The EU Data Act is easy to miss because it sits between several more talked-about topics: AI regulation, data protection, cybersecurity and cloud lock-in. For businesses that make, sell, integrate or rely on connected products, though, it is becoming very practical.
The rules have applied in the EU since 12 September 2025. A further design obligation for connected products and related services applies to products placed on the EU market from 12 September 2026. That makes this a useful checkpoint for UK manufacturers, software suppliers, equipment distributors and service businesses that sell into the EU or support EU customers.
The short version is this: data generated by connected products can no longer be treated as something only the manufacturer or platform owner controls by default. In many situations, users should be able to access the data their equipment generates, share it with a third party, and move more easily between cloud or data-processing providers.
What the Data Act Is Trying to Fix
The European Commission’s overview of the Data Act describes it as a framework for fair access and user rights around data, especially data created by connected devices. The examples are broad: cars, smart TVs, agricultural equipment and industrial machinery all sit within the kind of connected-product economy the law is aimed at.
That matters because modern products often create useful operational data after they have been sold. A machine might record usage hours, temperature, pressure, fault events, energy use, cycle times or performance patterns. That data can help with maintenance, diagnostics, optimisation, repair, insurance, training and new services.
Historically, the customer using the equipment has not always had clear access to that data. The supplier may have kept it inside a proprietary portal, restricted exports, charged heavily for integration, or made it difficult for an independent service provider to use the information. The Data Act is intended to make that kind of lock-in harder to justify.
Who Should Pay Attention?
For a small UK business that only runs a normal brochure website, the Data Act is unlikely to be the next urgent compliance task. It becomes more relevant when a business is involved in connected products, digital services, cloud platforms or operational data flows touching the EU market.
The groups most likely to need a review include:
- Manufacturers of connected equipment that sell machines, devices, vehicles, sensors or smart products into the EU.
- Software and app providers whose service changes how a connected product behaves or gives customers access to product data.
- ERP, integration and analytics suppliers that receive product or machine data on behalf of customers.
- Cloud and SaaS providers serving EU customers, especially where switching, export or interoperability terms are unclear.
- Industrial businesses using connected equipment that want better access to their own operating data for maintenance, reporting or optimisation.
The Data Act is an EU regulation, so UK-only activity will often be outside its direct scope. The boundary is not always simple in real operations. A UK supplier placing a connected product on the EU market, providing a related service to EU users, or contracting with EU customers should check the position rather than assuming Brexit removes the issue.
The Connected-Product Design Deadline
The legal text of Regulation (EU) 2023/2854 sets out the Data Act itself. Most provisions apply from 12 September 2025, but the Article 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026.
In practical terms, that means new connected products should be designed so that relevant product data and related service data are accessible to the user. This is not only a legal wording issue. It can affect product architecture, customer portals, APIs, data export formats, permission models, contracts, technical documentation and support processes.
A manufacturer that leaves the review until sales contracts are already signed may find that the hardest changes are not in the legal wording. They may be in old firmware, closed databases, supplier-controlled dashboards or undocumented data pipelines.
What Data Are We Talking About?
The Commission’s Data Act explainer says the connected-product provisions cover raw and pre-processed data generated by use of a connected product or related service where that data is readily available to the data holder. It can include relevant metadata and can include both personal and non-personal data.
That does not mean every piece of analysis, model output or protected know-how must be handed over. The Commission notes that inferred or derived data can fall outside the connected-product chapter, and the Data Act includes limits around competing connected products, trade secrets, security requirements and GDPR. Personal data still needs a valid legal basis where the person requesting access is not the data subject.
For businesses, this means the practical review should separate categories of data clearly:
- sensor and telemetry data generated by the product;
- events, logs, usage records and operating measurements;
- customer-entered data, configuration and metadata;
- analytics, predictions, enriched reports and derived insight;
- personal data that needs GDPR handling;
- trade-secret or security-sensitive material that needs controlled access.
This is where technology and contract work need to meet. A clause promising “data access on request” is weak if nobody knows where the data lives, which system controls permissions, or whether the export includes personal data from operators, drivers or customers.
Cloud Switching Is Part of the Same Picture
The Data Act is not only about machines and devices. It also includes rules for data-processing services, including cloud and edge services. The Commission says providers must remove obstacles that stop customers switching provider or using several services at the same time. For Platform as a Service and Software as a Service, the explainer highlights open interfaces and exports in commonly used, machine-readable formats.
One date is especially important for cloud customers and suppliers: switching charges, including data egress charges for operations necessary to switch, are due to be removed from 12 January 2027. Until then, transitional rules allow some cost-based charges.
For a business buying cloud software, this should sharpen procurement questions. Can you export the data in a usable format? What metadata is included? How long does export take? Is there an API? What happens to audit logs, attachments, automations, dashboards and integrations? How much of the system can be moved, and what remains proprietary?
A Practical Review Checklist
Businesses do not need to turn this into a theoretical policy exercise. The useful work is to map the actual systems, data and customer promises.
- List connected products and related services. Include equipment, apps, portals, telemetry services, maintenance platforms and customer dashboards.
- Identify EU exposure. Check whether products are placed on the EU market, used by EU customers, or supported by EU-facing services.
- Map generated data. Record what data is created, where it is stored, who controls it, and whether it is raw, pre-processed, inferred, personal or commercially sensitive.
- Check customer access routes. Review portals, APIs, exports, authentication and support processes. Access should not depend on one person manually pulling spreadsheets from a hidden system.
- Review contracts and pre-sale information. Product literature, service terms and data-sharing clauses should say clearly what data exists, how it can be accessed, and what limits apply.
- Check third-party sharing. If customers can ask for data to be shared with another provider, work out how consent, identity, permissions, logging and revocation will be handled.
- Test cloud exit paths. For SaaS, ERP, hosting and analytics platforms, test whether exports are complete enough to move service or support a parallel system.
- Document trade-secret and security controls. If access may be limited for legitimate reasons, make sure those reasons are specific, evidenced and technically enforceable.
Why This Is Also an Opportunity
The Data Act is often framed as another compliance burden. For some suppliers it will be exactly that, especially where systems were built around closed access and manual exports. But better data access can also make connected products more useful.
Manufacturers can build clearer service portals, stronger maintenance offers and cleaner APIs. Customers can combine equipment data with ERP, quality, energy and production systems. Smaller specialists can offer repair, analytics, optimisation and reporting services where the customer chooses to share data with them.
The businesses that handle this well will not treat data access as a grudging legal add-on. They will make it part of product quality: understandable documentation, sensible permissions, reliable exports, secure APIs and contracts that match how the technology actually works.
The Sensible Next Step
If your business sells or supports connected products, start with one product line or one customer workflow. Follow the data from the machine or device through the platform, portal, report, integration and contract. That will show whether the Data Act is a minor documentation update or a deeper architecture issue.
For cloud and software buyers, use the same moment to review exit terms and export quality. Even where the Data Act does not apply directly, a system that cannot provide usable exports, clear metadata and a tested exit route is a business risk. Regulation is only one reason to fix it; operational resilience is the better one.