The EU Data Act applies since 12 September 2025. It affects makers of connected products, providers of related services, and providers of cloud and edge services. If you sell any of those into the EU, you must give users access to their data and, if you run a cloud service, make switching providers possible.
Who is in scope?
The European Commission describes four groups of obligations that matter to a software company.
- Makers of connected products and providers of related services, who hold data generated by use. A related service is anything that makes a product behave in a specific way, such as a phone app that adjusts a fridge.
- Any business that must share data with another business under the Act or another EU law.
- Providers of data processing services, meaning cloud and edge services.
- Parties offering data or data services inside common European data spaces.
The Commission also says the Act covers personal and non-personal data, including relevant metadata, that is readily available to the data holder. Inferred or derived data, such as highly enriched data, is out of scope for the user access right.
Which dates matter?
Article 50 of the Regulation sets the dates. The text is available on EUR-Lex.
- 12 September 2025: the Regulation applies.
- 12 September 2026: the design obligation in Article 3(1) applies to connected products and related services placed on the market after that date.
- 12 January 2027: switching charges, including data egress charges, are removed. Until then providers may charge for costs they incur in switching.
- 12 September 2027: Chapter IV on unfair contract terms reaches older contracts that are of indefinite duration or run at least ten years from 11 January 2024.
What does Article 3 require of a product team?
Connected products and related services must be designed so that product data and related service data, with the metadata needed to interpret them, are by default easily and securely accessible to the user, free of charge, in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, access should be direct.
Before a contract is signed, the seller must tell the user the type, format and estimated volume of data, whether it is generated continuously, whether it is stored on the device or on a remote server and for how long, and how the user can access, retrieve or erase it.
What does a cloud provider owe a customer?
Chapter VI requires a written contract that sets out switching rights. Per Article 25 the contract must allow the customer to switch provider or move data to on-premises infrastructure with a maximum notice period of two months and a mandatory transitional period of up to 30 calendar days. If that is technically unfeasible, the provider must say so within 14 working days and propose an alternative that does not exceed seven months. Service continuity and a high level of security must hold throughout. The contract must also list exhaustively the categories of data and digital assets that can be ported.
Article 32 adds that providers must take adequate technical, organisational and legal measures to prevent unlawful third-country government access to non-personal data held in the EU.
What to do
- Decide which role you hold: data holder for a connected product or related service, provider of data processing services, or both.
- Inventory every product and service that generates data from use, and record what data, in what format, stored where and for how long.
- Write the pre-contract information required by Article 3 for each product and service.
- Build or document a way for users to access and export their data in a structured, machine-readable format, with security checks on who is asking.
- If you run a cloud or edge service, rewrite the contract terms to match Article 25 timings, and list portable data categories.
- Plan for the removal of switching and egress charges from 12 January 2027.
- Review your access controls and legal process for government requests on non-personal data held in the EU.
- Name an owner and keep a dated record of what you changed.
For step 2, a software bill of materials plus a data inventory gives you one place to see which components handle exported data. Safeguard's SBOM and dependency scanning can cover the software side, but the legal reading of your role is for your counsel.
Quick check
Does the Data Act apply only to hardware makers?
No. Related services, such as apps that control a product, are covered, and so are cloud and edge providers under the switching rules.
Is the product design duty already in force?
The Regulation applies since 12 September 2025, but the Article 3(1) design duty applies to products and services placed on the market after 12 September 2026. Confirm your own placement dates with counsel.
Sources
- Data Act explained, European Commission, fetched 18 October 2026
- Regulation (EU) 2023/2854, EUR-Lex, fetched 18 October 2026
Last reviewed: 18 October 2026.
