7 min read<\/p>\n
On March 26, the Bundestag passed the Data Act Implementation Act, effectively activating the EU Data Act in Germany. German IoT manufacturers now have five months to adapt their products to \u201cAccess by Design\u201d requirements. The Federal Network Agency (Bundesnetzagentur) will serve as the enforcement authority, with fines reaching up to \u20ac500,000. Small and medium-sized enterprises with fewer than 50 employees benefit from a key exemption-everyone else does not.<\/strong><\/p>\n The EU Data Act has been applicable across Europe since September 12, 2025. The regulation determines who may access data generated by connected products and related services-from a milking robot in the Allg\u00e4u region and an office building elevator to a SaaS platform for fleet management. What the European framework previously left unaddressed were national implementation rules: which authority is responsible, how violations are penalized, and who funds enforcement.<\/p>\n That\u2019s exactly what the German Bundestag finalized on March 26, 2026, during calendar week 13. The Data Act Implementation Act designates the Federal Network Agency (Bundesnetzagentur, or BNetzA) as the competent supervisory authority and establishes the legal basis for investigations, information requests, interim orders, and administrative fines. At the same time, the law resolves the long-standing dispute between the federal government and Germany\u2019s states (L\u00e4nder): BNetzA oversees data requests directed at federal authorities, while the L\u00e4nder retain responsibility for their own institutions-a concession to Germany\u2019s federal structure that shaped parliamentary debates.<\/p>\n During parliamentary hearings, critics highlighted the law\u2019s reliance on numerous vague legal terms. It employs phrases like reasonable conditions<\/em>, without undue delay<\/em>, and immediately<\/em>, which will only gain concrete meaning through BNetzA\u2019s enforcement practice and future guidance documents. For businesses, this creates legal uncertainty in the initial months-but also flexibility, as the agency plans to steer compliance primarily through guidelines rather than immediate sanctions.<\/p>\n Definition<\/p>\n Access by Design<\/strong> refers to the technical obligation to build connected products in such a way that users-or third parties they authorize-can access the data generated without requiring additional development effort. Access must be simple, secure, structured, and provided in a machine-readable format, typically via a documented API.<\/p>\n<\/div>\n The Data Act simultaneously targets two groups of businesses: manufacturers of connected products and providers of related services on one side, and cloud service providers on the other. For German-speaking SMEs (DACH region), this means virtually every machinery manufacturer equipping its equipment with telemetry capabilities is considered a product manufacturer under the regulation. Likewise, any SaaS provider processing customer data qualifies as a data-processing service provider.<\/p>\n Crucially, the regulation\u2019s scope applies only to products first placed on the market after 12 September 2026. Machines already sold are exempt from the \u201caccess-by-design\u201d requirement-a key detail that eases retrofitting obligations. However, manufacturers must still adapt existing product lines by the next hardware generation at the latest, allowing sufficient lead time for certifications, software updates, and contract adjustments.<\/p>\n The most significant relief for SMEs is the small and medium-sized enterprise (SME) exemption under Article 7 of the EU regulation. Companies with fewer than 50 employees and annual revenue below \u20ac10 million are exempt from data access obligations. According to German Chambers of Commerce (IHK) statistics, this covers more than 90% of Germany\u2019s mid-sized machinery manufacturers. However, timing matters: if a company exceeds these thresholds in a given fiscal year, it must comply with the obligations in subsequent years-a planning risk for scaling businesses.<\/p>\n No such exemption exists for cloud-switching rules, which apply to all data-processing service providers regardless of company size. Thus, a mid-sized SaaS company with 30 employees must enable customers to switch providers without flat-rate egress fees-even if it\u2019s exempt from IoT product requirements. This distinction is critical when conducting a gap analysis across your own product portfolio.<\/p>\n The Data Act consolidates three distinct sets of obligations that must be handled separately from an organizational standpoint. The first block concerns user access to data. Manufacturers of connected products must ensure that the buyer of a machine or the user of software receives direct access to the product and service data generated by it. This access must be fast, secure, and typically provided at no additional cost. These \u201caccess-by-design\u201d requirements do not yet apply to products placed on the market before September 12, 2026-but manufacturers should use the transition period to retrofit existing products and prepare software update pathways.<\/p>\n The second block addresses cloud switching. As of September 12, 2025, providers of data processing services-including traditional public cloud providers as well as industry-specific SaaS vendors-may no longer impose artificial barriers that hinder customer switching. Contracts must clearly specify term durations, notice periods, and data egress terms. Starting January 12, 2027, providers will be prohibited from charging flat-rate egress fees; only costs demonstrably tied to the actual data migration process will be permitted. For hyperscalers, this represents a sharp break from established pricing models; for customers, it offers significant leverage in contract negotiations.<\/p>\n The third block governs public authorities\u2019 access to data in exceptional circumstances. In clearly defined emergencies-such as natural disasters, pandemics, or major cyber incidents-government agencies may directly request corporate data if needed for crisis response. While the conditions are narrowly defined, companies must be technically prepared to respond to such requests at all. Germany\u2019s implementing legislation specifies which authorities are authorized to issue these requests and outlines the role of the Bundesnetzagentur (Federal Network Agency) as the oversight body.<\/p>\n Sources: EU Regulation 2023\/2854, German Bundestag Week 13\/2026, BMWK<\/p>\n The pivotal date on the calendar is September 12, 2026. On this day, the \u201cAccess by Design\u201d obligation takes effect for all products first placed on the market thereafter. Manufacturers planning to launch new product generations in autumn 2026 must already have finalized their data interface architecture, drafted API documentation, and cleared access concepts with legal teams. Anyone waiting until August will be too late.<\/p>\n With the implementation act, Germany\u2019s Federal Network Agency (Bundesnetzagentur or BNetzA) assumes a new regulatory role in a field that until now has been fragmented across data protection, competition law, and digital policy. It becomes the central point of contact for complaints, information requests, and interpretive questions. The agency may launch investigations, compel companies to provide information, issue interim orders, and impose coercive fines when necessary.<\/p>\n Source: German Bundestag, Plenary Session Week 13\/2026<\/p>\n At \u20ac500,000 per violation, Germany\u2019s penalty is modest by international standards-the GDPR allows fines up to \u20ac20 million, and the Digital Markets Act permits penalties of up to 10% of global turnover. Yet for a mid-sized machinery manufacturer with annual revenue of \u20ac25 million, a six-figure fine is a significant deterrent-especially if multiple violations are identified simultaneously. More important than the absolute amount is the signal it sends: BNetzA is an operational authority with 3,200 staff and extensive enforcement experience-from telecom regulation and energy market oversight to postal services. It will not let the Data Act fade into irrelevance.<\/p>\n What SMEs can expect next are initial guidelines and consultations from the Federal Network Agency-typically released in early summer 2026. These guidelines will clarify ambiguous legal terms, provide model clauses for cloud contracts, and offer guidance on distinguishing between SME exemptions and standard obligations. Companies with the capacity to actively engage in these consultations can help shape interpretations in their favor-industry associations like VDMA and Bitkom are already preparing position papers accordingly.<\/p>\n For small and medium-sized enterprises (SMEs), a structured approach across six clear steps-achievable within the next five months-is strongly recommended:<\/p>\n Companies that complete these six steps by the end of June can enter September with confidence. Those who only wake up in August will have to rely on guidance notes from Germany\u2019s Federal Network Agency (BNetzA) and bridging workshops offered by industry associations-possible, but unnecessarily stressful.<\/p>\n The Data Act is part of a broader package of EU regulations that will keep SMEs busy in 2026. The NIS2 Directive implementation<\/a> addresses cybersecurity in critical sectors, the EU AI Act<\/a> governs the use of AI systems-with a focus on high-risk applications-and the mandatory e-invoicing requirement<\/a> is transforming accounting practices. Meanwhile, the digital euro<\/a> raises additional questions for payment processes. The Data Act slots in as the fourth major regulatory pillar and overlaps with all the others at various points: with NIS2 on reporting and protection obligations for connected systems, with the AI Act on handling training data, and with e-invoicing on data formats.<\/p>\n For SMEs, this means compliance initiatives can\u2019t be tackled in isolation. Companies already transitioning their IT infrastructure to external providers as part of a managed services decision<\/a> should incorporate Data Act requirements directly into vendor selection. Those implementing a new ERP system should design API interfaces to inherently fulfill the \u201caccess-by-design\u201d obligation. The key is to bundle regulatory projects rather than run them in parallel-this reduces costs and eases the burden on already scarce IT resources.<\/p>\n The Data Act Implementation Act closes a critical gap in Germany\u2019s digital regulatory framework. The Federal Network Agency (BNetzA) becomes the supervisory authority. The penalty framework is manageable yet substantial. The SME exemption relieves at least 90% of mid-sized IoT manufacturers from data access obligations. What remains is the cloud-switching provision-and it applies to every data processing provider, even those below the revenue threshold.<\/p>\n The deadline of 12 September 2026 may seem distant, but it isn\u2019t. Architectural decisions for API interfaces, software updates, contract templates, and internal responsibilities all require lead time. Those who start today have five months; those who begin in August will have just four weeks and no buffer for unexpected issues. The right time for a scope analysis is now-not when the first BNetzA guidelines are published.<\/p>\nKey Takeaways<\/h2>\n
\n
What the Implementation Act Has Regulated Since March 26<\/h2>\n
Who\u2019s affected-and who qualifies for the SME exemption<\/h2>\n
The Three Obligation Blocks: Access, Switching, and Government Access<\/h2>\n
Timeline: What applies when<\/h2>\n
\n\n
\n \nDeadline<\/th>\n Requirement<\/th>\n Who is affected<\/th>\n<\/tr>\n<\/thead>\n \n September 12, 2025<\/td>\n Cloud switching, contractual clauses, government access<\/td>\n All data processing service providers<\/td>\n<\/tr>\n \n March 26, 2026<\/td>\n German implementing act adopted; BNetzA appointed as enforcement authority<\/td>\n All companies operating in Germany<\/td>\n<\/tr>\n \n September 12, 2026<\/td>\n \u201cAccess by Design\u201d for new connected products<\/td>\n IoT product manufacturers (excluding SMEs)<\/td>\n<\/tr>\n \n January 12, 2027<\/td>\n No more blanket egress fees<\/td>\n All cloud service providers<\/td>\n<\/tr>\n \n 2028<\/td>\n European Commission evaluates impact on SMEs<\/td>\n SME exemption under review<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n The Role of the Federal Network Agency<\/h2>\n
Six-Point Plan for SMEs<\/h2>\n
\n
Context: The Data Act in the 2026 Regulatory Mix<\/h2>\n
Conclusion<\/h2>\n