Skip to content

Regulation Tracker / EU AI Act / Chapter IX · Section 3

Article 78
Confidentiality

Chapter IX — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems, Section 3 — Market surveillance and control of AI systems in the Union market. 5 distinct duties, powers or definitions are coded from this article, applying from 2025-08-02. 3 reach legal practice directly.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 99 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. The Commission, market surveillance authorities and notified bodies and any other natural or legal person involved in the application of this Regulation shall, in accordance with Union or national law, respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect, in particular:

  1. (a)the intellectual property rights and confidential business information or trade secrets of a natural or legal person, including source code, except in the cases referred to in Article 5 of Directive (EU) 2016/943 of the European Parliament and of the Council ( 2 );
  2. (b)the effective implementation of this Regulation, in particular for the purposes of inspections, investigations or audits;
  3. (c)public and national security interests;
  4. (d)the conduct of criminal or administrative proceedings;
  5. (e)information classified pursuant to Union or national law.

2. The authorities involved in the application of this Regulation pursuant to paragraph 1 shall request only data that is strictly necessary for the assessment of the risk posed by AI systems and for the exercise of their powers in accordance with this Regulation and with Regulation (EU) 2019/1020. They shall put in place adequate and effective cybersecurity measures to protect the security and confidentiality of the information and data obtained, and shall delete the data collected as soon as it is no longer needed for the purpose for which it was obtained, in accordance with applicable Union or national law.

3. Without prejudice to paragraphs 1 and 2, information exchanged on a confidential basis between the national competent authorities or between national competent authorities and the Commission shall not be disclosed without prior consultation of the originating national competent authority and the deployer when high-risk AI systems referred to in point 1, 6 or 7 of Annex III are used by law enforcement, border control, immigration or asylum authorities and when such disclosure would jeopardise public and national security interests. This exchange of information shall not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities.

4. Paragraphs 1, 2 and 3 shall not affect the rights or obligations of the Commission, Member States and their relevant authorities, as well as those of notified bodies, with regard to the exchange of information and the dissemination of warnings, including in the context of cross-border cooperation, nor shall they affect the obligations of the parties concerned to provide information under criminal law of the Member States.

5. The Commission and Member States may exchange, where necessary and in accordance with relevant provisions of international and trade agreements, confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 78(1)Cooperation with authoritiesNot tier-specificlegal practice

    The Commission, market surveillance authorities, notified bodies and others applying the Act must respect confidentiality of information and data obtained in their tasks and activities.

    "shall, in accordance with Union or national law, respect the confidentiality of information and data obtained in carrying out their tasks and activities"
    Who
    Commission, Market surveillance authority, Notified body, Natural person, Other
    From
    (Art. 113(b))
    Legal practice
    Reaches legal practice directly — Confidentiality is important for legal-AI vendors and deployers sharing sensitive documentation, data or source code.
    See
    Art. 74 · Art. 77

  2. Art. 78(1)Cooperation with authoritiesNot tier-specificlegal practice

    Confidentiality must protect intellectual property, trade secrets, effective enforcement, public and national security, criminal or administrative proceedings, and classified information.

    "the intellectual property rights and confidential business information or trade secrets of a natural or legal person, including source code"
    Who
    Commission, Market surveillance authority, Notified body, Other
    From
    (Art. 113(b))
    Legal practice
    Reaches legal practice directly — Legal-AI source code, trade secrets and sensitive enforcement information receive express confidentiality protection.
    See
    Directive (EU) 2016/943 Article 5

  3. Art. 78(2)Data governanceNot tier-specificlegal practice

    Authorities applying the Act must request only strictly necessary data, protect obtained information with adequate and effective cybersecurity measures, and delete data when no longer needed.

    "shall request only data that is strictly necessary for the assessment of the risk posed by AI systems and for the exercise of their powers"
    Who
    Commission, Market surveillance authority, Notified body, National competent authority
    From
    (Art. 113(b))
    Legal practice
    Reaches legal practice directly — This limits and secures regulatory data collection from legal-AI providers and deployers.
    See
    Regulation (EU) 2019/1020

  4. Art. 78(3)Cooperation with authoritiesHigh-risk

    Confidential information exchanged among national competent authorities or with the Commission must not be disclosed without prior consultation of the originating authority and deployer in specified law-enforcement, border, immigration or asylum uses where disclosure would jeopardise security.

    "shall not be disclosed without prior consultation of the originating national competent authority and the deployer"
    Who
    National competent authority, Commission
    From
    (Art. 113(b))
    Legal practice
    Reaches legal-AI vendors or public bodies — This safeguards sensitive public-authority deployments and may affect justice-related AI where security interests arise.
    See
    Annex III point 1 · Annex III point 6 · Annex III point 7

  5. Art. 78(5)Cooperation with authoritiesNot tier-specific

    The Commission and Member States may exchange necessary confidential information with third-country regulatory authorities under international or trade agreements and confidentiality arrangements with adequate protection.

    "The Commission and Member States may exchange, where necessary and in accordance with relevant provisions of international and trade agreements, confidential information with regulatory authorities of third countries"
    Who
    Commission, Member State
    From
    (Art. 113(b))
    Legal practice
    Institutional — This is cross-border regulatory cooperation and is usually indirect for legal practice.
    See
    international and trade agreements

Cite

Regulation (EU) 2024/1689, Article 78 (Confidentiality), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_78 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-78, accessed 2026-09-08, CC BY 4.0.