The Data Act Design Obligation for Connected Products
If you place a connected product on the EU market after September 12, 2026, you must build it so that it makes its usage data available. With this, the Data Act has reached product development, a good two and a half years after its entry into force.
The Data Act (Regulation (EU) 2023/2854) governs access to the data generated by the use of connected products. It has applied since September 12, 2025. For manufacturers, the central obligation is in Article 3(1): connected products must be designed and manufactured, and related services designed and provided, so that the user can access the data they generate. We call this the design obligation for short.
Contents
What applies when
The Data Act takes effect in stages until September 2027. If you only know the date of application, you will miss the dates for products and for older contracts.
| Date | What applies |
|---|---|
| Jan 11, 2024 | The regulation enters into force, 20 days after its publication in the Official Journal. |
| Sep 12, 2025 | The regulation applies. The rules on unfair contractual terms between businesses cover contracts concluded after this date. |
| Sep 12, 2026 | The design obligation covers connected products and related services placed on the market after this date. |
| Jan 12, 2027 | Providers of data processing services may no longer charge switching fees when a customer switches provider. |
| Sep 12, 2027 | The rules on unfair contractual terms also cover older contracts, that is, contracts concluded on or before September 12, 2025, if they are of indefinite duration or expire no earlier than 10 years after January 11, 2024. |
Strictly speaking, it is wrong to speak of the Data Act entering into force now. It has been in force since January 2024; only its application was staggered. This confusion is one reason why many manufacturers consider the topic settled.
What changes for products placed on the market after September 12, 2026
The design obligation attaches to the individual product: it covers what is placed on the market after September 12, 2026. For older products, the regulation does not require any design change. Manufacturers must still make their data accessible. According to the answers of the Commission services in the Commission's FAQ on the Data Act, products already on the market have had to enable data access since September 12, 2025, just like new products.
The 2026 cut-off date pulls data access into product design. Access itself has been owed by the manufacturer for a year already. If you consider your current product line exempt for that reason, you are confusing the two dates.
A connected product is an item that obtains, generates, or collects data about its use or environment and is able to communicate these data, provided that its primary function is not storing, processing, or transmitting data on behalf of a party other than the user. A machine controller that reports operating hours and error codes to a portal is covered.
The data must be accessible by default, easily, securely, free of charge, and in a structured, commonly used, and machine-readable format, together with the metadata needed to interpret them. Where relevant and technically feasible, the user must be able to access them directly, without another party being involved. What this means for interfaces in practice is covered in our Data Act overview.
Microenterprises and small enterprises are exempt, provided they neither belong to a larger group of enterprises nor have been subcontracted to manufacture or design the product. For medium-sized enterprises, the obligations apply only one year after the product has been placed on the market.
Why the Data Act does not reach product development
The Data Act sounds like data protection. So it ends up with the data protection officer, who works on records of processing activities, data processing agreements, and data subject rights. It does not get as far as product development.
That is how it should be: the data protection officer is not the right owner. We know the same situation from IT security. The IT security team does not look after the company's products, and it should not, because that is the job of the product security officer. For the Data Act, we have not yet seen a comparable role.
In the engineering departments, the topic is unknown, and nobody there goes looking for it. In machine building, where the Machinery Regulation currently takes up attention, data protection is also seen as a consumer topic with no relevance for the company's own machines.
Yet the Data Act governs access to machine data, whether or not they contain personal data.
The enforcement structure draws this line itself. Each Member State designates the competent authorities for applying and enforcing the Data Act (Article 37). The data protection supervisory authorities are responsible only insofar as the protection of personal data is concerned. In Germany, for example, the Federal Network Agency (BNetzA) applies and enforces the Data Act and is also the central point of contact and national supervisory authority. For the protection of personal data at non-public bodies, Germany's Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible.
The design obligation thus falls to an authority that most manufacturers have no established contact with.
Are you a manufacturer, data holder, or provider?
This article covers the design obligation for manufacturers. The Data Act overview sets out the obligations for data holders and providers of data processing services alongside it.
How the Data Act and the CRA interact
The Commission services deny an obligation to redesign products for direct data access. According to them, the regulation does not require direct access for every connected product. The wording “where relevant and technically feasible” leaves the manufacturer the choice between direct access and access via a remote server, and the manufacturer may weigh technical feasibility and costs.
The answers on the Cyber Resilience Act (CRA) say the same more briefly, in question 2.9.3 of the Commission services' FAQ on the CRA: “Under the DA, there is no strict (re)design product obligation.” This freedom exists, however, only as long as the data are made available. Both documents are interpretive guidance and not legally binding.
If a product falls under both acts, the obligations to make data available belong in the cybersecurity risk assessment under the CRA. The data holder may still restrict or refuse sharing where trade secrets or security are at stake.
The regulation prescribes the result and leaves the way there to the manufacturer. If you designed your product properly from the start, the data can be retrieved without extra effort. The work lies in architectures that have grown over time with outdated components. So manufacturers do have to adapt their products after all, as soon as the existing architecture cannot deliver the required result.
What happens if you infringe the Data Act
The Data Act leaves penalties to the Member States (Article 40). They must be effective, proportionate, and dissuasive.
There is also a second route. For infringements of the obligations in Chapters II, III, and V, which include the design obligation, the data protection supervisory authorities can, within their competence, impose administrative fines under the General Data Protection Regulation (GDPR) (Article 40(4)). This range goes up to €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. The condition is that personal data are concerned.
In Germany, for example, the national Data Act implementation act (DADG) has been in force since May 30, 2026. Under it, anyone who does not design or manufacture a connected product properly commits an administrative offense, as does anyone who does not design or provide related services properly. The fine goes up to €500,000 and is imposed by the Federal Network Agency. For fines under the GDPR range, the act designates the BfDI. For a machine controller without personal data, a German manufacturer therefore faces the Federal Network Agency and a maximum of €500,000.
For manufacturers, the amount of the fine is the less important point. More important is that a national authority judges the design of a product, based on decisions that were made in the development project years earlier.
What to do now
The first question is who in your company answers a customer's request for their product data, and who answers when the competent authority asks. As long as this responsibility is open, the design obligation stays on paper, however good the interface in the product may be.
The second question concerns your portfolio. For every product that you newly place on the market after September 12, 2026, check two points:
- Does it release its usage data in a commonly used, machine-readable format?
- Can the user access the data without the manufacturer, where relevant and technically feasible?
For a newly developed controller, this is rarely a problem. For a product line that has been continued for 10 years, this is where you decide whether to retrofit.
The fine is the smaller risk. A product in the field that does not release its data costs more, because retrofitting then affects hardware and software at the same time.
Integrate data access into your CRA risk assessment
Where a product falls under both the Data Act and the CRA, the requirements for data access belong in the same risk assessment. In a call, we work out how both sets of obligations interact for your product.
