EU Data Act, Regulation (EU) 2023/2854

Regulation (EU) 2023/2854 on fair access to and use of data entered into force on 11 January 2024 and amends Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act). It has been applied since 12 September 2025, though some aspects do not apply until September 2026 or September 2027. The legislation aims to facilitate and promote the exchange and use of data, thereby creating an innovative and competitive data market.

Scope

The Data Act covers a wide range of ‘connected products’ and obligations concern ‘product data’ and ‘related service data’. Connected products obtain, generate or collect data concerning their performance, use or environment, and are able to communicate those data. Communication can be via on-device access, wireless connectivity or a physical connection.

Machine Builders

For the benefit of clients that build machines, if a machine stores data relating to its operation and use, and if the machine builder can access that data either remotely or by connecting to the machine locally, then the data must be sharable. There is no obligation to share data that is processed but not stored, such as from sensors and transducers.

Machine builders can continue to offer services such as remote condition monitoring but the underlying data must be sharable with the machine user and third parties.

Standardisation

The Data Act contains essential requirements relating to the form of the data and its usability. Data must be accessible to users easily, securely, free of charge, and in a comprehensive, structured, commonly used and machine-readable format.

Compliance with harmonised standards provides a presumption of conformity. In the absence of harmonised standards, ‘common specifications’ can provide a presumption of conformity. At the time of writing (June 2026), no harmonised standards or common specifications have been published, so other means must be used to demonstrate how the essential requirements have been met.

Contracts

When a product is placed on the market, information about sharable data must be provided before a contract is concluded. A contract must cover the basis for a manufacturer’s use of product data, and the terms can exclude or limit the user from accessing all or some data.

Suppliers cannot impose unfair contractual terms on customers. The EC has published non-binding model contractual terms, or voluntary agreements for exchanging data can be made.

Compensation

If a data holder (eg machine builder) is asked to make data available to a third party, then the data holder can require the third party to pay reasonable compensation for the cost of providing the data, but not for the data. If disputes arise over what is ‘reasonable’ compensation, the Data Act sets out arrangements for resolving these.

Initially, data processing service providers can charge users for switching providers, but these charges will be abolished after three years.

Authorities

Public sector bodies, the Commission, the European Central Bank and Union bodies can demand data from data holders when there is an exceptional need. Data holders are entitled to compensation, while micro and small businesses are exempt from the requirement to share data with authorities.

Legal representation

Data holders based outside the EU must designate a legal representative in one Member State. Legal representatives essentially act on behalf of an entity to co-operate with the authorities and, upon request, demonstrate how connected products and related services comply with the Data Act.