The short answer
From 12 September 2026, the EU Data Act requires new connected products and related services placed on the EU market to be designed so that users can get to their own data by default. Article 3(1) of Regulation (EU) 2023/2854 says product data and related-service data — plus the metadata needed to interpret them — must be “easily, securely and free of charge” accessible to the user, in a “structured, commonly used and machine-readable format,” and directly accessible where technically feasible. In engineering terms, that is a documented export or API, not a support ticket. The obligation binds anyone placing products on the EU market, so a US or UK vendor selling connected hardware or a related service into Europe is squarely in scope, and getting EU data-compliance aligned with the build is now part of shipping the product.
The practical reading: if you make connected hardware, IoT sensors, wearables, connected vehicles, industrial or medical devices, or the cloud services that run them, data access is now a product feature you have to design in — before the device ships, not after a user complains. The regulation itself has applied since 12 September 2025; the 2026 date is the one that turns it into code you have to write.
What changes on 12 September 2026?
The EU Data Act is the Union’s horizontal law on who can access and use the data generated by connected products and related services. Most of its provisions became applicable on 12 September 2025. But the single most engineering-heavy obligation was deliberately deferred by a year to give makers time to build for it: the access-by-design duty in Article 3(1), which applies to connected products and related services placed on the EU market after 12 September 2026.
Until now, the Data Act largely told data holders what they must do when a user asks for data. From this deadline, it also dictates how the product must be built in the first place. A connected coffee machine, a fleet telematics box, a factory robot, a glucose monitor or a smart thermostat launched into the EU after the date must ship with the ability to hand the user their data already designed in. That reframes compliance from a legal review into a hardware-plus-software delivery problem, which is why it lands on embedded and connected-product engineering teams as much as on counsel.
The reach is broad and deliberately extraterritorial. The obligation applies to any manufacturer of connected products, and any provider of related services, that places them on the EU market — irrespective of where that company is established. A US wearables startup, a Japanese industrial-equipment maker or a UK SaaS vendor whose service is a “related service” for a connected device all fall in scope the moment they sell into Europe. Non-EU data holders offering related services in the Union also have to designate an EU legal representative.
What “access by design” actually requires
Article 3(1) sets the default. Connected products and related services must be designed and manufactured so that product data and related-service data — together with the metadata necessary to interpret and use them — are, by default, “easily, securely and free of charge” accessible to the user. The data must be in a “structured, commonly used and machine-readable format” and, “where relevant and technically feasible,” directly accessible to the user. Read that as a specification: a documented, authenticated data endpoint or export — not a PDF, not a number read off a screen, not a CSV you email on request three weeks later.
The scope of data is specific. It covers raw and pre-processed data that are readily available to the data holder, plus the metadata needed to make sense of them. It does not force you to surrender heavily enriched or inferred analytics, or content protected by intellectual property — the value you add on top of the raw signal stays yours. Getting that boundary right is a data-modelling decision: you need to know which fields are “readily available product data” and which are proprietary derivations, and to expose the former cleanly through a data-access API without leaking the latter.
Article 4 handles the case where direct, built-in access is not technically feasible: the data holder must then make the data available to the user on a simple electronic request, without undue delay and free of charge. Article 5 goes a step further — on the user’s instruction, the data holder must share the data with a nominated third party (a repairer, an analytics provider, a competitor’s aftermarket service) on fair, reasonable and non-discriminatory terms. Designated gatekeepers under the Digital Markets Act are excluded as eligible third-party recipients. The through-line: the user, whether a consumer or a business customer, controls where their product data goes, and your architecture has to make that control real.
What it means for US & EU software teams
First, data portability is now a product requirement, not a nice-to-have. For years, connected-product teams treated the telemetry a device generates as a private asset locked inside the vendor cloud. The Data Act inverts that default: the user has a right to the readily-available data their device produces, in a form a machine can actually consume. If your roadmap does not have a documented export or API on it for EU-bound products, the deadline just added one.
Second, the hard part is the data model, not the endpoint. Standing up an API is routine engineering. Deciding exactly which fields are “readily available product data” that must be exposed, versus enriched or inferred data you are entitled to keep, is where teams get stuck — and it is a decision that touches firmware, cloud storage, analytics and legal at once. Products designed with a clean separation between raw signal and value-added analytics comply cheaply; products where everything is tangled together in one proprietary blob face an expensive retrofit.
Third, US vendors do not get a pass. The obligation follows the EU market, not the company’s headquarters, so “we’re a US business” is not a defence for a device sold in Berlin or Milan. And where the product data is also personal data, GDPR keeps applying on top — you still need a lawful basis, purpose limitation and security for any personal data you expose or share. The Data Act adds a portability-and-access layer; it does not replace privacy law. Teams that build a single, well-governed data-access layer — authenticated, logged, consent-aware, format-stable — satisfy both regimes at once instead of bolting on separate one-off answers to each request.
What to do now
- Inventory your connected products and related services aimed at the EU. Map which SKUs and services will be placed on the EU market after 12 September 2026 — those are the ones that must ship access-by-design. Existing products already on the market are treated differently, so the launch date matters.
- Classify your data. For each product, separate readily-available raw and pre-processed data (in scope) from enriched, inferred or IP-protected data (out of scope). Capture the metadata a user would need to interpret each field. This classification is the foundation everything else sits on.
- Design the access path. Build a documented, authenticated data-export API or in-product access that returns data in a structured, commonly used, machine-readable format. Add the Article 4 fallback (data on simple electronic request) and the Article 5 flow (share to a user-nominated third party on fair terms).
- Wire in identity, consent and logging. You must confirm who the user is, honour their instructions on third-party sharing, keep personal data GDPR-compliant, and log access for audit. Treat these as first-class parts of the feature, not afterthoughts.
- Review your contracts and terms. Unfair contract terms that block data access or overcharge for it are unenforceable under the Act. Check licensing, warranty and data clauses now, and appoint an EU legal representative if you are a non-EU data holder offering related services in the Union.
Frequently asked questions
What is the EU Data Act access-by-design deadline?
From 12 September 2026, Article 3(1) of the EU Data Act (Regulation (EU) 2023/2854) requires connected products and related services placed on the EU market to be designed so that, by default, product data and related-service data — plus the metadata needed to interpret them — are easily, securely and free of charge accessible to the user, in a structured, commonly used and machine-readable format, and directly accessible where technically feasible. The duty attaches to products placed on the market after that date; the regulation itself has applied since 12 September 2025.
Which products and services are in scope?
Connected products — any physical item that obtains, generates or collects data about its use or environment and can transmit it, such as smart appliances, wearables, medical devices, connected vehicles, industrial and agricultural machinery, and IoT sensors — plus the digital services that make them work (related services). It applies to raw and pre-processed data that are readily available, with the metadata needed to use them; it excludes heavily enriched, inferred data and IP-protected content.
Does the Data Act apply to US and other non-EU manufacturers?
Yes. The access-by-design obligation applies to any manufacturer of connected products, or provider of related services, that places them on the EU market, irrespective of where it is established. A US, UK or Asian company selling into the EU is in scope. Non-EU data holders offering related services in the EU must also appoint a legal representative in the Union.
What data must be shared, and in what format?
Readily-available product and related-service data, plus the metadata to interpret them, in a structured, commonly used and machine-readable format — in practice a documented API or export. Where direct access isn’t feasible, Article 4 requires the data holder to provide it on a simple electronic request, without undue delay and free of charge. Under Article 5, the user can direct sharing to a nominated third party on fair terms; DMA gatekeepers are excluded as recipients.
How is the Data Act different from GDPR?
GDPR governs personal data and gives individuals rights over it. The Data Act is broader: it covers data generated by connected products whether or not it is personal, and grants access and portability rights to the user — who may be a business customer. Where product data is also personal data, GDPR continues to apply on top. Treat the Data Act as an engineering-and-contracting obligation about who gets which product data, in what form; GDPR still governs lawful processing of any personal data involved.
Sources
EUR-Lex — Regulation (EU) 2023/2854 (Data Act)
Latham & Watkins — EU Data Act: What Businesses Need to Know
Wilson Sonsini — EU Data Act September 2026 Deadline: What Businesses Need to Know