A key pillar of the latest EU digital regulations is extensive transparency requirements. The Data Act and the AI Act are also largely based on improving data and system transparency. Affected companies must make IoT data widely accessible and explain in detail how AI models and systems work.
On the other hand, companies must protect their know-how to remain competitive. For many companies, internal know-how accounts for the bulk of their capital.
Therefore, companies are challenged by balancing compliance with transparency obligations and know-how protection.
I. Data Act: Sufficient Exemptions for Trade Secrets?
Although the Data Act provides several exemptions to protect trade secrets, how these exemptions are handled remains uncertain.
In general, the data access rights under Articles 4 and 5 of the Data Act include information that is protected as a trade secret. Although there are exceptions, their requirements are still unclear.
Companies may refuse to disclose trade secrets as a part of data access requests if they cannot agree on appropriate protective measures with the requesting party. However, how far can companies go with their demands regarding these measures, and at what point do they cross the line into intentionally sabotaging an agreement? When is it legitimate to withhold trade secrets due to the high likelihood to suffer serious economic damage from their disclosure? What does the lack of exemptions for trade secrets regarding Article 3 (1) Data Act (obligation to “data access by design”) mean for developers of IoT-based products and services? These are only some of the questions companies which are affected by the Data Act and rely on the protection of their trade secrets are facing.
II. AI Act: Are Providers of General-Purpose AI Obligated to Disclose Protected Know-How About Their AI Models?
The AI Act provides several information and transparency obligations regarding the development and functionality of AI systems and models. These obligations might lead to conflicts with the protection of deployers’ and providers’ trade secrets.
In particular, providers of general-purpose AI models (GPAI) are facing far reaching transparency obligations under Article 53 AI Act. Providers of AI systems who intend to integrate the GPAI model must be informed about the model’s architecture and number of parameters, among other things. Such information concerns the core of an AI model. Disclosing this information without simultaneously jeopardizing the confidentiality of important trade secrets is likely to be difficult in practice.
III. What Affected Businesses Can Do
Until binding case law and administrative practice have been established, companies should
- carefully monitor new developments in case law, official guidelines and legislation,
- carefully analyze how to protect trade secrets in a compliant manner,
- document implementation measures and related concerns regarding the protection of trade secrets, and
- cooperate with authorities without losing sight of one’s own rights and interests.
We are happy to advise you on how to tackle these challenges in practice.