EU Data Act Explained: Access-by-Design Rules From September 2026

Connected devices generate vast amounts of data every day. Smart vehicles collect performance information, industrial machines record operational metrics, and smart appliances generate usage data. However, manufacturers and service providers have traditionally controlled much of this information, making it difficult for users to access or share data with alternative service providers.

The European Union (EU) introduced the EU Data Act to address this challenge by establishing rules for fair access to and use of data. The regulation gives consumers and businesses greater control over data generated by connected products and creates opportunities for competition, innovation, and new data-driven services. The Act has applied since 12 September 2025, while a specific access-by-design requirement for connected products and related services placed on the market after 12 September 2026 introduces an important new compliance milestone.

Organizations must therefore look beyond written policies and consider how they design, develop, and deliver connected products.

Understanding the access-by-design requirement can help manufacturers, product teams, and compliance professionals prepare for their responsibilities under the regulation.

What is the EU Data Act?

The EU Data Act, formally known as Regulation (EU) 2023/2854, establishes harmonized rules for accessing, sharing, and using data across the European Union. It aims to create a fairer data economy by giving users more control over data generated through connected products and related services.

The regulation covers several areas, including:

• Connected product data: Gives users rights to access data generated through their use of connected products and related services.
• Business-to-business data sharing: Establishes rules for sharing data when the law requires a business to provide it to another business.
• Cloud switching: Requires data-processing service providers to facilitate switching between providers and support interoperability.
• Fair contractual terms: Protects businesses, particularly small and medium-sized enterprises (SMEs), against certain unfair data-sharing contract terms.
• Public-sector access: Allows public bodies to request certain private-sector data when exceptional needs arise, subject to the regulation’s conditions.
• Data protection and security: Establishes safeguards for data sharing and certain transfers or access requests involving non-EU government bodies.

The Data Act complements existing data protection legislation, including the General Data Protection Regulation (GDPR). It does not replace GDPR requirements or automatically authorize businesses to disclose personal data without a valid legal basis.

What is the Access-by-Design Requirement?

Access-by-design is a requirement under Article 3(1) of the EU Data Act. It requires manufacturers of connected products and providers of related services to design and provide products and services so that relevant product data and related service data, together with the metadata needed to interpret them, are accessible to users by default.

The access-by-design requirement covers connected products and related services introduced to the market after 12 September 2026.

Rather than treating data access as an optional feature or a request that requires extensive manual intervention, organizations must consider data accessibility during product development and service design.

For example, a manufacturer developing a connected industrial machine should consider how its customer can access the machine’s operational data. The manufacturer should design an appropriate access mechanism rather than relying solely on an internal dashboard or a support team to retrieve the information manually.

The exact implementation will depend on the product, the data involved, and the technical circumstances. However, organizations should evaluate data access early in the design process instead of addressing it only after launch.

Key Access-by-Design Rules Effective From September 2026

• Provide Access to Relevant Product Data by Default

Manufacturers must design covered connected products so users can access relevant data by default. This requirement applies to product data and related service data within the regulation’s scope, along with the metadata needed to understand that information.

Organizations should identify what data their products generate, where they store it, and how users can retrieve it. They should also document the technical methods that enable access.

For example, a connected vehicle may generate information about its performance, energy consumption, or component status. An appropriate design can help the user retrieve relevant data and share it with an eligible maintenance provider, subject to applicable legal and technical conditions.

• Make Data Accessible Securely and Free of Charge

The Data Act requires organizations to provide users with secure, easy access to covered data at no cost, in a structured, commonly used, machine-readable format. It also requires direct access where applicable and technically feasible.

These requirements help users retrieve and reuse data without unnecessary technical barriers.

Organizations should evaluate whether their products support appropriate access controls, secure authentication, reliable data retrieval, and usable export mechanisms. They should also consider whether the available formats allow users or authorized third parties to process the data effectively.

A secure design must balance accessibility with confidentiality, integrity, and personal data protection. Access-by-design does not mean unrestricted access for everyone.

• Design for Interoperability and Data Portability

Data becomes more useful when users can transfer it between compatible systems and service providers. The Data Act supports this objective by setting rules that improve data availability and make it easier to switch between data-processing services.

Organizations should assess whether their data formats, interfaces, and export mechanisms create unnecessary dependencies on a single provider.

For example, a business using connected manufacturing equipment may want to analyze operational data through an independent analytics service. A well-designed data access mechanism can make this process easier, provided the requested data and proposed use fall within the applicable rules.

• Consider Access Requirements During Product Development

Organizations should integrate data access into their product development lifecycle. Waiting until a product reaches the market may increase remediation costs and create avoidable compliance challenges.

Product managers, software developers, architects, security teams, and legal professionals should work together to identify relevant data, define user access requirements, and evaluate the necessary technical safeguards.

Teams should also assess third-party components and related services that influence how products generate, store, or expose data. Contracts and technical specifications may need to support the manufacturer’s ability to meet its obligations.

• Maintain Appropriate Security and Privacy Controls

The Data Act promotes greater data access, but organizations must still protect sensitive information and comply with applicable legal requirements.

Teams should implement controls such as authentication, authorization, encryption where appropriate, access logging, and monitoring. They should also determine whether a data request involves personal data and establish the necessary legal basis before disclosing it.

Organizations must distinguish between granting a user access to data under the Data Act and sharing that data with another party. The latter may require additional conditions, including a valid legal basis under data protection law.

Who Must Prepare for the September 2026 Deadline?

The access-by-design requirement primarily affects manufacturers of connected products and providers of related services within the scope of the regulation. Other organizations may also face obligations under different provisions of the Data Act.

• Manufacturers: Review product architecture, data collection practices, and access mechanisms.
• Software and service providers: Evaluate how related services generate and expose relevant data.
• Product managers and engineers: Incorporate access requirements into design specifications, development, and testing.
• Security architects: Build secure access mechanisms that protect data while enabling authorized use.
• Legal and compliance teams: Assess the regulation’s scope, contractual obligations, and interactions with GDPR.
• Procurement and vendor-management teams: Review supplier contracts and dependencies that could affect data access.

Organizations should determine whether each product or service falls within the regulation’s scope rather than assuming that every digital product faces identical obligations.

How Can Organizations Prepare for EU Data Act Compliance?

• Step 1: Identify Covered Products and Services

Create an inventory of connected products and related services that the organization manufactures, develops, or provides. Identify which products fall within the scope of the access-by-design requirement and determine when they were or will be placed on the market.

• Step 2: Map Data Flows

Document the data each product generates, where it resides, how it moves between systems, and which parties control or process it. Identify relevant metadata and determine whether users can retrieve the information.

• Step 3: Assess Existing Access Mechanisms

Review product interfaces, APIs, dashboards, download options, and support procedures. Determine whether users can access covered data easily, securely, and in the required format without charge.

• Step 4: Identify Technical and Contractual Gaps

Compare existing product designs and supplier arrangements with the applicable requirements. Identify barriers such as proprietary formats, restricted interfaces, unnecessary manual approvals, or third-party dependencies.

• Step 5: Implement Security and Privacy Safeguards

Define access permissions, authentication procedures, monitoring controls, and data protection measures. Confirm that the organization can provide appropriate access without disclosing data unlawfully or exposing unrelated users’ information.

• Step 6: Test and Document Compliance

Test the access mechanisms before placing covered products on the market. Verify that authorized users can retrieve relevant data and that the system handles access requests securely and reliably. Maintain documentation of design decisions, test results, identified risks, and corrective actions.

What Happens if Organizations Overlook the Requirements?

Organizations that fail to meet applicable Data Act obligations may face regulatory scrutiny, enforcement measures, and potential penalties under the relevant national enforcement framework.

Non-compliance can also create business risks. Users may struggle to obtain their data, service providers may struggle to offer competing services, and organizations may need to redesign products after launch.

Organizations should therefore treat the September 2026 milestone as a product-design and compliance issue, not merely a legal documentation exercise. Early preparation can help reduce rework, improve transparency, and support more flexible data-sharing arrangements.

Conclusion

The EU Data Act’s Access-by-Design mandate marks a major transition toward open, interoperable industrial and consumer IoT environments. By requiring manufacturers to build direct, zero-cost data export paths into hardware and software from the ground up, the EU is unlocking new aftermarket competition and giving users full ownership of their operational data. Organizations that integrate these data-sharing architectures early will avoid costly retrofits and gain a competitive edge in European markets.

Master data governance regulations and hands-on compliance frameworks: InfosecTrain’s DPO Hands-on Training features expert-led live instruction, practical case studies, and real-world exercises covering DPIAs, ROPA, and privacy-by-design implementations.

TRAINING CALENDAR of Upcoming Batches For DPO Training