The body must protect proprietary information while disclosing enough about its process and certification status to earn trust.
What applies today
Managing the balance between confidentiality and openness affects stakeholder trust and the perceived value of the certification. To get the information it needs, the body must convince clients that private material stays private. Organisations and people have a right to protect proprietary information unless the law or the scheme requires disclosure. At the same time it must publish enough, in good time, about how it evaluates and certifies, and about whether a certificate is live, widened, reduced, suspended, withdrawn or refused, to let outsiders trust the process. Openness means letting people reach the information they need. On request, the party that hired the body should be able to see what it holds about the product being evaluated or certified.
Why it matters
Confidentiality and openness are not opposites to be traded off once. They apply to different information. Product data is confidential; the fact that a certificate exists, its scope and its status are open. A body that hides a suspension behind confidentiality damages the system. A body that publishes client data to look transparent breaches the other duty.
The public FDIS contents lists Annex A and Annex B as informative annexes and does not number A.4 Confidentiality and openness separately. The FDIS wording is not held; the principle above is the 2012 text.
Where this clause lands in the revision
Annex A.4 is the confidentiality and openness principle. The FDIS keeps Annex A, and this principle still explains how the normative clauses are read. It creates no new obligation and carries no separate FDIS date. A first artefact an assessor commonly asks for here is confidential, publishable and on-request categories. The party this touches first is The confidentiality owner and the communications lead, who must balance the two duties.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Information map | Confidential, publishable and on-request categories |
| Public status | Certificate status information that is current |
| Advance notice | Client notice of the information to be published |
| Access route | Route for the contracting party to request information |
One common question. test both sides: a client file that should be protected, and a status that should be public. A body that fails either side has not balanced the principle.
Common failures
- The directory hides suspensions to protect the client
- The website publishes client data that was never agreed
- No one owns the information map
Prepare before publication
Sort the information the body holds into the three categories. Publish what belongs in the open category and protect the rest.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause A.4 has no separate date.
Cross-references
4.5 Confidentiality · 4.6 Publicly available information · 7.8 Directory of certified products · 7.11 Termination, reduction, suspension or withdrawal
Source
Source for A.4: ISO/IEC 17065:2012, Annex A.4, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.