Digital & AI
Regulation (EU) 2023/2854
Data Act
Data Act
If a connected product generates data — a tractor, a car, a factory sensor — you should be able to get that data and share it with a repair shop of your choice.
Does this hit me?
Your car or appliance data should not be a black box. Independent repair gets a legal hook. Privacy still applies — this is not a free-for-all on personal data.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
Jan 2024
Entered into force.
Sep 2025
Most provisions apply.
Why it exists
Manufacturers sat on usage data, locking repair and aftermarkets. Cloud customers also needed an easier way to leave a provider.
What actually changes
- Users of connected products can access product and related service data.
- They can share it with third parties (repair, insurance, analytics) under conditions.
- Unfair B2B data contract terms can be void.
- Cloud switching and safeguards against unlawful non-EU government access.
How it hits you
Your car or appliance data should not be a black box. Independent repair gets a legal hook. Privacy still applies — this is not a free-for-all on personal data.
For citizens
What this does to everyday life
Rights, bills, and what you can ignore. You are usually not the one who files — companies and states are.
Your car, tractor, or appliance data
If a connected product generates data, you (the user) should be able to get it and share it with a repair shop or insurer you choose — not only the brand's workshop.
Rights you actually get
- Access and portability of product data you generate as the user.
- GDPR still covers personal data in that telemetry.
Costs and trade-offs
- Some manufacturers will fight over trade secrets. Expect clunky first versions of 'share with independent repair'.
What you can do
- Ask in writing for product data and for a way to send it to an independent garage.
What you can ignore
- Strangers do not get a live feed of your car unless you authorise sharing.
If something goes wrong
National Data Act authority; DPA if the data is personal. Consumer bodies for repair-and-fairness fights.
More citizen notes across files: For people
Heard this? Not quite.
Claim: Anyone can download your car's full history.
The user (owner/holder) is in the driving seat. Sharing is user-authorized, and GDPR still covers personal data.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU digital, product and data teams. Regulation (EU) 2023/2854. Main rules from 12 September 2025.
Scope
- You make connected products available in the EU, or you hold their data; or you provide cloud/edge services.
First 90 days
- Before Sep 2025: Define user access and third-party sharing flows for product data.
- Before Sep 2025: Rewrite B2B data terms against the unfair-terms list.
Penalties: Set mainly by Member States; unfair terms can be void even without a fine.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. Manufacturers of connected products, related service providers, and data holders; also cloud switching rules.
You are probably
Manufacturers of connected products, related service providers, and data holders; also cloud switching rules.
Effort
A scoped programme this year beats a scramble at the apply-date.
Budget
SME: owner time plus one honest vendor. Large: a named lead, not a taskforce slide.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
Product + legal
This pack names Product + legal as an owner of early work.
Define user access and third-party sharing flows for product data.
Legal
This pack names Legal as an owner of early work.
Rewrite B2B data terms against the unfair-terms list.
Are you in scope?
This year's work- You make connected products available in the EU, or you hold their data; or you provide cloud/edge services.
Usually not, if
- A purely analogue product with no related digital service.
First moves
- Before Sep 2025Define user access and third-party sharing flows for product data.Product + legal
- Before Sep 2025Rewrite B2B data terms against the unfair-terms list.Legal
- If you repair or analyse machine data, the Act is a right you can invoke — ask the manufacturer in writing.
If you skip this
- Building an API that only your own aftermarket can authenticate to.
Done looks like
- Data-access design.
- User permission logs.
- Cloud switching runbooks.
Keep this evidence
- Data-access design.
- User permission logs.
- Cloud switching runbooks.
Ask vendors
- How does a user export product data to an independent repairer?
Where programmes usually break
- Building an API that only your own aftermarket can authenticate to.
Call counsel when
- Set mainly by Member States; unfair terms can be void even without a fine.
- A supervisor letter, a dawn information request, or a deal that warrants this file.
Enforcement
Set mainly by Member States; unfair terms can be void even without a fine.
National competent authorities for the Data Act; data protection authorities where personal data is involved.
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Regulation
- Legal basis
- Art 114 TFEU · Regulation (EU) 2023/2854
- Application
- In force 11 January 2024. Main application 12 September 2025. Some IoT design duties and unfair-contract terms apply on that date; cloud switching has staged application; certain essential-facility data-sharing obligations have later dates.
A horizontal data-economy statute: users of connected products get access to the data those products generate and can share it with third parties; unfair B2B data-sharing terms are policed; cloud customers get switching and in-parallel use; public bodies get exceptional access in emergencies. GDPR remains lex specialis for personal data. Trade secrets are protected but cannot nullify access.
How the file is built
IoT / product data (Chapter II)
Connected products and related services. The user (natural or legal person owning, renting, or leasing) can access and share readily available data.
B2B unfair terms (Chapter IV)
A list of terms that are unfair if imposed on SMEs (and some that are always void). Model contractual terms from the Commission are expected.
Cloud switching (Chapter VI)
Providers of data-processing services must enable switching, reduce egress obstacles, and support concurrency. Switching charges phased out.
Operators
| Role | Who | Core duties |
|---|---|---|
| Data holder | Typically the manufacturer or related-service provider who holds product data. | Design for access, share with user and user’s chosen third party, protect trade secrets proportionately. |
| User | Owner, renter, lessee of the product. | May authorise third parties; not a free-for-all to the public. |
| Data-processing service provider | Cloud, edge, and similar. | Switching, transparency of contracts, unbundling of specified services. |
Scope
Placing connected products on the Union market; related services to Union users; data-processing services offered to customers in the Union. Extra-territorial for non-EU manufacturers selling connected products here.
In
- Data generated by the use of connected products and related services (except certain content and inferred data — read Art 2 definitions carefully).
- B2B data-sharing contracts.
- Data-processing services (cloud).
Out, or narrower than assumed
- Certain data already in scope of sectoral access regimes may be adjusted, not double-charged.
- Micro and small manufacturers get design-duty reliefs for their own products, with limits.
- Personal data remains under GDPR; the Data Act does not create a new lawful basis.
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Arts 3–5 | Product design for access by default; user and third-party sharing of readily available data. | OEM business models that monetise exclusive telemetry need a new legal design. |
| Art 4(6)/5 | Trade secrets: disclose under conditions; refuse only in specific circumstances with notification to the authority. | A blanket ‘trade secret’ stamp fails. |
| Cloud switching | Remove switching obstacles; cap then eliminate egress charges on a timetable. | Cloud procurement should already price lock-in as a legal risk, not only a discount. |
Secondary law and guidance
- Commission model contractual terms and standard clauses for cloud.
- Guidance on ‘readily available data’ and trade secrets.
- National competent authorities (often the same as data or telecom regulators).
National layer. Competent authorities designated nationally. Penalties within a Union maximum frame (up to 4% of worldwide annual turnover for specified infringements, aligned with GDPR-style ceilings in parts).
How it sits with other files
If product data is personal, sharing with a third-party garage still needs a GDPR route (usually the user’s request / Art 6).
Gatekeeper data combination and steering rules sit beside Data Act access — different addressees.
Training AI on product data obtained via Data Act sharing still needs lawful basis and, if high-risk, data-governance duties.
Enforcement and private rights
Who
National data/economy authorities; cooperation via the European Data Innovation Board.
Tools
Orders, fines, complaint handling. Cloud customers will also sue on contract.
Private rights
Users and third parties can complain and litigate access refusals. Unfair terms are non-binding.
Risk register
| Risk | Signal | Control |
|---|---|---|
| Telemetry lock-in | Dealer-only diagnostic data | Product redesign for user access by Sept 2025 application. |
| GDPR-blind sharing | Sending driver-identifiable vehicle data to a third party on a Data Act request only | Joint Data Act + GDPR playbook. |
| Unfair SME terms | Take-it-or-leave-it clauses blocking SME use of shared data | Review Chapter IV blacklist/grey list. |
Open issues
- Boundary of ‘readily available’ vs derived/inferred data.
- Trade-secret vs access in automotive and industrial equipment.
- Cloud ‘switching’ in practice for tightly coupled PaaS.
Primary sources
If a connected product generates data — a tractor, a car, a factory sensor — you should be able to get that data and share it with a repair shop of your choice.
You feel it now
This is a this-year file.
Next
Main rules from 12 September 2025
Where it lands
| Channel | People | Companies |
|---|---|---|
| Aftermarket unlocked | Your car or appliance data should not be a black box. Independent repair gets a legal hook. Privacy still applies — this is not a free-for-all on personal data. | Users can share product data with a repair shop or insurer. Closed telemetry as a moat gets thinner. |
| Contract and trade secrets | Your car or appliance data should not be a black box. Independent repair gets a legal hook. Privacy still applies — this is not a free-for-all on personal data. | You may protect secrets, but not by refusing all access. Design APIs and permissioning now. |
| Cloud | Your car or appliance data should not be a black box. Independent repair gets a legal hook. Privacy still applies — this is not a free-for-all on personal data. | Switching and in-parallel use become contractual and technical duties for data-processing services. |
Who gains
Users, independent repair, and smaller aftermarket firms.
Who pays
Manufacturers of connected products and related services; cloud providers on switching.
Who pays
Manufacturers of connected products and related services; cloud providers on switching.
Who benefits
Users, independent repair, and smaller aftermarket firms.
Read the official text