EU Data Act Obligations for Connected Products

The design obligation of the Data Act applies from September 13, 2026. Connected products placed on the market from that day must be designed so that users can access the data generated by their use by default. Most other obligations have applied since September 12, 2025. Two further stages follow in 2027, one for switching between cloud providers and one for older contracts. Enforcement is national: each Member State designates the competent authorities and sets the penalties.

The Data Act (Regulation (EU) 2023/2854) is the EU regulation on access to data from connected products and related services. It gives users a right to the data generated by the use of their device. It also requires data holders to share these data with third parties at the user's request.

Contents

1. Data Act deadlines
2. Who the Data Act applies to
3. Which data users can request
4. Data sharing: terms, trade secrets, and compensation
5. When public authorities can request data
6. Cloud switching and interoperability
7. Access to data from third countries
8. Who enforces the Data Act
9. What manufacturers should do now
10. Where the real effort lies
11. Why the Data Act gets left aside

Data Act deadlines

The obligations apply in stages, from general application in September 2025 to older contracts in September 2027.

Date	What applies
Jan 11, 2024	Entry into force of the regulation
Sep 12, 2025	General application, including the information obligations before a contract is concluded (Article 3(2) and (3))
Set nationally	Competent authorities and penalties under national law (Articles 37 and 40); in Germany, for example, since May 30, 2026
Sep 13, 2026	Design obligation for connected products and related services placed on the market after Sep 12, 2026 (Article 3(1))
Jan 12, 2027	No switching charges when customers switch between providers of data processing services (Article 29)
Sep 12, 2027	Rules on unfair contractual terms (Chapter IV) also apply to older contracts of indefinite duration or expiring on or after Jan 11, 2034

For product development, September 13, 2026 is the date that matters. The two later stages concern providers of data processing services and the drafting of contracts between businesses.

Who the Data Act applies to

The regulation applies to manufacturers of connected products placed on the market in the Union and to providers of related services, wherever they are established. It also applies to users, data holders, data recipients, providers of data processing services, and public sector bodies that request data.

A connected product is an item that collects data about its use or environment and can communicate these data over an electronic communications service, a physical connection, or on-device access. Products whose primary function is storing, processing, or transmitting data on behalf of a party other than the user are excluded. A connected machine controller with remote maintenance access is covered. A server that a provider operates solely for its customers' data is usually not. If you build machinery, the Machinery Regulation also applies to the same product.

A related service is a digital service connected with the product in such a way that the product could not perform one or more of its functions without it. This also covers services that the manufacturer or a third party connects to the product later to add to, update, or adapt its functions. An update service is a related service, and so is a retrofitted service that adds to or changes the functions of a machine. A pure analytics service that only collects data and returns nothing to the machine is not a related service.

Microenterprises and small enterprises are exempt from the data access obligations, including the design obligation and the information obligations before a contract is concluded (Article 7(1)). The exemption applies only if they have no partner or linked enterprise that is larger and are not subcontracted to manufacture or design the product. The same exemption applies for the first year after an enterprise has qualified as a medium-sized enterprise. It also applies to a connected product for one year after a medium-sized enterprise placed it on the market.

The Data Act governs access to data. The security requirements for a product are set by the Cyber Resilience Act (CRA), which applies from December 11, 2027. Its reporting obligations have applied since September 11, 2026.

The scopes overlap only in part. Motor vehicles and medical devices fall under the Data Act but are excluded from the Cyber Resilience Act.

Which data users can request

Two limits restrict the user's right. It applies only where the user cannot already access the data directly from the product or the related service. And it covers only readily available data: product data and related service data that the data holder lawfully obtains or can obtain from the product or service without disproportionate effort going beyond a simple operation. Content is excluded from the outset, such as text, audio, or video recordings that the user creates with the device.

The second limit determines how much a user actually receives. The Commission's FAQ on the Data Act draws the line as follows. Raw data and pre-processed data are covered, together with the metadata needed to use them, for example measurements of a physical quantity such as temperature, pressure, flow, or position. Derived and heavily enriched data are not covered, and neither are the results of proprietary, complex algorithms. The FAQ is guidance on interpretation and does not create legal obligations.

If the data are covered, the data holder must make them available without undue delay, easily, securely, free of charge, and in a commonly used, machine-readable format. Where relevant and technically feasible, this must also happen continuously and in real time. At the user's request, the data holder must also make the data available to a third party. This remains free of charge for the user; separate conditions apply to the third party.

Data sharing: terms, trade secrets, and compensation

When a data holder must make data available to a data recipient, it must do so on fair, reasonable, and non-discriminatory (FRAND) terms and in a transparent manner. These rules apply only to legal obligations to make data available that entered into force after September 12, 2025. They apply expressly to sharing at the user's request. Sharing remains free of charge for the user. From the data recipient, however, the data holder may ask for reasonable and non-discriminatory compensation, which may include a margin. The compensation is capped at the costs of making the data available only for data recipients that are SMEs or not-for-profit research organizations and do not belong to a larger group.

Trade secrets remain protected. The data holder must identify the data concerned, mark them in the metadata, and agree with the user on proportionate technical and organizational measures, such as confidentiality agreements and strict access protocols. The data holder may withhold or suspend sharing in three cases: no agreement is reached, the user does not implement the agreed measures, or confidentiality is breached. The data holder must substantiate this decision and send it to the user in writing without undue delay. It must also notify the competent authority that it has withheld or suspended sharing. This only informs the authority. The authority has to decide only if the user lodges a complaint.

A second route is open in individual cases, but only to a data holder that is itself the trade secret holder. In exceptional circumstances, it may refuse a request for access to the specific data. It must show that it is highly likely to suffer serious economic damage from the disclosure despite the agreed measures. This showing must be based on objective elements, such as the enforceability of trade secret protection in third countries. The data holder must also notify the competent authority of this refusal.

A separate rule addresses the most obvious concern: that a competitor gets the data through the user. Neither the user nor a third party may use the data obtained to develop a product that competes with the connected product from which the data originate. They must also not use the data to derive insights into the economic situation, assets, or production methods of the manufacturer or data holder.

In practice, data holders rely on the trade secret exception when they decline to share data. The second option has not been used so far: contractually restricting access because it could undermine the security of the product required by law and endanger people.

When public authorities can request data

Public sector bodies, the Commission, the European Central Bank, and Union bodies can request data from data holders if they demonstrate an exceptional need. The clearest case is a public emergency, which can include a major cybersecurity incident. What matters is the formal status. The emergency must be determined or officially declared under the procedures of Union or national law. A serious incident at a single company does not qualify.

Outside a public emergency, such requests are limited to non-personal data. They are allowed only if the body has exhausted all other means, including buying the data on the market. Microenterprises and small enterprises are exempt from this second category.

Cloud switching and interoperability

From January 12, 2027, providers of data processing services must not charge switching fees for the switching process. Until then, they may only pass on their actual costs of switching.

For data spaces, the regulation sets essential requirements for interoperability, for example for describing dataset content, formats, and interfaces. These requirements apply to participants that offer data or data services to other participants.

Access to data from third countries

The regulation protects only non-personal data held in the Union against access by authorities of third countries. Providers of data processing services must take adequate technical, organizational, and legal measures to prevent governmental access from third countries that would conflict with Union law or national law.

A decision of a third-country court or authority can be recognized or enforced only if it is based on an international agreement in force, such as a mutual legal assistance treaty. Without such an agreement, a transfer is possible only under three conditions. The third country's legal system must require the decision to state its reasons and to be proportionate and specific. A court there must review a reasoned objection by the addressee. And that court must be able to take the protected interests of the data provider into account. In both cases, the provider hands over only the minimum amount of data.

Who enforces the Data Act

Each Member State designates one or more competent authorities to apply and enforce the Data Act (Article 37). If a Member State designates several authorities, one of them acts as data coordinator and single point of contact. The competent authorities handle complaints, including complaints about trade secrets, and receive the notifications of data holders that withhold or refuse data.

Member States lay down the penalties for infringements (Article 40). These must be effective, proportionate, and dissuasive. Where personal data are concerned, the data protection supervisory authorities are responsible. For infringements of Chapters II, III, and V, they may impose administrative fines under Article 83 of the General Data Protection Regulation (GDPR) up to the amount set in Article 83(5).

In Germany, for example, the Federal Network Agency (BNetzA) (in German) is the competent authority. The legal basis is the national Data Act implementation act (DADG) (in German), published in the Federal Law Gazette 2026 Part I No. 157 on May 29, 2026. It entered into force the following day, May 30, 2026. The agency is also the central point of contact for all questions on implementation, handles complaints, and approves dispute settlement bodies.

The German act sets fines in four tiers:

• Up to €5 million, or up to 2% of worldwide total turnover for legal persons with total turnover above €250 million, for infringing the ban on soliciting users to hand over their data or offering them commercial incentives to do so. This rule addresses large platforms designated as gatekeepers under the Digital Markets Act. It does not affect machinery manufacturers.
• Up to €500,000 for seven types of infringement. Three of them concern manufacturers directly: designing a connected product or related service contrary to the design obligation, not making the data available to the user or a third party named by the user, and using the data to gain insights into the user's economic situation. The same tier applies to anyone who infringes an enforceable order of the Federal Network Agency. The rest address users and data recipients, including using data obtained to develop a competing product.
• Up to €100,000 for further infringements.
• Up to €50,000 for all other infringements.

The Federal Network Agency can also impose periodic penalty payments of up to €500,000. For personal data, Germany's Federal Commissioner for Data Protection and Freedom of Information (BfDI) is the authority that imposes fines.

What manufacturers should do now

The design obligation attaches to the individual unit, not to the product type. Placing on the market is the first making available of a product on the Union market; any later supply is only making available. The Commission's FAQ applies this to the individual unit: each device is placed on the market exactly once. What counts is when it is first made available on the Union market.

• Review your portfolio. Which devices collect data about their use or environment and can communicate them externally? Prototypes are out of scope.
• Decide which group company is the data holder. The obligations to make data available and the notifications to the competent authority depend on this role.
• Appoint a legal representative. Manufacturers without an establishment in the Union must designate a legal representative in one Member State whom the competent authorities can address.
• Use technical protection measures where needed. Encryption and smart contracts remain expressly allowed as technical protection measures, provided they do not discriminate between data recipients or prevent users from exercising their rights.

The cut-off date applies only to the design obligation. The user's right to readily available data has no such limit. It has applied since September 12, 2025, including to machines delivered years before. According to the Commission's FAQ, however, it covers only data generated after that date. Whether you can meet this right depends on what your existing controller already outputs.

If you build connected machinery, the Cyber Resilience Act and the Machinery Regulation are two more acts that apply to the same product. Our article on how the CRA and the Machinery Regulation overlap shows how their requirements overlap. The individual steps for the Data Act are covered in our article on the Data Act design obligation for connected products.

Where the real effort lies

The most common concern in our client conversations is giving away intellectual property through the new interfaces. In most cases, this is not necessary at all, and you can protect yourself contractually and technically.

On the technical side, most manufacturers already have the interfaces. In machine building, OPC UA is the usual connection. Manufacturers that collect data over MQTT have so far only needed to make changes on the cloud side.

The effort was in the documentation. Writing down which data the device collects, in which format and in what volume, and publishing this information on the website took more time than the technology.

Since September 12, 2025, Article 3(2) has required four items of information before a purchase, rental, or lease contract is concluded:

• the type, format, and estimated volume of product data
• whether the product can generate data continuously and in real time
• how the data are stored
• how the user can access the data

The obligation lies with whoever sells, rents, or leases the product. That can be the manufacturer, but it does not have to be. If you treat the design obligation as the starting point, you are already a year behind on this obligation.

If you have nothing in place yet, plan for several months until the architecture and data processing are properly set up, including testing and documentation.

Why the Data Act gets left aside

The Data Act affects almost every machine builder, because most machines collect data. Even so, it often gets left aside. Many companies have not heard of the regulation and do not have it on their radar, so nothing happens. What remains undone is the product design and making the data available.

Doing nothing now carries a fine. The penalties are set by each Member State. In Germany, for example, the national act has provided for fines of up to €500,000 for these two obligations since the end of May 2026.

As of September 2026, it is unclear whether the Federal Network Agency will actually use this range. The topic is new for the authority, and there are no comparable cases yet from which to read an enforcement practice.

If you wait for the first published fine, you are working to the wrong date. The design obligation applies to every single device that reaches the Union market from September 13, 2026.