The EU Data Act does not mandate a software bill of materials. It does require makers of connected products to make product data accessible by design and to disclose what data a product can generate. A component inventory is the practical way to answer those questions, and it supports the security duties the Act leaves in place.
What does the Data Act regulate?
Regulation (EU) 2023/2854 gives users of connected products and related services access to the data those products generate. Its recitals describe data generation as the result of at least two actors, the manufacturer and the user, and aim to let users share data with third parties and use aftermarket services. Separate chapters set rules for data sharing between businesses, requests from public sector bodies in public emergencies, and switching between cloud and edge data processing services.
It is a data access law, not a vulnerability law. For vulnerability handling and SBOMs in the EU, the relevant text is the Cyber Resilience Act, which defines a software bill of materials and requires one from manufacturers.
What are the key dates?
Article 50 sets them. The Act applies from 12 September 2025. The Article 3(1) design obligation applies to connected products and related services placed on the market after 12 September 2026. Chapter IV, on unfair contractual terms between enterprises, applies to contracts concluded after 12 September 2025, and from 12 September 2027 to certain older contracts that are of indefinite duration or due to expire at least ten years from 11 January 2024. The switching rules sit in Chapter VI and follow the general application date.
Where does your component list help?
Article 3(1) says connected products must be designed so that product data and related metadata are, by default, easily, securely, free of charge, in a structured, commonly used and machine-readable format, and where relevant and technically feasible directly accessible to the user. Article 3(2) requires pre-contract information to the user, including the type, format and estimated volume of data the product can generate, and whether it generates data continuously and in real time.
To answer that honestly, you need to know which software components collect or emit data. A component inventory tied to a data map tells you whether the telemetry library in your firmware, the analytics SDK in your companion app and the cloud service behind them each produce data, in which format, and where it goes.
What about security?
The Act keeps security in view. Article 4(2) lets users and data holders contractually restrict or prohibit access, use or sharing if it could undermine security requirements laid down by law, resulting in serious adverse effect on health, safety or security of natural persons, and a data holder that refuses on that basis must notify the competent authority. Third parties receiving data must not use it in a way that adversely impacts the security of the product or service.
For cloud and edge providers, switching terms must include an obligation to ensure a high level of security throughout the switching process, including data security during transfer and the continued security of data during the retrieval period.
Constructed example
A maker of connected heat pumps ships firmware with an open-source networking stack, a metrics agent and a companion mobile app. The team already keeps a bill of materials per release for vulnerability management. For the Data Act, they add two columns: which components produce user-relevant data, and the export format. The pre-sale data disclosure and the user access feature are generated from that table instead of written from memory.
What to do
- Inventory every product and service that generates data about a user, device or environment.
- Attach a component list to each, from your build, including third-party SDKs.
- For each data type, record format, volume, frequency and where it is stored and sent.
- Draft the Article 3(2) pre-contract information from that record.
- Design a secure way for users to access data, with authentication and logging.
- Decide how security-based restrictions would be decided and documented.
- If you provide cloud or edge services, review switching clauses and security during export.
- Keep an SBOM anyway, because the Cyber Resilience Act and customers will ask for it.
Safeguard can generate and analyse dependency inventories for your repositories, which gives you the component side of this record. It does not assess Data Act compliance.
Quick check
Does the Data Act require an SBOM?
No. It has no SBOM requirement. The Cyber Resilience Act defines and requires one for manufacturers, so the two laws work together.
When does the design obligation for connected products start?
Article 3(1) applies to connected products and related services placed on the market after 12 September 2026.
Sources
- Regulation (EU) 2023/2854 (Data Act), EUR-Lex
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
Last reviewed: 18 October 2026.
