EU Data Act: connected products now need built-in data access
The EU Data Act (Regulation (EU) 2023/2854) reached its second milestone on 12 September 2026. Connected products and related services placed on the EU market from that date must be designed so that users can access the data they generate, easily and securely, and where relevant directly from the device. The rest of the Data Act has applied since 12 September 2025, and two more dates are coming: cloud switching charges end on 12 January 2027, and the unfair terms rules reach older contracts on 12 September 2027.
Meanwhile, the EU is negotiating a “Digital Omnibus” that would amend the Data Act. As of September 2026 it hasn’t been adopted, and none of the reported proposals change the September 2026 design date.
What the Data Act does
The Data Act is about who gets to use data from connected things: cars, industrial machines, smart home devices, medical wearables and the apps and services that go with them. In short:
- Access by design. New connected products must be built so that product data and related service data are available to the user, by default where that’s relevant and technically feasible. This is the obligation that started on 12 September 2026.
- Information before the sale. Before a customer buys, rents or leases a connected product, they must be told what data it generates, how much, and how they can access it.
- Access on request. Where the user can’t get the data directly, the data holder has to provide it on request, without undue delay and free of charge to the user.
- Sharing with third parties. Users can ask the data holder to share their data with a third party, such as an independent repair shop.
- Limits on the data holder. A manufacturer that wants to use non-personal product data itself needs a contract with the user to do so.
- Unfair terms. A data-related contract term imposed unilaterally on another business isn’t binding on it if the term is unfair.
- Cloud switching. Cloud and other data processing providers must make it easier for customers to switch providers, and they can only charge reduced, cost-based switching fees until those charges are abolished entirely on 12 January 2027.
Key dates
| Date | What applies |
|---|---|
| 12 September 2025 | Most of the Data Act, including user access and sharing rights, the cloud switching rules and the unfair terms rules for contracts concluded after this date |
| 12 September 2026 | Access by design for connected products and related services placed on the market after this date |
| 12 January 2027 | Switching charges for cloud and data processing services must be removed completely |
| 12 September 2027 | Unfair terms rules apply to certain contracts concluded on or before 12 September 2025 |
Who it affects
- Manufacturers of connected products placed on the EU market, wherever they’re based. A Chinese or US manufacturer selling smart devices into the EU is covered.
- Providers of related services, such as the app that controls a device.
- Businesses that buy data services or cloud, which get the unfair terms protections and the switching rights.
- Cloud and SaaS providers with EU customers.
There’s a carve-out for the smallest firms. Micro and small enterprises don’t have to meet the user data access obligations, as long as they don’t have a larger partner or parent that would otherwise be caught.
A worked example
Kessler Wärmetechnik, a German maker of smart heat pumps with 140 staff, launches a new model in October 2026. Because the model goes on sale after 12 September 2026, Kessler has to design it so homeowners can get the operating data (temperatures, run times, energy use) themselves, for example by downloading it in the app, rather than relying on Kessler to hand it over.
Before a homeowner buys, the product information has to explain what data the heat pump produces and how to get it. If a homeowner asks Kessler to share the data with an independent installer, Kessler has to do that on fair terms. And if Kessler wants to use that non-personal operating data to improve its own products, it needs that right in its contract with the user.
Kessler’s older model, already on the market before 12 September 2026, isn’t caught by the design rule. But the access on request and sharing rights have applied to it since September 2025. My honest view is that many manufacturers underestimated that part.
The Digital Omnibus, as of September 2026
The Commission’s digital simplification package includes changes to the Data Act. It hasn’t been adopted. The Council hasn’t agreed a negotiating mandate, and Parliament’s committees received more than 1,750 amendments by mid-July 2026. A Council compromise text reported in July would ease cloud switching for SMEs and small mid-caps on older contracts, allow proportionate early-termination fees in fixed-term contracts, widen trade secret grounds for refusing access, and fold several other EU data laws into the Data Act. Those are proposals, not law. Adoption is expected late 2026 at the earliest.
What to do now
- List your connected products and related services, and note which were placed on the market after 12 September 2026.
- For new products, check that users can reach their data directly, and update pre-sale information.
- Set up a process to handle access and third-party sharing requests.
- Put a clear data use clause in your user terms if you want to use non-personal product data.
- Review data-related terms you impose on business customers for anything one-sided. Our data processing agreements guide covers the personal data side.
- If you sell cloud services, plan to remove switching charges by 12 January 2027.
Sources
- European Commission: Data Act
- EUR-Lex: Regulation (EU) 2023/2854 (Data Act)
- McCann FitzGerald: Data Act developments in 2026 and beyond
- Greenberg Traurig: Digital Omnibus proposes amendments to the Data Act
This article is general information, not legal or tax advice. Laws differ between countries and states and change over time, so check the rules that apply to you or speak to a qualified professional.