Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data, known as the Data Act, has applied since 12 September 2025. A further obligation is added from 12 September 2026: connected products placed on the market after that date must be designed and manufactured so that the data they generate is accessible to the user by default.
The Data Act and its application timeline
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 lays down harmonised rules on fair access to and use of data and amends Regulation (EU) 2017/2394 and Directive (EU) 2020/1828. The text was published in the Official Journal of the European Union of 22 December 2023 and entered into force on 11 January 2024.
Article 50 sets out a staggered timeline. The general rule is application from 12 September 2025. The obligation arising from Article 3(1), by contrast, applies to connected products and related services placed on the market after 12 September 2026. Chapter IV, on unfair contractual terms unilaterally imposed, applies to contracts concluded after 12 September 2025 and, from 12 September 2027, also to contracts concluded earlier where they are of indefinite duration or expire at least ten years after 11 January 2024. Chapter III applies only to data-making-available obligations under rules entering into force after 12 September 2025.
The 12 September 2026 date therefore does not change the general architecture of the regulation, which has been applicable for a year. It affects the way products are conceived, because it moves compliance from the contractual relationship to the industrial design stage.
Access by default to product data
Article 3(1) provides that connected products are to be designed and manufactured, and related services designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use that data, are by default easily, securely and free of charge accessible to the user in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible.
Connected product is defined in Article 2(5) as an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, a physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user. On its dedicated page the European Commission lists cars, smart televisions and industrial machinery among the examples.
By default means that access does not depend on a request by the user or on a configuration step after purchase. The temporal criterion set by Article 50 is the placing on the market: the new rule covers units placed on the market after 12 September 2026 and not products already available, which remain subject to the obligations to make data available upon request.
Pre-contractual information, access on request and sharing with third parties
Article 3(2) requires the seller, renter or lessor, who may be the manufacturer, to provide the user, before concluding the contract and in a clear and comprehensible manner, with certain minimum information: the type, format and estimated volume of product data that the connected product is capable of generating, together with the other elements listed in the provision.
Article 4 governs the situation where the user cannot directly access data from the connected product or related service. In that case the data holder makes the data available without undue delay, of the same quality as is available to it, easily, securely and free of charge, in the format set out in the provision and, where relevant and technically feasible, continuously and in real time, upon a simple request through electronic means where technically feasible.
Article 5 gives the user the right to request that readily available data be made available to a third party, under the same conditions of quality and timeliness and free of charge to the user. The provision excludes undertakings designated as gatekeepers under the Digital Markets Act from the eligible third parties. This is the basis for the repair and maintenance scenarios referred to by the European Commission, since it allows users to turn to operators independent of the manufacturer.
Exclusions, supervision and penalties
Article 7 excludes from the obligations of Chapter II data generated by the use of connected products manufactured or designed by a micro or small enterprise, and of related services provided by such enterprises, under defined conditions, with a comparable provision for enterprises qualifying as medium-sized under Recommendation 2003/361/EC.
Article 37 entrusts the application and enforcement of the regulation to one or more competent authorities designated by each Member State, which may establish new authorities or rely on existing ones. Where more than one authority is designated, the Member State designates a data coordinator among them. Supervision of the application of Regulation (EU) 2016/679 remains with the data protection supervisory authorities.
Article 40 leaves penalties to the Member States, which must be effective, proportionate and dissuasive, and requires notification of those rules to the European Commission, which keeps and regularly updates a public register of the measures notified.
Outlook
The timeline continues beyond 2026. On 12 September 2027 Chapter IV extends to contracts concluded before 12 September 2025 in the cases set out in Article 50, while Article 49 sets 12 September 2028 as the deadline by which the European Commission carries out an evaluation of the regulation and submits a report to the European Parliament, the Council and the European Economic and Social Committee. As regards supporting tools, the Commission has published frequently asked questions, a draft recommendation on non-binding model contractual terms for data access and use and non-binding standard contractual clauses for cloud computing contracts, and guidance on vehicle data; it has also launched a dedicated legal helpdesk. Guidance on reasonable compensation for mandatory business-to-business data sharing under Chapter III remains announced.
A second undefined element concerns the text of the regulation itself. The proposal for a regulation known as the Digital Omnibus, presented by the European Commission on 19 November 2025 (COM(2025) 837), also affects the rules on data and is registered under procedure 2025/0360(COD); according to the European Parliament Legislative Train Schedule the file is tabled and not yet concluded. Until the legislative procedure is completed, the applicable framework remains Regulation (EU) 2023/2854 as in force.
In dialogue with the 2030 Agenda
Goal 9. Industry, Innovation and Infrastructure: access by default to data generated by connected products affects device architecture and the infrastructure for transmitting and processing industrial data.
Goal 8. Decent Work and Economic Growth: the regulation extends access to equipment performance data to professional users and sets the conditions under which data is made available to other economic operators.
Goal 12. Responsible Consumption and Production: the possibility of sharing data with operators independent of the manufacturer concerns repair and maintenance services and therefore the service life of connected products.
Goal 16. Peace, Justice and Strong Institutions: Article 37 requires the designation of national competent authorities and Article 40 leaves to Member States penalties that are effective, proportionate and dissuasive.
Sources
- European Union, Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 (Data Act)
- EUR-Lex, Rules on fair access to and use of data (Data Act), summary
- European Commission, Data Act, Shaping Europe’s digital future
- European Commission, COM(2025) 837 final, proposal for a regulation of 19 November 2025 (Digital Omnibus)
- European Parliament, Legislative Train Schedule, The Digital Omnibus Regulation Proposal, procedure 2025/0360(COD)
