- [C-741/21](https://publications.europa.eu/resource/celex/62021CJ0741): in an Art 82 damages action, a controller cannot avoid liability through the negligence of a person under its authority.
- [C-807/21](https://publications.europa.eu/resource/celex/62021CJ0807): a fine needs intent or negligence, but it needs no act or knowledge by management.

The closest example is [C-77/21, Digi](https://publications.europa.eu/resource/celex/62021CJ0077). An "ethical hacker" reached data on about 322,000 people and sent one line as proof. Digi notified the authority two days later. The authority then found infringements of Art 5, because Digi kept a test database for about 18 months and did not delete it. The judgment concerned purpose and storage limits, and it did not decide Art 4(12).

**Our reading.** An agent that defeats an access control or goes past its instructions very likely causes a personal data breach. A scan that the customer ordered, within scope, and that reads only what the mandate allows, is a strong candidate for no breach. No judgment states this for a security scanner. Art 32 requires regular security tests, but it does not authorize exploit steps.

Plan for two roles. Notify the customer as a processor, and assess your own controller duties at the same time. Negligence is the realistic route to a fine, and write access to production with no scope limit is a weak position.

## Check NIS2, DORA, and the AI Act

**NIS2.** [NIS2](https://publications.europa.eu/resource/celex/32022L2555) covers medium and large cloud, data center, and managed service providers. Its definition of an incident has no malice element. [Regulation 2024/2690](https://publications.europa.eu/resource/celex/32024R2690) uses "suspectedly malicious" in some triggers and not in others. A benign scan can still meet the triggers for data loss, an outage, or the share of affected users. Your 24 hours can run while staff do not yet know that the cause is your own agent.

**DORA.** A financial customer has its own clock under [DORA](https://publications.europa.eu/resource/celex/32022R2554) and [Regulation 2025/301](https://publications.europa.eu/resource/celex/32025R0301). Slow notice from you can cause it regulatory harm and give it a contract claim. An unplanned scan is not a threat-led test, because an authority validates the scope of that test.

**AI Act.** [Art 2(8)](https://publications.europa.eu/resource/celex/32024R1689) says that testing in real world conditions is not covered by the research exclusion. The Act gives no defense to a cyber offense, a data protection breach, or a damages claim.

**Civil claims.** The new [Product Liability Directive](https://publications.europa.eu/resource/celex/32024L2853) applies to products placed on the market or put into service after December 9, 2026. It lets only natural persons claim, and it excludes professional property. A corporate customer is more likely to use contract and national tort law. A data subject can use GDPR Art 82.

## Prepare these records before the first scan

Three facts decide most outcomes: written consent that names the test, agent actions after first proof, and the time when staff learned of the access.

1. Get a written customer mandate that names active exploit tests. A malware scan clause gives weak support.
2. Keep one target record for each run, with the tenant and system.
3. Stop the agent after first proof, and require approval for each further step.
4. Keep network logs outside the agent, because the agent's own logs are weak evidence alone.
5. Write the processor notice now, and name the person who sends it.
6. Keep customer data out of model logs and outside vendors, or record where it goes.

Consent does not bind end users, other tenants, or regulators. Ask your counsel to review the mandate and the notice.

The [Cyber compliance articles](/services/cyber-compliance/articles) give the same analysis for the UK, Australia, US federal law, and US states. Devekko's [Cyber compliance service](/services/cyber-compliance) covers the technical controls and records. It does not give legal advice.