{"answer_id":"praxikon:eu:ai-act:answer:artikel-78-ai-act","canonical_page":"https://www.praxikon.com/en/antwoord/artikel-78-ai-act","query":"What does Article 78 of the AI Act say about confidentiality of what you submit to an authority?","lang":"en","view":"full","mode":"obligation","question":"What does Article 78 of the AI Act say about confidentiality of what you submit to an authority?","situation":"Article 78 of the AI Act covers confidentiality of what you submit to an authority. The Commission, the market surveillance authorities, the notified bodies and everyone involved in the application of the Regulation respect the confidentiality of what they obtain in carrying out their tasks, and in doing so expressly protect the intellectual property rights, the confidential business information and the trade secrets of a natural or legal person, including source code. They may request only data that is strictly necessary, must secure it, and must delete it as soon as it is no longer needed. For you this is therefore not a duty but a protection, with a limit: the exception in Article 5 of Directive (EU) 2016/943 remains, and the provision leaves the exchange of information and the dissemination of warnings between authorities untouched. This provision concerns the deployer, the provider of a GPAI model and the provider of an AI system. This provision applies today.","likely_role":null,"note":null,"matched_terms":[],"dataset":{"id":"praxikon:sys:registry:dataset:ai-act-implementation-graph","version":"2.2.0","schema_version":"1.5.0","effective_at":"2026-08-08T00:00:00.000Z","known_at":"2026-09-06T00:00:00.000Z","last_reviewed_at":"2026-08-08T00:00:00.000Z","licence":"https://www.praxikon.com/nl/legal/terms","canonical_url":"https://www.praxikon.com/api/v1/entities"},"obligations":[{"slug":"article-78-confidentiality","label":"Article 78: confidentiality of what you submit to an authority","summary":"The Commission, the market surveillance authorities, the notified bodies and everyone involved in the application of the Regulation respect the confidentiality of what they obtain in carrying out their tasks, and in doing so expressly protect the intellectual property rights, the confidential business information and the trade secrets of a natural or legal person, including source code. They may request only data that is strictly necessary, must secure it, and must delete it as soon as it is no longer needed. For you this is therefore not a duty but a protection, with a limit: the exception in Article 5 of Directive (EU) 2016/943 remains, and the provision leaves the exchange of information and the dissemination of warnings between authorities untouched.","legal_status":"applicable","deadline_at":null,"high_risk_regime_from":null,"human_page":"https://www.praxikon.com/en/verplichtingen/article-78-confidentiality","api":"https://www.praxikon.com/api/v1/obligations?lang=en","official_source":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","citations":[{"kind":"official_fact","statement":"Paragraph 1 provides that the Commission, market surveillance authorities and notified bodies and any other natural or legal person involved in the application of this Regulation shall, in accordance with Union or national law, respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect, in particular: (a) the intellectual property rights and confidential business information or trade secrets of a natural or legal person, including source code, except in the cases referred to in Article 5 of Directive (EU) 2016/943; (b) the effective implementation of this Regulation, in particular for the purposes of inspections, investigations or audits; (c) public and national security interests; (d) the conduct of criminal or administrative proceedings; (e) information classified pursuant to Union or national law. Paragraph 2 provides that the authorities involved in the application of this Regulation pursuant to paragraph 1 shall request only data that is strictly necessary for the assessment of the risk posed by AI systems and for the exercise of their powers in accordance with this Regulation and with Regulation (EU) 2019/1020, that they shall put in place adequate and effective cybersecurity measures to protect the security and confidentiality of the information and data obtained, and that they shall delete the data collected as soon as it is no longer needed for the purpose for which it was obtained, in accordance with applicable Union or national law.","source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 78(1)-(5)","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"},{"kind":"editorial_interpretation","statement":"Read this article as the answer to the question your supplier asks and that you ask yourself as soon as you have to hand something over. The protection is real and it names source code expressly, which is unusually explicit in Union law. But it is a duty of the recipient and not a right of refusal for the party submitting. Article 21(1) requires the provider, upon a reasoned request, to give all the information and documentation necessary to demonstrate conformity; Article 78 does not say you may withhold anything, it says what the recipient must do afterwards. Anyone who inverts that and refuses on grounds of confidentiality is legally empty-handed. Two limits on top, because they get missed in practice. The first is Article 5 of Directive (EU) 2016/943: that exception sits verbatim in point (a) and it covers, among other things, exercising the right to freedom of expression and information and revealing misconduct in the general public interest. The second is paragraph 4: between authorities, and when disseminating warnings, confidentiality does not operate as a lock. Your file can therefore reach another Member State without that being a breach. What does work in your favour is paragraph 2. That is a strict necessity test on the request itself, with a retention limit attached: deletion as soon as the data is no longer needed for the purpose for which it was obtained. That is a question you can put to an authority and whose answer you can record.","source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 78(1)-(5)","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"},{"kind":"editorial_interpretation","statement":"There is an asymmetry in this article that is rarely noticed. Paragraph 3 gives one set of parties a heavy extra protection: where a high-risk system from point 1, 6 or 7 of Annex III is used by a law enforcement, border control, immigration or asylum authority, information exchanged on a confidential basis may not be disclosed without prior consultation of the originating authority and the deployer, and the technical documentation stays physically within the premises of that authority where it is itself the provider. For a commercial provider in exactly the same Annex III areas that arrangement does not apply. The practical conclusion is not that one is better protected than the other, but that you need to know which side you are on: if you supply such an authority, your documentation travels a different path from your own archive, and you settle that path in the contract rather than after the fact. Note also what this article does not govern. It says nothing about the public availability of the EU database in Article 71, whose public part is meant to be found, and nothing about what a deployer must explain to an affected person under Article 86. Confidentiality towards a regulator and transparency towards a citizen are two separate tracks in this Regulation, and it is a mistake to try to close one with the other.","source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 21(1); Article 74(8) and (9); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"},{"kind":"recommended_action","statement":"Mark on every submission which part you regard as confidential business information, trade secret or source code, and why, and keep a register of what you handed to whom on what date. That register is your only starting point if you later want to know whether something left the circle. When asked for additional data, ask about the necessity within the meaning of paragraph 2 and about the purpose for which the data is obtained, and record the answer; that is not a refusal and it is the only way to be able to invoke the retention limit of paragraph 2 later. Put in supplier contracts who receives a request from an authority, who decides what is handed over, and that the other party is informed within an agreed period. If you supply a law enforcement, border control, immigration or asylum authority, record where the technical documentation stays physically and who has access to it. Finally, do not assume that confidentiality releases you from Article 21: the duty to deliver on request stands apart from the recipient’s duty to handle what is delivered with care.","source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 21(1); Article 74(8) and (9); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}]}],"conditional":[],"sources":[{"id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","title":"EU Artificial Intelligence Act 2024/1689","publisher":"European Parliament and Council","canonical_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj","source_version":"original-oj-2024-07-12","verified_at":"2026-08-08T00:00:00.000Z"}],"first_actions":[{"label":"Mark and register what you submit to an authority or body","summary":"State on every submission which part is confidential business information, trade secret or source code, keep track of what was handed to whom on what date, and on a further request ask about the necessity and the purpose within the meaning of Article 78(2)."}],"evidence":[{"label":"Register of submissions to authorities","summary":"Per submission: which system, which document, which version, to which recipient, on what date, which part was marked confidential, and which purpose the recipient stated.","url":"https://www.praxikon.com/en/ai-act/artikel/78"}],"guidance":[],"examples":[],"standards":[],"definitions":[],"answer_page":"https://www.praxikon.com/en/antwoord/artikel-78-ai-act","follow_up_questions":[],"disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}