The EU Data Act: since 12 September 2026, a connected product is designed with data access built in
The "access by design" obligation of the EU Data Act applies to connected products placed on the market since 12 September 2026. What it imposes on a specification, and why it is decided before the microcontroller is chosen.
The EU Data Act (Regulation (EU) 2023/2854) became applicable on 12 September 2025. A year later, on 12 September 2026, its most structural provision for a design office kicked in: access by design.
Two waves, two scopes
It helps to separate what applies since when, because the two obligations do not fall on the same teams.
- Since 12 September 2025 (Articles 4 and 5): the user of a connected product has the right to obtain the data it generates, free of charge, in a structured, machine-readable format, and to have it transmitted to a third party of their choice. Where direct access is not possible, the data holder must provide it on request. This is primarily a legal and operational obligation.
- Since 12 September 2026 (Article 3(1)): connected products and related services placed on the market from that date must be designed so that data is accessible by default, easily and securely. This is a design obligation — it targets the product, not just the contract.
The legislator allowed twelve extra months precisely because complying with Article 3 means touching the product architecture, which cannot be done through a contract amendment.
What "by design" means in a specification
The requirement is deliberately technology-neutral. In practice it comes down to a few decisions taken early:
- Identify the product's data: raw measurements, usage data, operating logs, the metadata needed to interpret them. These are the data "generated by use", whether personal or not.
- Provide an access path: local interface, API, export. It has to exist when the product is placed on the market, not be added for the first customer who asks.
- Choose a usable format and document it: an undocumented proprietary binary frame does not meet "structured, commonly used and machine-readable".
- Manage access rights: the user, a third party they designate, and nobody else. That implies identity, authorization and traceability on the device or platform side.
- Preserve trade secrets: the regulation provides for protective measures, but they must be justified and proportionate, not invoked wholesale to refuse everything.
Information before the sale
Article 3 also requires, before the contract is concluded, informing the user of the type, format and volume of data generated, how it can be accessed, the identity of the data holder and how to exercise their rights. These belong in the product documentation and the commercial datasheet — not only in the terms and conditions.
Why this changes design, not just paperwork
A product built to send its data exclusively to the manufacturer's cloud, with no local interface and no export, needs a firmware overhaul to comply. Conversely, a device that already exposes its measurements on a documented interface — the choice we make on our gateways — has nothing to catch up on. The question is settled at architecture time, well before the microcontroller or the radio protocol is chosen.
It meets another requirement on the same European calendar: the security of digital products, carried by the Cyber Resilience Act and the RED directive, which we cover in a dedicated article. Giving access to data and securing that access are two sides of the same design work.
What still needs watching
Two points call for vigilance. First, contracts: unfair clauses on business-to-business data access have been regulated since September 2025, with a specific regime for long-term contracts concluded before that date. Second, the portability of data processing services — the "cloud switching" part of the same regulation — whose heaviest obligations land on 12 January 2027.
As always with a recent text, the exact qualification of your product deserves legal advice: whether a piece of equipment is a "connected product" within the meaning of the regulation, and who its "data holder" is, is not always obvious.
Sources
Have an IoT project in mind?
Describe your context, we'll propose a tailored solution.