Executive summary

A further important phase of the EU Data Act is taking effect.

Under Article 3(1) of the Data Act, connected products must be designed and manufactured, and related services designed and provided, so that product data and related-service data, together with the metadata needed to interpret and use those data , are by default easily and securely accessible to users, free of charge, in a structured and machine-readable format.

Where relevant and technically feasible, the data must be directly accessible to the user.

Under the Data Act’s transitional provisions, this design obligation applies to connected products and related services placed on the market after 12 September 2026.

The requirement is particularly relevant for manufacturers and providers of IoT devices, connected machinery, vehicles, wearables, medical and health devices, smart-home products and other products generating data about their use or environment.

The Data Act is moving into product architecture

Most of the Data Act has applied since 12 September 2025.

Its rules already govern matters such as access to data generated by connected products, data sharing with third parties, contractual terms concerning access to data and switching between data-processing services.

Article 3(1), however, introduces something different.

It requires data access to be considered when the connected product or related service is designed.

For newly placed products, Data Act compliance is therefore no longer only a question of responding correctly when a customer asks for data.

Manufacturers may need to ensure that the product and its associated technical architecture have been built so that users can actually obtain the relevant data in the manner required by the Regulation.

What data must be accessible?

The obligation concerns:

• product data generated through the use of a connected product;
• related-service data generated during the provision of a related service; and
• the relevant metadata necessary to interpret and use those data.

The Data Act covers both personal and non-personal data.

However, it does not give users an unrestricted right to every piece of information held by a manufacturer.

The scope depends in particular on the data generated by the use of the connected product or related service and on the definitions and other limitations contained in the Regulation.

What does access-by-design require?

Article 3(1) requires the relevant data to be accessible by default:

• easily;
• securely;
• free of charge;
• comprehensively;
• in a structured format;
• in a commonly used format; and
• in a machine-readable format.

Where relevant and technically feasible, the user should have direct access to the data.

That may have consequences for APIs, dashboards, device interfaces, data export functionality and the underlying technical architecture of connected products and services.

The obligation extends well beyond consumer IoT

The concept of a connected product is deliberately broad.

The Regulation expressly contemplates products across the economy, including:

• industrial machinery;
• vehicles and mobility products;
• medical and health devices;
• wearables;
• smart-home equipment;
• consumer electronics;
• agricultural equipment;
• connected infrastructure; and
• other products capable of communicating data concerning their use or environment.

The Data Act can therefore be relevant in both B2C and B2B environments.

For technology companies, the key question is often not simply whether a product is marketed as an “IoT device”, but whether it generates relevant product data and is capable of communicating those data.

Product design, privacy and cybersecurity need to work together

Making data accessible does not mean disregarding other legal requirements.

Connected-product manufacturers may simultaneously need to address:

• GDPR requirements where product data contains personal data;
• cybersecurity and access-control requirements;
• the Cyber Resilience Act;
• protection of trade secrets;
• intellectual-property rights;
• confidentiality obligations; and
• sector-specific safety and security requirements.

The design challenge is therefore not simply to make as much data as possible accessible.

It is to build an architecture that enables the access required by the Data Act while preserving legally required security, confidentiality and data-protection safeguards.

Contracts and product information also matter

The Data Act does not rely on technical design alone.

Before a connected product is purchased, rented or leased, users must receive specified information concerning the data the product is capable of generating, including matters such as its type, format and estimated volume and how the user can access or retrieve those data.

Providers of related services are subject to additional transparency obligations.

This means that product design, customer documentation, contractual terms and privacy information should be reviewed together.

Technology M&A implications

The new requirement is also relevant to technology transactions.

For acquisitions involving connected products or IoT businesses, buyers may increasingly want to understand:

• when relevant product generations were placed on the market;
• whether their architecture satisfies Data Act access requirements;
• what product and related-service data are generated;
• how users access those data;
• whether third-party components affect accessibility;
• whether data-access arrangements comply with GDPR and cybersecurity requirements; and
• whether remediation would require software changes or more fundamental product redesign.

Data Act compliance may therefore become part of product-regulatory and technology due diligence for connected-product businesses.

What technology businesses should do now

1. Identify connected products in scope.

   Determine which products generate or collect data concerning their use or environment and can communicate those data.

2. Map product and related-service data.

   Identify the data and relevant metadata generated through use of the product and associated services.

3. Review technical accessibility.

   Determine how users can access or retrieve the data and whether direct access is technically feasible and relevant.

4. Review APIs and interfaces.

   Assess whether existing dashboards, APIs, export tools and device interfaces meet the Data Act requirements.

5. Coordinate privacy and cybersecurity.

   Ensure that increased data accessibility does not create inappropriate access to personal data, confidential information or protected systems.

6. Review product documentation.

   Confirm that pre-contractual information accurately describes the data generated and the means available for accessing it.

7. Review supplier arrangements.

   Where data generation or accessibility depends on third-party technology, contracts should support the manufacturer’s Data Act obligations.

8. Include Data Act compliance in M&A due diligence.

   Connected-product targets should be assessed for both technical compliance and potential remediation costs.

FAQ

When does the Article 3(1) design requirement apply?

The Data Act provides that the Article 3(1) obligation applies to connected products and related services placed on the market after 12 September 2026.

Does the requirement only concern consumer products?

No. The Data Act applies to connected products used in both consumer and business environments, subject to the Regulation’s scope and exceptions.

Must users always have direct access to the data?

Direct access is required where this is relevant and technically feasible. In other circumstances, the Data Act contains mechanisms requiring data holders to make relevant data available to users.

Does the Data Act override the GDPR?

No. Where product or related-service data constitutes personal data, GDPR requirements continue to apply.

Does this affect product development rather than only legal documentation?

Yes. Article 3(1) expressly concerns how connected products are designed and manufactured and how related services are designed and provided.

Sources

• Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act), in particular Articles 2, 3, 4 and 50.
• European Commission, Data Act implementation materials.