Data Act: Buyers Can Request Machine Data for Free
6 min read
Many planners have scheduled the Data Act for 12 September 2026. Regulation (EU) 2023/2854 has applied since 12 September 2025. Buyers of connected machines may request readily available product data free of charge.
Key takeaways
- The Data Act has applied since 12 September 2025. Only the design obligation for devices newly placed on the market begins on 12 September 2026.
- Buyers may request machine data free of charge. The data holder must supply readily available data electronically.
- Micro and small enterprises remain exempt from Chapter II. Medium-sized manufacturers above this threshold must provide data.
- The Bundesnetzagentur (Federal Network Agency) accepts complaints. The Commission’s Digital Omnibus remains a proposal.
Related:Data Act Implementation Act: What German IoT Manufacturers Must Implement by September 2026 / Digital Product Passport: What Manufacturers Must Do
What is the Data Act? Regulation (EU) 2023/2854 defines who may access data from connected products. It has applied directly in every member state since 12 September 2025. The design obligation for devices newly placed on the market begins on 12 September 2026.
Calendars Set the Data Act a Year Too Late
Trade calendars often list 12 September 2026 as the start of the Data Act. Article 50 of Regulation (EU) 2023/2854 sets the start of application a year earlier.
The European Commission dates entry into force to 11 January 2024. Applicability began on 12 September 2025. Anyone who waited a year for the later deadline has left a valid access right unused.
The costly mistake is confusing the start of application with the design obligation. The design obligation under Article 3(1) applies only to connected products placed on the market after 12 September 2026. The existing fleet does not fall under this paragraph.
| Obligation | Applies from | Applies to |
|---|---|---|
| Regulation as a whole | 12 September 2025 | all data holders in scope in the EU |
| Access on request (Article 4) | 12 September 2025 | readily available data, including the existing fleet |
| Access by design (Article 3(1)) | after 12 September 2026 | products newly placed on the market |
| Switching charges end | 12 January 2027 | data processing services |
Source: Regulation (EU) 2023/2854 Article 50 and Article 3(1), plus Factsheet 1 from the Bundesnetzagentur.
New Devices Must Open Data by Default
Article 3(1) requires that new connected products be designed and manufactured so that product data and related service data are accessible by default. This also applies to related services. The data, including the relevant metadata, must be available to the user easily, securely and free of charge in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, be directly accessible.
Before purchase, rental or leasing, the seller, rental provider or lessor must clearly inform the user. This includes the type, format and estimated volume of the product data, real-time capability, storage location and retention period, and the means of access. The manufacturer can take on this role itself.
This information obligation applies before the contract is concluded, before the machine reaches the shop floor. Anyone placing a new device on the market after 12 September 2026 must build access into the design. A portal added afterwards does not satisfy Article 3(1).
The Existing Fleet Delivers on Request
Where the user cannot access the data directly from the product, the data holder must provide readily available data. Article 4(1) requires this without undue delay, easily, securely, free of charge and in machine-readable form. Where relevant and technically feasible, the data must be of the same quality the data holder itself holds. This applies continuously and in real time.
The request may be made electronically, where technically feasible. This obligation has applied since 12 September 2025. It also covers older connected products, provided the data are readily available.
At the request of the user or a party acting on the user’s behalf, the data holder makes the same data available to a third party. Article 5(1) specifies the same speed and the same quality, free of charge for the user. This is how an independent workshop or service provider can obtain the performance data the manufacturer already has.
Raw data and pre-processed data, plus metadata the data holder holds without disproportionate effort, fall within scope. Derived and heavily enriched data fall outside, as does content such as a film on a smart TV. Personal data remain governed by the GDPR (General Data Protection Regulation).
The Same Company Buys and Sells Machines
The Bundesnetzagentur describes this dual role explicitly. A company can be the data holder of its own devices while also acting as the user of third-party machines in its own facility. The user within the meaning of the regulation is the buyer, renter or lessee.
Connected products include machines used in industry and agriculture, robots, wind turbines and vehicles. Related services are software that influences the function of the device. Pure read-out services with no influence on the function do not fall under this, according to the agency.
The first email often decides which role the company plays in the matter. Whoever requests data acts as the user. Whoever answers the email acts as the data holder. The regulation recognises both roles side by side.
Small Businesses Remain Exempt
Chapter II does not apply to data from products that a micro enterprise or small enterprise manufactures or designs. The exemption applies only if the company has no partner or linked enterprise that is not itself small. It also does not apply if the small company manufactures as a subcontractor for a larger company.
A company that has qualified as a medium-sized enterprise for less than a year is likewise relieved for one year after placing its connected products on the market. Medium-sized manufacturers without this grace period must provide data.
Chapter IV on unfair contract terms applies to contracts concluded after 12 September 2025. For older contracts, the chapter applies from 12 September 2027 if they run indefinitely or their term ends no earlier than ten years after 11 January 2024. Anyone holding legacy contracts with data clauses needs a separate calendar for them.
The Bundesnetzagentur Handles Complaints
Under Article 37(1), the Bundesnetzagentur is the competent authority for application and enforcement. The legal basis is the Act Implementing Regulation (EU) 2023/2854, promulgated in the Federal Law Gazette 2026 Part I No. 157 on 29 May 2026. The Act was signed on 26 May 2026.
Users can lodge a complaint with the authority about a breach of Chapter II. The Bundesnetzagentur operates a complaint portal for this purpose. Article 3(2)(g) requires that the user be informed of this right before the contract is concluded.
From 12 January 2027, according to the Bundesnetzagentur, no switching charges may be levied for data processing services. The Data Act makes it easier to switch to and use cloud services in parallel. That is a second deadline, independent of the design obligation for machines.
The Commission has published FAQs in version 1.4 dated 22 January 2026, along with model contractual clauses and guidance on vehicle data. There is also a Legal Helpdesk. The Digital Omnibus contains proposals to amend the Data Act and remains a Commission proposal. Anyone waiting for relief from Brussels is waiting for a procedure that does not replace the regulation in force.
Frequently Asked Questions
Does the Data Act only apply to devices sold after 12 September 2026?
The regulation has applied since 12 September 2025. Only the design obligation under Article 3(1) covers products placed on the market after 12 September 2026. The right of access on request under Article 4 also applies to the existing fleet, provided the data are readily available.
Who has to hand over machine data?
The data holder, usually the manufacturer or the provider of the related service. The user is the buyer, renter or lessee. Micro and small enterprises without partner or linked enterprises and without a subcontract for a larger company are exempt from Chapter II.
Where do you file a complaint in Germany?
To the Bundesnetzagentur as the competent authority under the implementation act of 26 May 2026. The agency operates a complaint portal. The Commission’s Digital Omnibus, as a mere proposal, changes nothing about that.
Read more on MyBusinessFuture
MyBusinessFutureManufacturers Report CRA Incidents to ENISA Ahead of the CSIRTMyBusinessFutureNIS-2 Registration: What the Executive Suite Must Do NowMyBusinessFutureBearingPoint: DACH codes with AI, but barely embeds itMore from the MBF Media Network
cloudmagazinKubernetes binds GPU jobs only when all pods fitDigital ChiefsOracle has customers pre-finance AI capacity expansionSecurityTodayAttackers read GitLab files without a loginImage source: AI-generated (September 2026)
