Data Act Implementation Act: What German IoT Manufacturers Must Implement by September 2026

7 min read

On March 26, the Bundestag passed the Data Act Implementation Act, effectively activating the EU Data Act in Germany. German IoT manufacturers now have five months to adapt their products to “Access by Design” requirements. The Federal Network Agency (Bundesnetzagentur) will serve as the enforcement authority, with fines reaching up to €500,000. Small and medium-sized enterprises with fewer than 50 employees benefit from a key exemption-everyone else does not.

Key Takeaways

What the Implementation Act Has Regulated Since March 26

The EU Data Act has been applicable across Europe since September 12, 2025. The regulation determines who may access data generated by connected products and related services-from a milking robot in the Allgäu region and an office building elevator to a SaaS platform for fleet management. What the European framework previously left unaddressed were national implementation rules: which authority is responsible, how violations are penalized, and who funds enforcement.

That’s exactly what the German Bundestag finalized on March 26, 2026, during calendar week 13. The Data Act Implementation Act designates the Federal Network Agency (Bundesnetzagentur, or BNetzA) as the competent supervisory authority and establishes the legal basis for investigations, information requests, interim orders, and administrative fines. At the same time, the law resolves the long-standing dispute between the federal government and Germany’s states (Länder): BNetzA oversees data requests directed at federal authorities, while the Länder retain responsibility for their own institutions-a concession to Germany’s federal structure that shaped parliamentary debates.

During parliamentary hearings, critics highlighted the law’s reliance on numerous vague legal terms. It employs phrases like reasonable conditions, without undue delay, and immediately, which will only gain concrete meaning through BNetzA’s enforcement practice and future guidance documents. For businesses, this creates legal uncertainty in the initial months-but also flexibility, as the agency plans to steer compliance primarily through guidelines rather than immediate sanctions.

Who’s affected-and who qualifies for the SME exemption

The Data Act simultaneously targets two groups of businesses: manufacturers of connected products and providers of related services on one side, and cloud service providers on the other. For German-speaking SMEs (DACH region), this means virtually every machinery manufacturer equipping its equipment with telemetry capabilities is considered a product manufacturer under the regulation. Likewise, any SaaS provider processing customer data qualifies as a data-processing service provider.

Crucially, the regulation’s scope applies only to products first placed on the market after 12 September 2026. Machines already sold are exempt from the “access-by-design” requirement-a key detail that eases retrofitting obligations. However, manufacturers must still adapt existing product lines by the next hardware generation at the latest, allowing sufficient lead time for certifications, software updates, and contract adjustments.

The most significant relief for SMEs is the small and medium-sized enterprise (SME) exemption under Article 7 of the EU regulation. Companies with fewer than 50 employees and annual revenue below €10 million are exempt from data access obligations. According to German Chambers of Commerce (IHK) statistics, this covers more than 90% of Germany’s mid-sized machinery manufacturers. However, timing matters: if a company exceeds these thresholds in a given fiscal year, it must comply with the obligations in subsequent years-a planning risk for scaling businesses.

No such exemption exists for cloud-switching rules, which apply to all data-processing service providers regardless of company size. Thus, a mid-sized SaaS company with 30 employees must enable customers to switch providers without flat-rate egress fees-even if it’s exempt from IoT product requirements. This distinction is critical when conducting a gap analysis across your own product portfolio.

The Three Obligation Blocks: Access, Switching, and Government Access

The Data Act consolidates three distinct sets of obligations that must be handled separately from an organizational standpoint. The first block concerns user access to data. Manufacturers of connected products must ensure that the buyer of a machine or the user of software receives direct access to the product and service data generated by it. This access must be fast, secure, and typically provided at no additional cost. These “access-by-design” requirements do not yet apply to products placed on the market before September 12, 2026-but manufacturers should use the transition period to retrofit existing products and prepare software update pathways.

The second block addresses cloud switching. As of September 12, 2025, providers of data processing services-including traditional public cloud providers as well as industry-specific SaaS vendors-may no longer impose artificial barriers that hinder customer switching. Contracts must clearly specify term durations, notice periods, and data egress terms. Starting January 12, 2027, providers will be prohibited from charging flat-rate egress fees; only costs demonstrably tied to the actual data migration process will be permitted. For hyperscalers, this represents a sharp break from established pricing models; for customers, it offers significant leverage in contract negotiations.

The third block governs public authorities’ access to data in exceptional circumstances. In clearly defined emergencies-such as natural disasters, pandemics, or major cyber incidents-government agencies may directly request corporate data if needed for crisis response. While the conditions are narrowly defined, companies must be technically prepared to respond to such requests at all. Germany’s implementing legislation specifies which authorities are authorized to issue these requests and outlines the role of the Bundesnetzagentur (Federal Network Agency) as the oversight body.

Timeline: What applies when

Sources: EU Regulation 2023/2854, German Bundestag Week 13/2026, BMWK

The pivotal date on the calendar is September 12, 2026. On this day, the “Access by Design” obligation takes effect for all products first placed on the market thereafter. Manufacturers planning to launch new product generations in autumn 2026 must already have finalized their data interface architecture, drafted API documentation, and cleared access concepts with legal teams. Anyone waiting until August will be too late.

The Role of the Federal Network Agency

With the implementation act, Germany’s Federal Network Agency (Bundesnetzagentur or BNetzA) assumes a new regulatory role in a field that until now has been fragmented across data protection, competition law, and digital policy. It becomes the central point of contact for complaints, information requests, and interpretive questions. The agency may launch investigations, compel companies to provide information, issue interim orders, and impose coercive fines when necessary.

Source: German Bundestag, Plenary Session Week 13/2026

At €500,000 per violation, Germany’s penalty is modest by international standards-the GDPR allows fines up to €20 million, and the Digital Markets Act permits penalties of up to 10% of global turnover. Yet for a mid-sized machinery manufacturer with annual revenue of €25 million, a six-figure fine is a significant deterrent-especially if multiple violations are identified simultaneously. More important than the absolute amount is the signal it sends: BNetzA is an operational authority with 3,200 staff and extensive enforcement experience-from telecom regulation and energy market oversight to postal services. It will not let the Data Act fade into irrelevance.

What SMEs can expect next are initial guidelines and consultations from the Federal Network Agency-typically released in early summer 2026. These guidelines will clarify ambiguous legal terms, provide model clauses for cloud contracts, and offer guidance on distinguishing between SME exemptions and standard obligations. Companies with the capacity to actively engage in these consultations can help shape interpretations in their favor-industry associations like VDMA and Bitkom are already preparing position papers accordingly.

Six-Point Plan for SMEs

For small and medium-sized enterprises (SMEs), a structured approach across six clear steps-achievable within the next five months-is strongly recommended:

1. Clarify scope: Which of your company’s products and services fall under the Data Act? Who is the manufacturer, who is the cloud provider, and who serves both roles? Without precise categorization, every subsequent measure will be fragmented and ineffective.
2. Check SME exemption: Compare headcount and revenue from the last fiscal year. Even within holding structures, the group-wide view applies-individual subsidiaries may exceed the threshold if the parent company does.
3. Inventory data architecture: What data do your connected products actually generate? Where is it stored, who has access, and what interfaces already exist? This inventory forms the foundation for implementing “access-by-design.”
4. Develop an API roadmap: Starting September 2026, new products must include a documented access interface-typically REST or MQTT with OAuth authentication. For existing products, decide on a retrofit strategy: update them or deploy without access-by-design capabilities.
5. Revise cloud contracts: Review current data processing service agreements for switching clauses. If they include flat-rate egress fees, adjustments must be made by 12 January 2027. New contracts should be drafted to comply with the Data Act-model clauses are expected in autumn 2026.
6. Appoint a contact person: The implementing legislation requires an internal point of contact for user inquiries and regulatory requests. Functionally, the data protection officer is a natural fit, but product management and IT teams must also be closely aligned.

Companies that complete these six steps by the end of June can enter September with confidence. Those who only wake up in August will have to rely on guidance notes from Germany’s Federal Network Agency (BNetzA) and bridging workshops offered by industry associations-possible, but unnecessarily stressful.

Context: The Data Act in the 2026 Regulatory Mix

The Data Act is part of a broader package of EU regulations that will keep SMEs busy in 2026. The NIS2 Directive implementation addresses cybersecurity in critical sectors, the EU AI Act governs the use of AI systems-with a focus on high-risk applications-and the mandatory e-invoicing requirement is transforming accounting practices. Meanwhile, the digital euro raises additional questions for payment processes. The Data Act slots in as the fourth major regulatory pillar and overlaps with all the others at various points: with NIS2 on reporting and protection obligations for connected systems, with the AI Act on handling training data, and with e-invoicing on data formats.

For SMEs, this means compliance initiatives can’t be tackled in isolation. Companies already transitioning their IT infrastructure to external providers as part of a managed services decision should incorporate Data Act requirements directly into vendor selection. Those implementing a new ERP system should design API interfaces to inherently fulfill the “access-by-design” obligation. The key is to bundle regulatory projects rather than run them in parallel-this reduces costs and eases the burden on already scarce IT resources.

Conclusion

The Data Act Implementation Act closes a critical gap in Germany’s digital regulatory framework. The Federal Network Agency (BNetzA) becomes the supervisory authority. The penalty framework is manageable yet substantial. The SME exemption relieves at least 90% of mid-sized IoT manufacturers from data access obligations. What remains is the cloud-switching provision-and it applies to every data processing provider, even those below the revenue threshold.

The deadline of 12 September 2026 may seem distant, but it isn’t. Architectural decisions for API interfaces, software updates, contract templates, and internal responsibilities all require lead time. Those who start today have five months; those who begin in August will have just four weeks and no buffer for unexpected issues. The right time for a scope analysis is now-not when the first BNetzA guidelines are published.

Frequently Asked Questions

Source cover image: Pexels / Marco