Navigating the EU Data Act: A Guide for Smart Makers

Executive Summary

The EU Data Act, in force since January 2024 and generally applicable since September 2025, marks a major shift in how data generated by connected devices must be accessed, shared, used and protected. For smart equipment manufacturers, this regulation challenges traditional approaches to data access, usage rights, governance and monetisation.

The Act establishes rights for users to access certain data generated by connected products and related services, and to request that this data be shared with authorised third parties. It also introduces obligations concerning data accessibility, fair contractual terms and the protection of commercially sensitive information.

At its core, the Data Act aims to unlock the value of industrial data, remove unfair barriers and create a more competitive European data economy. Its implications extend beyond EU borders. Manufacturers headquartered outside the EU may also fall within its scope when their connected products are placed on the EU market or their related services are provided in the EU.

While these requirements introduce operational and architectural challenges, they also create opportunities for innovation. Manufacturers that establish transparent, user-centric data practices can strengthen customer trust, develop new service opportunities and build more competitive digital ecosystems.

This paper explains the Data Act’s relevance for smart equipment manufacturers, outlines its key requirements and identifies practical steps for addressing compliance obligations in 2026 and beyond.

Introduction

Connected equipment is becoming the norm across industrial sectors. From factory floors and energy grids to agricultural machinery and building management systems, manufacturers increasingly rely on connected devices to monitor performance, enable remote support and deliver predictive analytics. The data these machines generate is valuable, and manufacturers have traditionally exercised significant control over how it is accessed and used.

The EU Data Act changes this landscape. The regulation introduces a legal framework governing access to and use of data generated by connected products and related services. It requires data holders, including equipment manufacturers where applicable, to make certain data accessible to users and, at their request, authorised third parties.

These access rights generally cover readily available raw and pre-processed data, together with the metadata necessary to interpret and use it. However, they do not automatically extend to inferred or derived data, such as insights generated through additional analysis or proprietary algorithms. The distinction depends on the nature of the processing involved and is particularly important for equipment manufacturers developing differentiated, value-added digital services.

The Act also establishes rules governing third-party data sharing, fair contractual terms, compensation arrangements and the protection of trade secrets.

For smart equipment manufacturers, these requirements are significant. However, they also provide an opportunity to modernise data governance, improve interoperability and develop more transparent relationships with customers and ecosystem partners.

Understanding the EU Data Act

Scope and Objectives

The EU Data Act establishes rights and obligations concerning data generated through the use of connected products and related services made available in the European Union.

It covers a broad range of connected equipment, from consumer appliances to industrial machinery, including relevant digital services connected to the operation or functionality of those products.

The regulation distinguishes between several important roles, including users, data holders and third-party data recipients. Equipment manufacturers may act as data holders where they have the right or obligation to use and make relevant data available, but the manufacturer is not automatically the data holder in every situation.

Its overarching objectives are to:

• Unlock industrial data for broader access and reuse.
• Empower users to access and share data generated through their use of connected products.
• Promote fair access to data and reduce barriers to switching data processing services.
• Protect trade secrets and commercially sensitive information while enabling appropriate data sharing.
• Encourage innovation and competition in related and aftermarket services.

Timeline and Enforcement

The EU Data Act establishes two related but distinct sets of obligations for equipment manufacturers, reflecting different application dates.

Existing connected products and related services: Since 12 September 2025, users have had the right to access readily available data generated by connected products and related services, together with the metadata necessary to interpret and use it. Where this data is not directly accessible, the data holder must make it available following a simple electronic request, without undue delay and free of charge, in a comprehensive, structured, commonly used and machine-readable format. These obligations can also apply to equipment already deployed in the field.

New connected products and related services: Since 12 September 2026, the data-accessibility-by-design requirements under Article 3(1) have applied to connected products placed on the EU market from that date and to related services provided for them. These must be designed to make relevant data readily available to users. Where relevant and technically feasible, data must be directly accessible, including through appropriate interfaces or remote access mechanisms. Where direct access is not relevant or technically feasible, request-based access obligations continue to apply.

For equipment manufacturers, this creates two parallel priorities: establishing reliable processes to fulfil data access requests across their existing installed base, and incorporating data accessibility into the design and development of new connected products and related services.

Key Considerations for EU Data Act Compliance

1. User Data Access and Portability

The Data Act establishes requirements for making relevant data generated by connected products and related services accessible to users.

Under Article 4(1), where data is not directly accessible, data holders must make readily available data accessible to users upon request, without undue delay and free of charge.

For connected products placed on the market since 12 September 2026, Article 3(1) also establishes accessibility-by-design requirements. Products and related services must be designed to make relevant data readily available, with direct access where relevant and technically feasible.

These obligations generally concern raw and pre-processed data, together with the metadata necessary to interpret and use it. They do not automatically extend to highly enriched inferred or derived data generated through additional proprietary analysis.

Manufacturers should therefore understand which data falls within the scope of these obligations, where it is held and how authorised users can access it securely and reliably.

2. Data Access, Value-Added Services and Fair Contract Terms

The Data Act distinguishes between access to data generated by connected products and related services and the proprietary, value-added digital services that manufacturers build around that data.

While manufacturers must provide users with access to relevant raw and pre-processed data, this does not necessarily require them to unbundle or separately offer proprietary analytics, dashboards, predictive maintenance applications or other premium services.

For example, a manufacturer may be required to provide access to underlying machine data even where a customer has not subscribed to its advanced analytics offering. However, this does not automatically extend to the manufacturer’s proprietary algorithms, analytical models or insights derived from them.

The regulation also establishes requirements concerning fair contractual terms and restrictions on arrangements that improperly undermine statutory data access rights.

Manufacturers should review customer agreements, terms of use and licensing policies to ensure that contractual arrangements are consistent with applicable Data Act obligations.

3. Third-Party Data Sharing Enablement

The Data Act gives users the right to request that relevant data generated by their connected products and related services be made available to third parties of their choosing.

For example, a factory operator may wish to share machine data with an independent maintenance provider or an external analytics specialist. Data holders must facilitate this access securely, without undue delay and in accordance with the applicable requirements.

Importantly, the Act also establishes safeguards against certain competitive uses of shared data. Data recipients are prohibited from using data obtained under the Act to develop a connected product that competes with the product from which the data originates.

However, this restriction does not generally prevent third parties from using the data to develop or provide competing related or aftermarket services, such as maintenance, repair or analytics.

For equipment manufacturers, this distinction is particularly significant. While the Act enables greater competition in data-driven services, it also provides protections against the use of shared product data to develop competing connected equipment.

Manufacturers should therefore establish appropriate mechanisms for managing third-party access, defining permitted uses of shared data and protecting commercially sensitive information.

4. Safeguarding Trade Secrets

While the Data Act promotes broader access to industrial data, it also recognises the importance of protecting trade secrets.

The regulation provides mechanisms for identifying trade secrets and establishing appropriate technical and organisational safeguards before protected information is disclosed.

Data holders and recipients may agree on measures designed to preserve confidentiality, including access restrictions, confidentiality obligations and other proportionate protections.

In exceptional circumstances, a data holder may withhold or suspend the sharing of specific trade-secret-protected data where the applicable legal conditions are met, including circumstances involving a demonstrated likelihood of serious economic damage.

Such decisions must be justified and handled in accordance with the regulation’s notification and procedural requirements.

Manufacturers should establish clear processes for identifying trade secrets, assessing disclosure risks, agreeing appropriate safeguards and documenting decisions concerning restricted access.

5. Pricing and Monetisation Policies

The Data Act requires relevant data to be made available to users free of charge under the applicable user access provisions.

However, this does not prevent manufacturers from developing commercial services that provide additional value through analytics, predictive maintenance, benchmarking or other forms of advanced data processing.

The regulation also establishes rules governing compensation for data made available to third parties. Where compensation is permitted, it must comply with the applicable requirements concerning fairness, reasonableness and non-discrimination, including relevant limitations and exceptions.

For manufacturers, the distinction between mandatory access to relevant product data and optional value-added services is therefore important when designing commercial offerings.

By clearly separating statutory data access rights from premium digital services, manufacturers can support compliance while continuing to develop differentiated revenue opportunities.

6. Public Sector Requests and Exceptional Needs

The Data Act includes provisions allowing certain public-sector bodies to request access to private-sector data in situations of exceptional need.

These provisions address circumstances including:

1. Responding to a public emergency, such as a natural disaster or other major incident, where access to relevant data is necessary.
2. Fulfilling specific public-interest tasks, subject to the regulation’s conditions, including restrictions on the types of data that may be requested and requirements concerning necessity and availability.

These provisions do not establish an unrestricted right for public authorities to access manufacturers’ data.

Manufacturers should establish procedures for assessing the legitimacy, scope and legal basis of relevant requests, and for responding in accordance with the regulation’s safeguards.

Data Categorisation and Classification

A practical data inventory should distinguish raw observations, pre-processed readings, necessary contextual metadata, inferred or derived outputs, personal data and information potentially protected as trade secrets. These categories can overlap: for example, machine location data may be both in-scope product data and personal data.

Classification should be based on the actual processing and legal context, not labels alone. Manufacturers should document data provenance, the data holder, applicable user rights, sensitivity and retention, and any justified limits on disclosure.

The use of Privacy-Enhancing Technologies (PETs), such as anonymisation, pseudonymisation or encryption, does not automatically change the classification of raw or pre-processed data into inferred or derived data. These techniques are designed to protect sensitive information rather than generate new analytical insights. Consequently, their application does not, in itself, remove data from the scope of the Data Act’s access and sharing obligations.

This supports consistent decisions without assuming that all telemetry is freely shareable or that every processed value is excluded.

Third-Party Ecosystem Enablement

A workable sharing framework should allow users to identify eligible recipients and permit data holders to provide the relevant datasets securely, in the required format and timeframe.

Manufacturers should assess identity verification, authorisation, appropriate access boundaries, contractual conditions, records of disclosures and processes for withdrawal or changes in access.

The right architecture will depend on the equipment, service model and data flows. Detailed platform design and implementation choices should be developed with technical, legal and data-governance stakeholders rather than presumed in this paper.

Alignment with Other EU Digital Regulations

While the EU Data Act is a foundational framework for industrial data access, manufacturers must navigate it alongside other important EU regulations:

• GDPR (General Data Protection Regulation): Continues to govern personal data and prevails where applicable privacy rules conflict with the Data Act. A Data Act access request does not itself eliminate the need for a lawful basis for personal-data disclosure.
• Data Governance Act (DGA): Addresses complementary data-sharing arrangements, including mechanisms for facilitating trusted data sharing and reuse.
• AI Act: May separately apply to AI systems built around industrial data, particularly where manufacturers use machine-generated information in AI-driven applications.

Manufacturers should also assess relevant sector-specific legislation and national enforcement requirements.

A coordinated approach to these regulations can help reduce duplication, improve data governance and support long-term digital innovation.

Best Practices for Building Data-Ready Connected Equipment

To meet their obligations and unlock future opportunities, manufacturers should:

• Inventory connected products and related services, including readily available datasets and the metadata needed to interpret them.
• Design secure, practical access routes, using standards-based interfaces where appropriate.
• Separate qualifying underlying data from proprietary analytical outputs and value-added services.
• Maintain data lineage and records of access decisions, including applicable safeguards and recipient permissions.
• Review contracts, privacy controls and trade-secret procedures with legal and compliance stakeholders.

Further Guidance from the European Commission

For additional implementation guidance, manufacturers should consult the European Commission’s Frequently Asked Questions – Data Act, updated in January 2026.

The FAQ provides practical clarification on important aspects of the regulation, including the scope of data access obligations, direct and indirect access mechanisms, edge processing, related services, data-holder responsibilities, interactions with the GDPR, trade-secret protections, cloud switching and enforcement.

While the FAQ is a valuable resource for interpreting and applying the Data Act, it is not legally binding. Manufacturers should use it alongside Regulation (EU) 2023/2854 and applicable sector-specific and national legislation, which remain the authoritative legal framework.

What Smart Equipment Manufacturers Need to Do Next

To assess and strengthen their EU Data Act compliance, manufacturers should focus on five priority actions:

1. Audit your connected product portfolio

Identify which products and data are in scope. Assess your ability to fulfil data access requests for existing equipment and ensure products placed on the market after 12 September 2026 meet the applicable data-accessibility-by-design requirements.

2. Assess your data infrastructure and sharing readiness

Evaluate whether your current systems and processes can support secure data access, export and third-party sharing. Identify gaps in data availability, access mechanisms and governance.

3. Review and update customer contracts

Ensure that agreements reflect users’ statutory data access rights. Review provisions concerning permitted data uses, third-party sharing and potentially unfair contractual restrictions.

4. Establish secure data access processes

Define how users and authorised third parties can request, retrieve and share relevant data. Assess the technical and operational capabilities needed to support secure, reliable access.

5. Engage your legal and compliance teams

Coordinate with legal, product and technical stakeholders to establish data classification policies, trade-secret safeguards, privacy requirements and practical implementation priorities.

Conclusion

The EU Data Act is reshaping how industrial data is accessed, shared and used. While its requirements introduce significant operational and architectural considerations, manufacturers that embrace transparency, user access and responsible data governance will be better positioned to compete and grow.

For equipment manufacturers, the immediate challenge is twofold: meeting established data access obligations for equipment already in service while incorporating accessibility into newly marketed connected products.

The Act also preserves opportunities for manufacturers to develop differentiated analytics and value-added services. Understanding the boundary between shareable underlying data and proprietary analytical outputs is therefore essential.

Rather than treating the Data Act solely as a compliance obligation, manufacturers can use it as an opportunity to modernise their data architectures, strengthen customer relationships and build more open, trusted digital ecosystems.

Take the Next Step

The path to effective Data Act compliance begins with understanding the data generated by connected products, identifying applicable access obligations and establishing appropriate governance processes.

Manufacturers should bring together their legal, product development, data management and technical teams to assess existing capabilities, prioritise compliance gaps and establish a practical roadmap for meeting their obligations.

By taking a structured approach to data access and governance, equipment manufacturers can meet evolving customer expectations while protecting their ability to innovate and deliver differentiated digital services.

Explore More: Navigating EU Digital Regulations

The EU Data Act is just one part of an evolving regulatory landscape for Smart Makers. Understanding how different EU regulations affect connected products, cybersecurity and AI is essential for building secure, compliant and future-ready solutions.

Explore our related white papers for practical guidance:

• Cyber Resilience Act (CRA) White Paper – Understand the CRA’s cybersecurity requirements and what they mean for connected product development, security and lifecycle management.
• NIS2 Directive White Paper – Explore how manufacturers can strengthen IoT security, operational governance and compliance in regulated environments.
• EU AI Act White Paper – Discover the implications of the EU AI Act for Smart Makers, including AI risk classification, organisational responsibilities and governance throughout the product lifecycle.