EU Data Act — the access-by-design obligation (Article 3(1)) starts applying to connected products placed on the EU market after 12 September 2026.
Since 12 September 2025, manufacturers have had to supply connected-product data on request. From 12 September 2026, Article 3(1) of Regulation (EU) 2023/2854 requires products placed on the EU market to be built so that those data are available by default, irrespective of where the manufacturer is established.
The EU Data Act — Regulation (EU) 2023/2854 — has applied since 12 September 2025. Users of connected products can already ask for the data they co-generate; unfair contractual terms can already be challenged.
One obligation was deliberately held back. Article 50 provides that “the obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026”. Article 3(1) is the design provision: connected products must be designed and manufactured, and related services designed and provided, so that product data and the metadata needed to interpret them are “by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user”.
The gap between the two dates is the substance of the matter. Since September 2025 the question has been whether a manufacturer can produce data when asked. From September 2026 it is what the product does unasked.
The deadline attaches to each machine shipped, not to each product line
The wording of Article 50 reads at first like a grandfathering clause for existing designs. The Commission’s own reading is narrower. Its frequently asked questions, version 1.4 of 22 January 2026, explain that placing on the market is the transfer of ownership or possession occurring after the manufacturing stage, that it happens only once per product, and that “the concept of placing on the market refers to each individual product, not to a type of product”.
The result is plain. A machine model designed in 2021 and unchanged since falls outside the design obligation for every unit placed on the market before 12 September 2026 and inside it for every unit placed after. The clock runs on shipments, not on development cycles. For a manufacturer with a long-lived catalogue, the exposure is not a future product but the current one, from the first delivery in the autumn.
Article 3(1) sets a default, not an unconditional right of direct access
The provision is often read as an obligation to open every machine to its user. The Commission answers directly: “No. Article 3(1) of the Data Act does not oblige manufacturers to grant direct access to data in all situations and for all connected products.” The qualifier “where relevant and technically feasible” preserves the manufacturer’s discretion, and the guidance lists what may be weighed: technical possibility, the cost of the modifications required, and the difficulty of protecting trade secrets or product security.
What the qualifier does not do is remove the data from reach. Where the user cannot access data directly, Article 4(1) obliges the data holder to make readily available data accessible without undue delay, of the same quality as the holder has itself, free of charge and in a structured, machine-readable format. That duty has applied since September 2025 and covers products already in service. September 2026 therefore decides architecture rather than entitlement: either route must deliver an interoperable format such as XML, JSON or CSV, and, where low latency matters, interfaces rather than manual extraction.
Choosing direct access is also a decision about trade secrets
Articles 4 and 5 carry a statutory mechanism for protected data, the trade-secrets handbrake: the data holder agrees safeguards before disclosure, may suspend sharing where they are breached, and may exceptionally refuse where objective evidence shows that serious and irreparable economic loss is highly likely.
Article 3 carries none of that. The Commission is explicit: “Different from the rights under Article 4 and 5, Article 3 does not provide for any statutory law protections of the manufacturer when making data directly available from the connected product.” Direct access may still be made conditional, but only by contract — an obligation to protect specified data, or a prohibition on using it to manufacture a competing product — and Article 7(2) makes any term that varies the user’s rights to their detriment non-binding.
The Regulation restrains both sides. Under Article 4(10) a user may not use the data obtained to develop a competing connected product, nor to derive insights about the manufacturer’s economic situation, assets and production methods. Under Article 4(13) a data holder “shall only use any readily available data that is non-personal data on the basis of a contract with the user”: a manufacturer collecting fleet telemetry for its own service business needs that contractual basis. Enforcement is not nominal: Article 40(4) allows the GDPR supervisory authorities, within their competence, to fine infringements of Chapters II, III and V under Article 83 of that Regulation, up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
For Swiss manufacturers, the obligation travels with the machine
Article 1(3) applies the Regulation to manufacturers of connected products placed on the market in the Union and to providers of related services, “irrespective of the place of establishment of those manufacturers and providers”. Establishment outside the Union is not a shelter; market access is the trigger.
The exposure is measurable. Swissmem reports that Swiss technology-industry goods exports reached CHF 68.1 billion in 2025, of which 56.4% went to the European Union and 23.0% to Germany alone, on figures from the Federal Office for Customs and Border Security. In the first quarter of 2026 those exports were worth CHF 17 billion, with EU-bound exports up 3.9% while shipments to Asia and the United States fell, and the sector employed 324,200 people. Machinery, electrical equipment and precision instruments dominate that trade.
Two consequences follow. First, the Commission’s guidance states that entities established outside the Union which make connected products or services available on the EU market must designate an EU-based representative, whom competent authorities may address directly. Second, the small-company exemption is narrower than it appears. Article 7(1) disapplies the Chapter II obligations for products manufactured or designed by a microenterprise or a small enterprise, but only where that enterprise has no partner or linked enterprise failing to qualify as micro or small, and where it “is not subcontracted to manufacture or design a connected product or to provide a related service”. A specialist supplier building to a customer’s specification is unlikely to qualify.
What can be settled before September, and what follows it
Four decisions do not depend on further guidance.
- Decide, for each product line, between direct and indirect access, and record the reasoning against the Commission’s own criteria: technical feasibility, cost of modification, trade secrets, product security.
- Prepare the pre-contractual information. Articles 3(2) and 3(3) require the seller, rentor or lessor and the provider of a related service to disclose, before the contract is concluded, the type, format and estimated volume of data the product generates, where and how long it is stored, and how the user may access or erase it. That belongs in sales documentation, not a compliance file.
- Put the contracts in place. On 19 November 2025 the Commission published, as a draft recommendation, non-binding model contractual terms for data access and use and standard contractual clauses for cloud contracts, developed with SMEs in mind.
- Check the company’s own use of machine data against Article 4(13), and appoint an EU representative where none exists.
Three further dates carry information. Commission guidelines on reasonable compensation, required under Article 9(5), are expected in the second or third quarter of 2026. Switching charges for data processing services disappear entirely on 12 January 2027. From 12 September 2027 the unfair-terms rules of Chapter IV reach contracts concluded on or before 12 September 2025 that are of indefinite duration or due to expire at least ten years from 11 January 2024.
One proposal under negotiation should not be mistaken for relief. The Commission’s Digital Omnibus of 19 November 2025, COM(2025) 837 final, would amend the Data Act in several places, but it does not touch Article 3(1) or the dates in Article 50, and it changes nothing until it is adopted.
Behind the legal question sits a commercial one. Once product data are available by design, the aftermarket manufacturers have held by default — repair, maintenance, spare parts, data-based insurance — becomes contestable by whoever the customer chooses to share the data with. The decision taken this summer settles which side of that market a company competes on, and it is taken in firmware and interfaces rather than in the legal department.