A modern car produces hundreds of parameters a second, a connected boiler knows exactly how many hours it has worked, a farm machine logs consumption and faults before the operator notices anything. Until yesterday that data almost always belonged to whoever built the device: users saw as much of it as the official app chose to show them. Since September 12, 2026, that is no longer the case, at least in Europe.
What changed on September 12
The Data Act (EU Regulation 2023/2854) has applied since September 2025, but the most demanding part has only just kicked in: the access by design requirement in Article 3. Connected products and related services placed on the market after September 12, 2026 must be designed so that the data they generate is accessible to the user by default — easily, securely, free of charge, in a comprehensive, structured, commonly used, machine-readable format. Where it is technically feasible, access must be direct: from the device, without going through the manufacturer.
The difference from the past is subtle but decisive. Access to data used to be a contractual matter, negotiated case by case. Now it is a design requirement: if the device was never built to expose its data, no clause will fix it.
The obligation is not retroactive. It covers products placed on the market after that date, not the entire catalogue already in circulation — which means two generations of devices, under two sets of rules, will coexist for years.
Which data, and for whom
The regulation covers product and related service data, including the metadata needed to interpret it: sensor readings, operating states, events, diagnostics. It does not cover the outputs of proprietary algorithms, which stay with the manufacturer.
The user — a private individual or a company — can obtain it for themselves, and can also ask for it to be shared with a third party of their choosing: an independent repair shop, a maintenance provider, a competing service. That is where the regulation really bites, because it dismantles the arrangement where only the official network can read the data from the machine you bought.
Some cases fall outside the perimeter: data that would reveal trade secrets can be protected through agreed measures, and micro and small enterprises benefit from exemptions.
What it means if you build things
For anyone making connected hardware or the apps that go with it, the work is concrete:
- A data access channel. A documented API, an export in a standard format, or both. “You can see it in our app” is no longer an acceptable answer.
- Information before the sale. The regulation requires telling people in advance what data the product generates, in what format, how often, how to get it, and whether it is stored continuously.
- Permission handling. If users can send their data to a third party, you need a verifiable way to grant and revoke that access.
- Machine-readable formats. A PDF is not a structured format. A documented CSV or JSON is.
The open problems
- Where trade secrets begin. Is a sensor’s calibration, or the logic of a consumption algorithm, know-how or raw data? The line is still blurry, and practice will draw it.
- The security of direct access. Opening a channel to a device’s data means opening an attack surface. Authentication, rate limits, and logs become part of the requirement, not an extra.
- The cost for small manufacturers. Exemptions for the smallest firms help, but anyone just above the threshold has to design a full data infrastructure for modest volumes.
- “Generated” versus “derived” data. A meter measuring kWh produces raw data; the estimated monthly cost is a computation. Plenty of disputes will be fought exactly on that boundary.
Tip: if you are designing a connected device or the app that drives it, write a page now listing the data it generates, the format it can be exported in, and who can authorise sharing it. You need it legally, but more importantly it is the document that forces you to find out what you actually collect — usually more than you remembered.
What to expect next
The next deadline is January 12, 2027: from that day, cloud providers will no longer be able to charge switching fees when a customer moves to another provider, after the gradual reduction that started in 2025. That is the other half of the Data Act, the half aimed at service lock-in rather than device lock-in.
Put together, the two halves tell the same story: the data you produce by using a product or a service is not a by-product belonging to whoever sold it to you. For developers, the practical consequence is that data export stops being a feature at the bottom of the backlog and becomes part of the design — which, it is worth saying, is also how you build apps people trust.