InsideCRA
InsideCRA › Articles › Article 63

Regulation (EU) 2024/2847 · Chapter

Article 63 — Confidentiality

Confidentiality: what authorities do with what they learn.

LAW Official text — verbatim from the Official Journal snapshot; only the Official Journal is authentic.

1.1. All parties involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect, in particular:
(a) intellectual property rights and confidential business information or trade secrets of a natural or legal person, including source code, except the cases referred to in Article 5 of Directive (EU) 2016/943 of the European Parliament and of the Council ;
(b) the effective implementation of this Regulation, in particular for the purposes of inspections, investigations or audits;
(c) public and national security interests;
(d) integrity of criminal or administrative proceedings.

2.2. Without prejudice to paragraph 1, information exchanged on a confidential basis between the market surveillance authorities and between market surveillance authorities and the Commission shall not be disclosed without the prior agreement of the originating market surveillance authority.

3.3. Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member States and notified bodies with regard to the exchange of information and the dissemination of warnings, nor the obligations of the persons concerned to provide information under criminal law of the Member States.

4.4. The Commission and Member States may exchange, where necessary, sensitive information with relevant authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of protection.

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

What this article does

Article 63 sets the confidentiality frame for everyone handling information under this Regulation: everyone involved respects the confidentiality of information and data obtained in carrying out their tasks, so as to protect in particular intellectual property rights and confidential business information or trade secrets (including source code), effective implementation, public and national security, and the integrity of proceedings — without affecting the exchange of information and dissemination of warnings between the Commission, Member States and notified bodies.

Why it matters for cooperation

The document demands of surveillance reach deep into commercially sensitive territory — the technical file is the product's blueprint F-016. This article is the counterpart promise that makes providing it tolerable: material handed to an authority is covered by a confidentiality duty that names trade secrets and source code.

Verified facts this page relies on

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Continue in the reference: Regulation map · topics · timeline.