Direct answer: the EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. For connected products and related services placed on the EU market after 12 September 2026, Article 3(1) requires that product data, related service data and the metadata needed to interpret and use them be, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and directly accessible to the user where relevant and technically feasible. Users may also request data under Article 4 or ask the data holder to share it with a third party under Article 5; the data holder must provide it without undue delay, at the same quality and free of charge to the user. Cloud/edge and other data processing service providers must meet switching requirements: a maximum notice period of 2 months, a 30-day transition (up to 7 months where technically infeasible), at least 30 days of retrieval after the transition, and no switching charges from 12 January 2027 (only reduced, directly related charges before then).
This guide is for manufacturers/exporters of connected products sold in the EU (IoT, industrial equipment, smart appliances, vehicle-related devices) and providers of cloud, edge, SaaS and other data processing services. Data cut-off: 8 November 2026; sources are the European Commission Data Act policy page, Data Act Explained, the EUR-Lex Regulation and the Commission Data Act FAQ (version 1.4, 22 January 2026). Official facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) The Data Act already applies; 12 September 2026 is the Article 3(1) "accessible by default" design date for newly placed connected products, not the entry-into-application date of the whole regulation. (2) Free to the user does not mean free to third parties: a data holder may request reasonable, non-discriminatory compensation from a third-party recipient under Article 9, but may not charge the user. (3) Cloud switching has hard limits: 2 months' notice, 30-day transition, 30-day retrieval, and zero switching charges from 12 January 2027; contracts and export formats need to change now.
Timeline: from entry into force to zero switching charges in 2027
The Data Act was adopted on 13 December 2023, published in the Official Journal on 22 December 2023, entered into force on 11 January 2024 and has applied since 12 September 2025. Article 50 also stages application: Article 3(1) applies to connected products and related services placed on the market after 12 September 2026; Chapter IV (unfair contractual terms) applies to contracts concluded after 12 September 2025, and from 12 September 2027 to pre-existing contracts of indefinite duration or due to expire at least 10 years after 11 January 2024; switching charges could be reduced from 11 January 2024 to 12 January 2027, and must be zero from 12 January 2027.
| Date | Event | What it means |
|---|---|---|
| 13 Dec 2023 | Data Act adopted | Harmonised EU rules on data access/sharing/switching |
| 11 Jan 2024 | Entry into force | Implementation preparation begins |
| 12 Sep 2025 | Applies | Main data access, sharing, contract and switching duties |
| 12 Sep 2026 | Article 3(1) date | Connected products placed on the market afterwards must be accessible by default |
| 12 Jan 2027 | Switching charges end | Cloud/edge providers may not charge for switching |
| 12 Sep 2027 | Chapter IV for legacy contracts | Unfair-term rules for indefinite/long-term contracts |
Sources: Regulation (EU) 2023/2854 Article 50; European Commission Data Act policy page and Data Act Explained (accessed 8 November 2026). Specific application, transition and national enforcement follow the Regulation and competent authority requirements.
Who is in scope: products, data holders, users, third parties and cloud providers
The Data Act covers connected products placed on the EU market and related services, plus data processing services (cloud, edge and similar). The main roles are: manufacturer/data holder (designs the product, holds the data, provides it to users/third parties); user (an individual or business that buys, rents or leases a connected product); third party (a data recipient at the user's request); data processing service provider (switching); and public sector bodies (exceptional-need access under Chapter V). A non-EU manufacturer that places a connected product on the EU market is covered for that product; the Data Act also contains safeguards against unlawful third-country government access to non-personal data held in the EU (Chapter VII).
| Role | Core duty/position | Check first |
|---|---|---|
| Connected product manufacturer | Accessible-by-default design, pre-contract disclosure, data-holder duties | Whether the product is placed on the EU market and when |
| Data holder | Provide data to users/third parties, trade-secret protection, compensation rules | Data scope, trade secrets |
| User | Access/use/share data; must not develop a competing product | User identity and authorisation |
| Third party | Purpose limitation, no profiling, no gatekeeper, no competing product | Contract and user authorisation |
| Cloud/edge provider | Switching, export, notice/transition/retrieval, charges | Service type, contract term |
| Public sector | Exceptional-need data requests (Chapter V) | Legal basis and scope |
| Non-EU vendor | Applies when products are placed on the EU market; third-country access safeguards | EU representative, data location |
Sources: Regulation (EU) 2023/2854 Articles 1-6, 23-31 and 34-36 and the European Commission Data Act Explained (accessed 8 November 2026). This is an editorial summary; scope, role determination and national enforcement follow the Regulation.
Connected products: accessible by default, pre-contract disclosure, user requests
Article 3 requires connected products to be designed and manufactured, and related services designed and provided, so that product data and related service data (including metadata needed to interpret and use them) are, by default, easily, securely, free of charge, comprehensive, structured, commonly used and machine-readable, and directly accessible to the user where relevant and technically feasible. Pre-contract information must clearly cover the type/format/estimated volume of data, whether it is generated continuously/real-time, whether it is stored on-device or remotely and for how long, how the user can access/retrieve/erase it, how to request sharing with a third party, and complaint rights. If the user cannot access the data directly, Article 4 requires the data holder to provide it without undue delay, at the same quality, free of charge, structured/machine-readable and, where relevant, continuously/real-time; security restrictions and trade secrets are handled under Article 4(2) and (6)-(9), with notification to the competent authority.
| Duty | Key point | Checkable evidence |
|---|---|---|
| Accessible-by-default design | Article 3(1): data + metadata easily, securely, free, structured, machine-readable, directly accessible | Product architecture, API/export docs, permission design |
| Pre-contract disclosure | Article 3(2)/(3): data type/format/volume, real-time, storage/retention, access/erase, sharing/complaints | Instructions, contract annex, product page |
| User request | Article 4: without undue delay, same quality, free, structured/machine-readable, continuous/real-time | Request workflow, SLA, logs |
| Third-party sharing | Article 5: at user request; free to the user; conditions under Articles 8/9 | Authorisation records, sharing API, contract |
| Security restriction | Article 4(2): contractual restriction/prohibition possible only for serious health/safety/security impact, with authority notification | Risk assessment, restriction basis, notification |
| Trade secrets | Article 4(6)-(9): identify, protect, withhold/suspend with written reasons, notify authority | Trade-secret register, NDA/access control |
Sources: Regulation (EU) 2023/2854 Articles 3-5 (accessed 8 November 2026). This is an editorial summary; data scope, trade-secret determination and security exceptions require case-specific legal analysis.
Third-party sharing: purpose limitation, contracts and compensation
When a user asks a data holder to share data with a third party, Article 5 applies, and the third party is bound by Article 6: it may process the data only for the purposes and conditions agreed with the user; erase it when no longer needed (unless otherwise agreed for non-personal data); must not manipulate the user's choices; must not use the data for profiling unless necessary to provide the requested service; must not pass it to another third party unless there is a contract with the user and trade-secret protections are in place; must not make it available to a gatekeeper; and must not use it to develop a competing product. Article 8 requires fair, reasonable, non-discriminatory and transparent terms and no discrimination between comparable recipients; Article 9 allows reasonable, non-discriminatory compensation (a margin is allowed, but SMEs and not-for-profit research organisations are limited to direct costs), and compensation is not payment for the data itself. Article 13 makes unfair B2B contractual terms non-binding.
| Party | Key constraint | Contract/evidence |
|---|---|---|
| Third party | Purpose limitation, erasure, no profiling, no gatekeeper, no competing product | Data-sharing agreement, user authorisation, audit rights |
| Data holder | FRAND, non-discrimination, transparency; no trade-secret disclosure except legal exceptions | Terms, pricing/compensation method, refusal reasons |
| Compensation | Reasonable, non-discriminatory, may include a margin; SMEs/non-profit research limited to direct costs | Cost calculation, compensation breakdown |
| Unfair terms | Article 13: terms grossly deviating from good commercial practice/contrary to good faith are non-binding | Contract review, negotiation record |
| User | Must not use the data to develop a competing product or share it for that purpose | Use-restriction clause |
Sources: Regulation (EU) 2023/2854 Articles 5, 6, 8, 9 and 13 (accessed 8 November 2026). This is an editorial summary; compensation calculation, trade-secret measures and unfair-term findings require case-specific legal analysis.
Cloud switching: 2 months' notice, 30-day transition, 30-day retrieval, zero charges in 2027
Article 23 requires data processing service providers to remove switching obstacles; Article 25 requires the contract to set out switching rights and obligations: the customer may switch to the same service type or to on-premises ICT, with a maximum notice period of 2 months and a maximum transition period of 30 calendar days. If that is technically infeasible, the provider must explain within 14 working days and offer an alternative transition period of up to 7 months; after the transition, there must be at least 30 days of retrieval, followed by full erasure of exportable data. Article 29 allows reduced switching charges from 11 January 2024 to 12 January 2027, capped at the direct costs of switching; no switching charges may be imposed from 12 January 2027. Article 30 requires open interfaces for non-infrastructure services and export in a structured, commonly used, machine-readable format; Article 28 requires disclosure of the jurisdiction of the ICT infrastructure and measures against third-country governmental access.
| Stage | Deadline/requirement | Action |
|---|---|---|
| Notice period | Maximum 2 months | Contract states method and start date |
| Transition | 30 calendar days; up to 7 months if infeasible | Assist, maintain continuity, disclose risks |
| Retrieval | At least 30 days after transition | Export formats, interfaces, download tools |
| Erasure | Full erasure of exportable data after retrieval | Deletion proof, audit record |
| Charges | Zero from 12 January 2027; only direct costs before | Fee schedule, cost calculation |
| Interfaces/format | Open interfaces for non-infrastructure services; structured/machine-readable | API docs, export format, online register |
| International access | Disclose jurisdiction and measures against third-country access | Website section, contract clause |
Sources: Regulation (EU) 2023/2854 Articles 23, 25 and 28-30 (accessed 8 November 2026). This is an editorial summary; "same service type", technical infeasibility and the scope of custom-built services follow the Regulation and competent authority interpretation.
90-day implementation checklist
If there is no Data Act programme yet, use the first 90 days to connect what data the product generates, who can access it, how it is exported, how contracts are written and how the cloud can be switched. The order is: data map, product design/pre-contract disclosure, user and third-party request workflow, trade secrets and contracts, cloud switching/export, evidence and drills.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Inventory connected products, generated data, metadata, storage location and user types | Data map, product scope |
| Weeks 2-4 | Implement Article 3 accessible-by-default design and pre-contract disclosure | Product/instructions/contract update list |
| Weeks 4-6 | Build user access and third-party sharing workflow (Articles 4/5) | Request form, API/export, authorisation records |
| Weeks 5-7 | Identify trade secrets and security restrictions; define refusal/suspension process | Trade-secret register, NDA, notification templates |
| Weeks 6-9 | Review data-sharing contracts and compensation (Articles 8/9/13) | Contract templates, compensation calculation |
| Weeks 8-11 | Cloud switching drill: notice, transition, export, retrieval, erasure | Switching runbook, export format, fee schedule |
| Weeks 10-12 | Evidence pack and management review | Compliance evidence index, remediation plan |
Editorial implementation advice, not an official template; specific product design, contracts, trade secrets and switching requirements follow the Data Act, Commission FAQ/guidance and competent authority requirements.
FAQ
Does the Data Act apply now?
Yes. It entered into force on 11 January 2024 and has applied since 12 September 2025; Article 3(1) applies to connected products and related services placed on the market after 12 September 2026. From 12 January 2027, switching charges must be zero.
What does 12 September 2026 mean?
It is the application date for the Article 3(1) "accessible by default" design duty for newly placed products: connected products and related services placed on the EU market after that date must let users access product data, related service data and necessary metadata easily, securely, free of charge and in a structured/machine-readable format by default. It is not the entry-into-application date of the whole regulation.
Which products/companies are covered?
Connected products placed on the EU market and related services, plus cloud/edge and other data processing services. Manufacturers, data holders, users, third-party recipients and data processing service providers can all be subject to duties. A non-EU manufacturer placing products on the EU market is covered for those products.
Must data be free to the user?
Articles 3/4 require data to be provided to the user free of charge; Article 5 sharing is also "free of charge to the user". However, the data holder may request reasonable, non-discriminatory compensation from the third-party recipient under Article 9 (a margin is allowed; SMEs/non-profit research organisations are limited to direct costs). Compensation is not payment for the data itself and may not be charged to the user.
What about trade secrets?
The data holder must identify trade secrets, mark them in the metadata and agree confidentiality measures with the user/third party (NDAs, access controls, technical standards). If measures are not agreed or implemented, or confidentiality is undermined, sharing may be withheld/suspended with written reasons and notification to the competent authority; in exceptional cases of likely serious economic damage, access may be refused case by case, with written reasons and notification.
How long does cloud switching take, and is it charged?
Maximum notice period 2 months; transition 30 calendar days in principle, up to 7 months where technically infeasible; at least 30 days of retrieval after the transition, then full erasure. From 11 January 2024 to 12 January 2027 only reduced charges directly linked to switching are allowed; from 12 January 2027 no switching charges may be imposed.
How is personal data handled?
The Data Act does not affect the GDPR. Personal data still requires a legal basis under Article 6 (and Article 9 where applicable); where the user is not the data subject, the data holder providing personal data to a third party must also satisfy GDPR and ePrivacy conditions. The Data Act is not a legal basis for collecting or generating personal data.
What are the fines?
The Data Act requires Member States to set effective, proportionate and dissuasive penalties and notify the Commission by 12 September 2025; there is no single EU fine amount. For infringements of Chapters II, III and V, GDPR supervisory authorities may, within their competence, impose fines under Article 83 of the GDPR (up to the Article 83(5) amount). Specific amounts/procedures follow national law.
Research method and limitations
This article separates "official facts" from "editorial advice": the Data Act's adoption/entry-into-force/application dates, the Article 3(1) 12 September 2026 date, zero switching charges from 12 January 2027, and the content of Articles 3/4/5/6/8/9/13/23/25/28/29/30/40 come from EUR-Lex Regulation (EU) 2023/2854; policy background, chapter structure and application notes come from the European Commission Data Act policy page, Data Act Explained and the Commission FAQ (version 1.4, 22 January 2026). The 90-day list and the "evidence/action" columns are editorial.
Eight limitations: (1) this is not legal advice; (2) national competent authorities, fines and enforcement practice are not checked country by country; (3) Commission FAQ/guidance may update (this article uses version 1.4 of 22 January 2026); (4) trade-secret, security-restriction and "technical infeasibility" findings are highly fact-specific; (5) sector-specific guidance such as vehicle data is not covered; (6) no contract template, API specification or technical-standard detail is provided; (7) the article does not map the Data Act clause by clause against the GDPR, Data Governance Act, DMA or DSA; (8) personal data processing, third-country access and cross-border transfers require specific legal advice.
Sources and basis
- European Commission, Data Act: digital-strategy.ec.europa.eu/en/policies/data-act. Entry into force 11 January 2024, applies 12 September 2025; connected-product data access, cloud switching, public-sector access, unfair contract terms. Accessed 8 November 2026.
- European Commission, Data Act explained: digital-strategy.ec.europa.eu/en/policies/data-act-explained. Chapter structure, IoT data sharing, cloud switching, third-country access safeguards and relationship with the Data Governance Act. Accessed 8 November 2026.
- EUR-Lex, Regulation (EU) 2023/2854 (Data Act): eur-lex.europa.eu/eli/reg/2023/2854/oj. Articles 3/4/5/6/8/9/13 on data access and sharing, 23/25/28/29/30 on cloud switching, 40 on penalties and 50 on staged application. Accessed 8 November 2026.
- European Commission, Commission publishes Frequently Asked Questions about the Data Act (FAQ version 1.4, 22 January 2026): digital-strategy.ec.europa.eu/en/library/commission-publishes-frequently-asked-questions-about-data-act. Implementation FAQ, model contractual terms/standard contractual clauses, vehicle data guidance and legal helpdesk. Accessed 8 November 2026.
Data cut-off 8 November 2026; based on official pages and the Regulation; not legal advice; specific obligations follow the Data Act, Commission guidance/FAQ, competent authorities and national law.