EU Data Act: What U.S. Connected-Product Makers Need to Know

The EU Data Act (Regulation (EU) 2023/2854) gives users of connected products the right to access and share the data their use of those products generates ^[1][2]. It applies to manufacturers of connected products placed on the EU market wherever the manufacturer is established ^[1], so a US company selling connected equipment into Europe is covered.

This guide takes the manufacturer’s view: what counts as a connected product, the design duty for products placed on the market after 12 September 2026, how user and third-party data requests work, how trade secrets are protected, and the engineering work all this triggers. It’s part of our EU requirements hub.

Key dates

Re-verified on EUR-Lex on 2026-11-10 ^[1][3].

Our EU regulatory timeline tracks these dates with sources.

Does it apply to your product?

Connected product. An item that obtains, generates or collects data about its use or environment, can communicate product data via an electronic communications service, a physical connection or on-device access, and whose primary function isn’t storing, processing or transmitting data on behalf of someone other than the user ^[1]. The Commission’s examples include industrial machines, robots and agricultural machinery alongside consumer products ^[4].

Related service. A digital service, including software, connected with the product at the time of purchase, rent or lease such that without it the product couldn’t perform one or more of its functions, or one connected later by the manufacturer or a third party to add to or adapt its functions ^[1]. The Commission’s example is an app that adjusts a light’s brightness or a fridge’s temperature ^[4].

Product data and readily available data. Product data is data generated by using the product that the manufacturer designed to be retrievable by the user, the data holder or a third party ^[1]. "Readily available data" is product and related service data the data holder can lawfully get from the product or service without disproportionate effort beyond a simple operation ^[1]. This definition decides much of your scope; how it applies to your data is a question for counsel.

Content is out. The Commission explains that content such as a film watched on a connected TV isn’t in scope, but data on the screen’s brightness is ^[4].

Small-company exemption. The user-access and sharing obligations in Chapter II don’t apply to data from products manufactured or designed by micro or small enterprises, with conditions (for example, no larger partner or linked enterprise) ^[1]. Most of this site’s readers are larger than that.

What manufacturers must do

1. Design for access (products placed on the market after 12 September 2026)

Connected products must be designed and manufactured, and related services designed and provided, so that product and related service data, with the metadata needed to interpret it, are by default accessible to the user: easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly ^[1].

2. Tell users before the contract

Before a sale, rental or lease, the seller (which may be the manufacturer) must tell the user, among other things, what type, format and estimated volume of product data the product can generate, whether it generates data continuously and in real time, whether data is stored on-device or on a remote server and for how long, and how the user can access, retrieve or erase it ^[1]. Related service providers have similar duties ^[1].

3. Answer user requests

Where users can’t access data directly from the product, the data holder must make readily available data and metadata available without undue delay, of the same quality the data holder has, free of charge, in a structured, machine-readable format and, where relevant and technically feasible, continuously and in real time, on a simple electronic request where technically feasible ^[1].

4. Share with third parties at the user’s request

At the user’s request, the data holder must make the same data available to a third party the user chooses, under the Data Act’s conditions for business-to-business sharing ^[1].

5. Limits on your own use

You may use non-personal readily available data only on the basis of a contract with the user, and not to derive insights about the user’s economic situation, assets or production methods in ways that could undermine their commercial position ^[1]. You also may not make non-personal product data available to third parties except to fulfil your contract with the user ^[1].

Trade secrets and security

• Trade secrets must be preserved. The data holder identifies data protected as trade secrets, including in the metadata, and agrees proportionate technical and organisational measures with the user, such as confidentiality agreements and access protocols ^[1].
• If measures aren’t agreed or aren’t respected, the data holder may withhold or suspend sharing of that data, with a written, reasoned decision to the user and a notification to the competent authority ^[1].
• In exceptional cases, a data holder that can show it’s highly likely to suffer serious economic damage may refuse a request case by case ^[1][4].
• Users and data holders may contractually restrict access or sharing where it could undermine the connected product’s security requirements laid down in EU or national law, with a serious adverse effect on the health, safety or security of natural persons. A data holder that refuses on this basis notifies the competent authority ^[1].
• Users may not use the data to develop a competing connected product ^[1].

Engineering takeaway: the data holder must identify trade-secret data, including in metadata ^[1], so it helps to know this field by field before the first request arrives.

The engineering work

Our original mapping of Data Act duties to engineering tasks. It’s a planning aid, not a legal checklist.

The engineering tasks are examples of how teams might meet each duty, not requirements of the Act.

The architecture for these access paths (identity, consent, export formats, rate limits, trade-secret filtering, audit trail) is the subject of our connected equipment data API architecture guide.

Data Act vs GDPR

• Scope. The Data Act covers personal and non-personal data ^[1]. The GDPR covers personal data only.
• Which wins. The Data Act is without prejudice to EU data protection law. Where users are data subjects, Data Act access rights complement GDPR access and portability rights. In a conflict, data protection law prevails ^[1].
• In practice. Industrial equipment data is often non-personal, but operator IDs, location or usage patterns can make it personal. Your data inventory should flag which fields may be personal data, for counsel to confirm.

Data Act and the Cyber Resilience Act

The two overlap on connected products: the Data Act asks you to open data access, and the Cyber Resilience Act asks you to secure the product, including protection from unauthorised access ^[5]. Design the access path as part of your security architecture, not as an add-on. See Cyber Resilience Act vs. other EU rules and our Cyber Resilience Act guide.

Cloud and SaaS providers (one paragraph)

The Data Act also has rules on switching between data processing services such as cloud and edge services (Chapter VI) ^[1][4]. If your connected product depends on a cloud back-end you sell as a separate service, ask counsel whether those rules reach you. Otherwise they’re mainly a concern for cloud providers.

Where to start

1. List every connected product and related service you place on the EU market, with dates. Products placed after 12 September 2026 carry the design duty.
2. Build a data inventory per product, and use the device data inventory worksheet when it’s available.
3. Flag trade-secret and personal-data fields.
4. Decide the access path (on-device, API, portal) per product line.
5. Draft the pre-contract data information with your sales and legal teams.
6. Set up a request intake process, including for third parties.

If you need outside engineering capacity for the access path, see our guide to evaluating firmware development companies.

Spotted an error? Report it to our corrections log. Read our editorial methodology.