EU Data Act Obligations for Manufacturers and Cloud Vendors

The EU Data Act splits supplier duties by role. If you make connected products or provide the related services tied to them, you must design them so users can reach the data they generate.

As the data holder, you must also give readily available data to the user, or to a third party the user chooses, without undue delay, at no cost to the user, in a format machines can read.

If you sell cloud or edge computing services, your duties come from a different part of the Act. Customers must be able to switch to another provider within fixed time limits. Switching charges end on 12 January 2027. Your service also has to meet minimum interoperability requirements.

The law is Regulation (EU) 2023/2854, and it already applies across the EU. Micro and small enterprises are exempt from the connected product duties, and two deadlines are still ahead.

I am not a lawyer, so read this as a packaging view and not as legal advice. When a client's campaign stalls, whether it runs on cold email or LinkedIn outreach, I usually find a packaging problem before a tactics problem. Compliance breaks the same way. Sort each product, service and contract into its role first. Then do the tasks.

What follows is a dated roundup of the EU text and the Commission's implementation pages, sorted by role. This is not legal advice.

What does the EU Data Act require from suppliers?

The Commission calls the Act a horizontal framework: one set of rules covering who may access and use data, written to make more data available, especially data from industry (Commission FAQs page). "Horizontal" means your role in the data flow sets your duties, whatever industry you sell into.

When do the Data Act rules apply?

Five dates matter. Three are behind you and two are still ahead.

The first two dates come from the Commission's Data Act policy page, the charges date from the Commission's Data Act explainer, and the rest from Article 50 of the Regulation.

For connected products, the useful planning question in October 2026 is product by product: when did this item reach the EU market?

The test runs unit by unit, not model by model. A unit placed on the EU market after 12 September 2026 falls under the design duty, even if the model launched years earlier. Units placed before that date are outside Article 3(1). The access-on-request duties in Articles 4 and 5 still cover the readily available data those units produce.

Answer that question in a spreadsheet with product, related service, market date and data holder. Sales copy calling anything "Data Act ready" waits until those rows are filled in. Packaging first, then the pitch.

For cloud vendors the question is different: which live contracts still bill for switching or exit, and which long-running data terms were signed before September 2025.

What must connected product vendors do?

A connected product generates data about its use or its environment and can send that data out. A related service is the digital service, often an app, tied to how the product works. Both carry duties.

Who is exempt

Article 7 takes the smallest suppliers out. If a micro or small enterprise makes or designs the product, or runs the related service, the connected product rules do not apply to that data. Two conditions: it has no partner or linked enterprise above that size, and nobody subcontracted it to make or design the product (EUR-Lex full text).

A medium-sized enterprise gets the same relief during its first year at that size, and for each product during the first year after it places that product on the market.

Check your group structure before you rely on this. A small subsidiary of a large group has a linked enterprise above the threshold, so it does not qualify.

The design duty

Under the EU text, both the product and its related service have to be built so the user can reach the data easily, securely and for free, in a "comprehensive, structured, commonly used and machine-readable format". The text also leaves engineering room: the manufacturer's design choices decide which data a product is capable of making available.

In practice, the duty covers what the product actually produces. It does not require you to invent new sensors.

Information before the contract

Before a product is sold, rented or leased, the seller, renter or lessor has to tell the user what data it can generate, including type, format and estimated volume, and how that data can be stored, retrieved or accessed. Product teams own that information. Sales teams have to put it in front of the buyer before signature.

The Commission's Data Act explainer also lists collection frequency as part of that information. So build one short data sheet per product with 5 lines: data types, format, estimated volume, how often it is collected, and how the user gets it.

Access on request and sharing with a third party

Where the user cannot reach the data directly, Article 4 makes access a duty on request: the data holder hands over the readily available data without undue delay, free of charge and in a machine-readable format.

Article 5 extends that. If the user asks, the data holder must send the same data to a third party the user chooses, and the user still pays nothing.

The Commission's news release from the day the Act started to apply says users in manufacturing and agriculture get access to data on how their industrial equipment performs, and users can choose more cost-effective repair and maintenance providers.

For a machinery supplier, the aftermarket service business now competes on data it used to keep to itself. And that business is not small.

BCG's third services benchmark study found that industrial manufacturers that prioritize aftermarket services earn one-third or more of their total income from them. A McKinsey analysis across 30 industries put the average EBIT margin on aftermarket services at 25%, against 10% for new equipment. That is the margin now open to competitors.

Where cloud infrastructure falls outside

The recitals separate product data from pure hosting. The server holding product data may be the manufacturer's own, a third party's or a cloud provider's, and processors acting for someone else are not data holders. Data accessed only for storage or processing on behalf of third parties, such as cloud infrastructure run entirely for other clients, sits outside these access rules.

A worked example

Take a maker of industrial compressors that ships each unit with a telemetry module and sells a monitoring app. The telemetry is stored on a hosting platform the maker rents. One customer is a food plant in France.

• The plant is the user.
• The maker, with its monitoring app, is the data holder for the compressor and app data. For units placed on the market after the design date, the design duty applies too.
• The plant's head of maintenance asks for 12 months of pressure and runtime logs. The maker supplies them under Article 4.
• The plant then asks the maker to send the same feed to an independent maintenance firm. That is Article 5, and the plant pays nothing for it.
• The hosting platform is a processor here. The maker still answers the plant. The host runs the export under whatever the processing contract says.

Write that handoff into the processing contract before the first request arrives: who runs the export, in which format, and within what time.

What should cloud and data-processing providers check?

A cloud or edge provider can play two roles, so sort each contract first.

When you host product data for a manufacturer, you are the processor from the example above. The access duties sit with your customer, but your customer cannot meet them without you, so your processing contracts need the export handoff in writing.

When you sell the service in your own right, Chapter VI applies to you directly.

Switching duties

Article 25 says your contract must let a customer switch to another provider, or move its exportable data and digital assets to its own on-premises systems. The limits are fixed:

• Notice to start a switch: at most 2 months.
• Transition after the notice ends: at most 30 calendar days, with the contract and the service still running.
• Data retrieval after the transition: at least 30 calendar days for the customer to take its data out.
• If 30 days is technically unfeasible, you have 14 working days from the request to say so, explain why, and propose an alternative period of no more than 7 months, keeping the service running throughout.

Article 29 deals with money. The Commission's explainer says the Act removes switching charges, data egress included, from 12 January 2027, and that until then providers may still charge the costs they incur for switching and egress. Any contract that would bill an exit fee after that date needs new wording now.

The UK Competition and Markets Authority's working paper on egress fees says switching costs are more likely to stop customers switching when they are large. Take the fee away, and a customer who stayed only because leaving was expensive is free to go.

Interoperability

The same explainer says cloud and edge providers have to meet minimum requirements that make interoperability easier. Review your interfaces, export formats, technical documentation and customer contract together, because a customer planning a switch will read them together.

Keep law and support material apart. The Commission has published several tools, and only one of them is the law.

The Data Act Legal Helpdesk takes questions on requirements, rights and obligations, including data access, sharing obligations, user rights and interoperability. You sign in with EU Login, submit a form and get a tailored reply by email. The Commission aims to answer within 15 working days under its Code of Good Administrative Behaviour.

Use it for a narrow question about your own product, with your role described, and keep counsel for the full review.

Which contract terms should suppliers review first?

The Commission says the Act bans unfair contract terms that would block data from being shared. Its explainer adds that the unfair-terms rules protect every business, SMEs above all, from one-sided clauses imposed on them. Article 50 phases those rules in, as the dates table shows.

The Commission's model terms and clauses page says both sets were developed to help parties, especially SMEs, apply the Act, and that using them is voluntary.

For mandatory data sharing there are three MCT sets, one for each relationship: data holder and user, user and data recipient, data holder and data recipient. The cloud SCCs cover exit, termination, security and business continuity, plus clauses on non-dispersion, non-amendment and liability.

Review in this order:

1. Product terms and service agreements that say who may access and use device or service data
2. Clauses that limit what a customer may do with data, or who they may share it with
3. Processing agreements with your own hosting provider, checked against the export handoff described above
4. Cloud contracts you sell, checked against the Article 25 notice and transition limits and compared clause by clause with the SCC topics
5. Data sharing agreements with partners, compared with the MCT set that matches the relationship

If sales tells a buyer "your data is yours" while the template restricts sharing, the buyer will notice the gap in procurement. Fix the template first. Then the deck.

How do personal data and GDPR fit in?

The Regulation states plainly that it gives the data holder no lawful ground of its own to collect or generate personal data. Any sharing of personal data still needs a valid basis under the GDPR.

This matters when the user asking for data is not the person the data describes. A machine log that records which operator signed in, or vehicle data that shows who was driving, contains personal data.

The Data Act says you must provide the data; the GDPR decides whether, and how, the personal parts can go. Flag every data field that identifies a person, and send those fields to legal review before the first export.

Where should a supplier start in the first 30 days?

Does the Data Act apply to you?

If you place connected products on the EU market, sell a related service that runs with them, or provide cloud or other data-processing services to EU customers, the Data Act applies to you wherever your company is based.

Then apply one filter: a micro or small enterprise with no larger partner or linked company is outside the connected product duties, but the cloud switching and unfair-terms rules can still reach it.

If you only set B2B terms for data access and use, review your contract templates. If none of this applies, check again before your next EU launch.

Who owns each data flow

Each row below needs a named person who can change that data flow. A shared team inbox does not count.

The first 30 days

1. Days 1 to 3: start from your customers. My team starts targeting by looking at a client's current and past customers. Do the same here: list every EU customer using your connected products or your cloud service. They are the users who can send the first request. Note your own company size and group structure next to the list, so you know whether Article 7 applies.
2. Days 4 to 7: find who will ask. When we target a new niche, I look back at past deals to see who actually made the decision, and I use the real titles for that niche. At your customers, the person who asks for machine data is more likely a head of maintenance or a plant manager than anyone in procurement. Brief your account managers to expect them.
3. Days 8 to 12: export one product line and read it. Pull a real data export and go through it row by row, the same way I take a lead list apart before anyone writes the message. Check every field before a customer sees it. Mark what is readily available, what is machine-readable, and what identifies a person.
4. Days 13 to 16: write the pre-contract data sheet. One page per product, built from the 5 lines in the pre-contract section above.
5. Days 17 to 20: build request intake and a log. Put one named person on the request inbox, the way my team puts an inbox manager on campaign replies so nothing gets missed. Log each data request with the date received, the date fulfilled and who handled it. "Without undue delay" is easier to defend with dates.
6. Days 21 to 25: compare contracts with the Commission tools. Use the five-step review order from the contract section and mark every clause that restricts access or sharing. Cloud vendors also mark every notice period over 2 months and every exit fee that would still apply after January 2027.
7. Days 26 to 28: run the GDPR pass. Legal reviews every personal data field found in step 3.
8. Days 29 to 30: send open questions to the helpdesk. One specific question per request, with your role and product described.

What happens if a supplier ignores the Data Act?

Enforcement is national. Each Member State designates the competent authorities and sets the penalties, which Article 40 requires to be effective, proportionate and dissuasive, so the size of a fine depends on the country that handles the case (Commission Data Act explainer and the Regulation).

Personal data raises the ceiling. Where personal data is involved, data protection authorities can fine breaches within their competence under Article 40(4), using the GDPR fine scale in Article 83. At the top of that scale the GDPR cap is EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5) GDPR).

That ceiling applies only to breaches a data protection authority handles, not to every Data Act breach.

The cost usually shows up earlier, at the customer. A head of maintenance who asks for equipment data and gets a vague answer has a reason to shortlist someone else at renewal, and a clause that blocks sharing is exactly the kind of term Chapter IV targets once it covers that contract.

Your buyers will ask for the export before they read any "Data Act ready" page. For a buyer of connected equipment or cloud software, a data request is the real audit of a supplier. Fix one product line first, end to end. Then scale the same flow across the catalogue.

If the Data Act is turning into a packaging question for your product, and you want help with the outreach side, book a call.