EU Data Act

Applies To

Overview

Regulation (EU) 2023/2854, commonly known as the EU Data Act, entered into force on 11 January 2024 and has applied since 12 September 2025, with some duties phased in later. It forms a central pillar of the European Data Strategy alongside the Data Governance Act. The regulation applies to manufacturers of connected products placed on the EU market, providers of related services, data holders that make data available, and data recipients in the EU. The Data Act aims to unlock the significant economic value of industrial data and data from internet-connected devices (IoT) by ensuring that users of connected products and services can access data generated through their use, and can share that data with third parties of their choosing. The regulation also introduces safeguards against unlawful international data transfers, sets limits on contractual terms in business-to-business (B2B) data sharing arrangements, establishes rules for switching between cloud and edge services (computing done close to where data is produced), and creates a mechanism for public sector bodies to request access to privately held data during emergencies. For AI-related compliance, the Data Act is particularly relevant because the processes used to train large AI models often rely on data generated by connected devices. Obligations around data portability (moving data to another provider), interoperability (systems working together), and third-party sharing directly affect how enterprises structure data lakes (large central data stores) and training datasets.

Key Requirements

• •Data holders must make data generated by connected products or related services available to users upon request, without undue delay and free of charge.
• •Data holders must share data with third parties designated by the user, subject to agreed terms, under FRAND-equivalent conditions.
• •Contracts between data holders and data recipients must not contain terms that are grossly unfair, and default rules apply when parties cannot agree.
• •Public sector bodies and EU institutions may request access to privately held data in cases of public emergency, subject to strict conditions and proportionality requirements.
• •Cloud service providers must enable customers to switch to alternative providers within contractual switching periods, with switching charges capped and eventually eliminated.
• •Technical protection measures must not prevent lawful data access or sharing obligations imposed by the regulation.
• •Providers of data processing services, such as cloud and edge services, must take measures against unlawful international government access to and transfer of non-personal data (Article 32).
• •Interoperability requirements apply to operators of data spaces and data processing services, using harmonised standards to be developed by European standards organisations.
• •Providers of smart contracts used for automated data sharing must implement kill-switch and access-control mechanisms meeting specified technical standards.
• •Enforcement and penalties are set at member-state level; member states must designate competent national authorities and establish effective, proportionate, and dissuasive penalties.

What Your Organization Must Do

• →Map which connected products and related services your business places on the EU market.
• →Build a process to give users their device data without undue delay and free of charge.
• →Review business-to-business data contracts for grossly unfair terms before the 12 September 2027 date.
• →Check cloud and edge contracts for switching periods, and plan for the charge ban from 12 January 2027.
• →Confirm safeguards against unlawful international government access to non-personal data under Article 32.
• →Track national implementing measures and designated authorities in each member state where you operate.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

When does the EU Data Act become enforceable for businesses?

It has applied since 12 September 2025, with staggered dates. Design duties for data access cover connected products placed on the market after 12 September 2026. Unfair-terms rules reach older contracts from 12 September 2027, and cloud switching charges are banned from 12 January 2027.

Does the EU Data Act apply to non-EU companies selling connected products in the EU?

Yes. The regulation applies to manufacturers of connected products placed on the EU market regardless of where the manufacturer is headquartered. Non-EU companies selling IoT hardware or related digital services to EU customers are in scope and must meet the same obligations as EU-based manufacturers.

What are the penalties for non-compliance with the EU Data Act?

Penalty levels are set by individual member states, not fixed at the EU level. Each member state must designate a competent authority and establish penalties that are effective, proportionate, and dissuasive. Companies should monitor national implementing measures in each jurisdiction where they operate to assess their specific penalty exposure.

How does the EU Data Act differ from the Data Governance Act?

The Data Governance Act creates a framework for voluntary data sharing intermediaries and governs reuse of public sector data. The Data Act imposes direct mandatory obligations on private data holders to share data generated by connected products with users and third parties. The two regulations are complementary pillars of the EU Data Strategy but address distinct scenarios.

Does the EU Data Act affect AI model training using IoT-generated data?

Yes, data holders supplying device data must respect user access rights and third-party sharing conditions. Cloud and edge providers hosting that data must also guard against unlawful international government access.

What obligations does the Data Act impose on cloud service providers regarding customer switching?

Cloud providers must allow customers to switch to alternative providers within contractual switching periods, with switching charges capped and phased out entirely over time. Providers must also ensure their services meet interoperability requirements to facilitate migration, and must not use technical or contractual barriers to obstruct lawful switching.