Map of the AI Act

Article 78: confidentiality of what you submit to an authority

The map shows what hangs off this object: who carries the duty, what it calls for, what it is evidenced by and what it rests on. Click an object and it becomes the new centre.

On a small screen the map reads as a path rather than as a network.

obligation

Article 78: confidentiality of what you submit to an authority

The Commission, the market surveillance authorities, the notified bodies and everyone involved in the application of the Regulation respect the confidentiality of what they obtain in carrying out their tasks, and in doing so expressly protect the intellectual property rights, the confidential business information and the trade secrets of a natural or legal person, including source code. They may request only data that is strictly necessary, must secure it, and must delete it as soon as it is no longer needed. For you this is therefore not a duty but a protection, with a limit: the exception in Article 5 of Directive (EU) 2016/943 remains, and the provision leaves the exchange of information and the dissemination of warnings between authorities untouched.

based on

Article 78 on EUR-Lexguidance

is affected

supervises

Market surveillance authorityrole · editorial reading

calls for

Mark and register what you submit to an authority or bodyaction · editorial reading

evidenced by

controlled by

Review before handing over source code or trade secretscontrol · editorial reading

supported by

Full text of Article 78template · editorial reading

Legendroleobligationactionevidencesolid line: official findingdashed line: our reading

Back to the whole regulation

obligation

Article 78: confidentiality of what you submit to an authority

The legal path

Source ·: Article 78 on EUR-Lex
Condition ·: Applies to all information and data obtained by the Commission, the market surveillance authorities, the notified bodies and any other natural or legal person involved in the application of this Regulation in carrying out their tasks and activities. The protection operates in accordance with Union or national law and not on its own.
Condition ·: Paragraph 2 limits what an authority may request: only data that is strictly necessary for the assessment of the risk posed by AI systems and for the exercise of its powers in accordance with this Regulation and with Regulation (EU) 2019/1020. Two follow-on duties attach to that: adequate and effective cybersecurity measures, and deletion as soon as the data is no longer needed for the purpose for which it was obtained.
Exception ·: The protection of intellectual property, confidential business information and trade secrets, including source code, applies except in the cases referred to in Article 5 of Directive (EU) 2016/943. Point (a) of paragraph 1 says so in as many words.
Exception ·: Paragraph 4 provides that paragraphs 1, 2 and 3 do not affect the rights or obligations of the Commission, the Member States and their relevant authorities, or those of notified bodies, with regard to the exchange of information and the dissemination of warnings, including in the context of cross-border cooperation, nor the obligations of the parties concerned to provide information under criminal law of the Member States. Confidentiality under this article is therefore not a duty of silence between authorities.

Open in the explorer

Checked on 2026-08-08T00:00:00.000Z · praxikon:eu:ai-act:obligation:article-78-confidentiality

Read the map atin force now 2 Feb 2025 2 Aug 2025 27 Jul 2026 2 Aug 2026 2 Dec 2026 2 Aug 2027 2 Dec 2027 2 Aug 2028

Read at 2 Aug 2025. What did not yet apply on that date is not shown here. The obligations for providers of GPAI models apply.