If you own a smart watch, a connected thermostat or a modern car, your devices have been quietly generating streams of data about you — your sleep, your routines, your driving. Until recently, that data lived almost entirely on the manufacturer's servers, and getting your hands on it was difficult or impossible. A major new European rule that took effect on 12 September 2026 changes that picture: from that date, newly sold connected products in the European Union must be designed so the data they collect is directly accessible to the people who use them.
This guide explains what the new obligation means for device owners, product makers and repair businesses alike, how it fits into a wider wave of EU digital regulation arriving this autumn, and what practical steps each group should take now. It is written for an international audience — the EU rules matter to any company selling into Europe, and their ideas are already spreading to other jurisdictions.
What the EU Data Act requires
The underlying law is the EU Data Act (Regulation (EU) 2023/2854). Most of its provisions became applicable on 12 September 2025, including a requirement that "data holders" give users access, on request, to certain product and related-service data generated by connected products. The new phase that began on 12 September 2026 goes further: it introduces an access-by-design obligation. Connected products and related services placed on the market after that date must be engineered so that the relevant data is, by default, easily, securely and directly accessible to users, free of charge — where relevant and technically feasible.
The qualifier matters. The "technically feasible" condition gives manufacturers room to design products so that all or part of the relevant data is directly or indirectly accessible, taking into account technical feasibility, costs, trade secrets, intellectual property, security concerns and the relevance of direct access in the specific scenario. Where a company relies on indirect access, it should be prepared to justify that decision. In other words, the law sets a default toward openness while leaving engineering judgement in the loop.
Once access is enabled, the data must be provided in a comprehensive, structured, commonly-used and machine-readable format, together with the information needed to understand and use it. A PDF summary or a locked-in dashboard alone will not meet the standard; the intent is that data can move — to an app, a repair service, or a competing product — without friction.
What changes for device owners
For consumers, the new rights are practical rather than abstract:
- See your own data. You can view and download the data your device generates — fitness readings from a wearable, energy usage from a smart thermostat, telemetry from a connected vehicle — through the device itself or its companion app, without filing a formal request.
- Take your data elsewhere. You can share that data with a service provider of your choice, such as an independent repair shop, an insurer or a start-up building analytics tools. The manufacturer can no longer hoard the data to lock you into its own paid services.
- Expect new services. Because the data is machine-readable, third parties can build comparison tools, maintenance reminders and repair services on top of it. The president of Germany's Bundesnetzagentur, the agency enforcing the Data Act in Germany, has argued that the rule helps businesses too — start-ups can build new repair and comparison services using device data.
The rules cover smart home appliances, wearables, connected vehicles and industrial equipment. Note the timing: the design requirement applies to products placed on the market from 12 September 2026. Older devices fall under the earlier, less strict access-on-request rules from September 2025. If you are buying a new connected product this autumn, it should increasingly come with a built-in way to get your data out.
The Cyber Resilience Act: the parallel security wave
The Data Act is not the only EU digital rule landing this month. The EU Cyber Resilience Act (Regulation (EU) 2024/2847, the CRA) entered its next implementation phase on 11 September 2026. From that date, the reporting obligations for certain cybersecurity vulnerabilities and incidents affecting "products with digital elements" — software or hardware products, including their remote data processing solutions and components placed on the EU market separately — apply under Article 14. Examples include connected home cameras, smart fridges and smart televisions.
This matters well beyond Europe's borders. The CRA applies to companies outside the EU if they place products with digital elements on the EU market or make them available there, so UK, US and other international manufacturers must pay attention. The penalties for non-compliance are significant: fines of up to EUR 15 million or up to 2.5% of global annual turnover. The bulk of the CRA's substantive requirements — essential requirements, conformity assessment and CE marking — apply from 11 December 2027, so manufacturers have just over a year to prepare for the heaviest part.
A practical compliance checklist for manufacturers
If you make or sell connected products into the EU, legal advisories published this month converge on a similar to-do list:
- Map your data. Identify every category of product data and related-service data each product generates, where it is stored, and how it flows. You cannot expose data you have not inventoried.
- Build the access path. Design an in-product or app-based interface that gives users direct access by default, in a machine-readable format, free of charge. Document any case where you rely on indirect access and the reasons (technical feasibility, security, trade secrets).
- Prepare for incident reporting. With CRA Article 14 now in force, establish an internal process for detecting, assessing and reporting actively exploited vulnerabilities and severe incidents within the required windows, and know which national authority and the EU single reporting platform to notify.
- Review contracts. Update distribution, supplier and cloud-processing agreements so responsibilities for data access and incident reporting are clearly allocated across the value chain.
- Watch the Digital Omnibus proposal. The European Commission has proposed changes that could adjust the Data Act's scope and timing; advisories suggest tracking it before redesigning products wholesale.
- Plan for December 2027 now. The CRA's essential requirements and CE marking obligations are the heaviest lift; starting conformity work this autumn leaves a realistic runway.
What about the Digital Omnibus proposal?
Legal commentators have flagged that the Commission's Digital Omnibus proposal could modify how some of these obligations apply in practice. The details are still moving, but the direction — access-by-design for new products — is set. Businesses planning product launches for 2027 should treat the September 2026 obligations as the floor, not the ceiling, and keep an eye on the final omnibus text.
Frequently asked questions
Does the Data Act apply to my old smart TV?
The new access-by-design rule applies to products placed on the market from 12 September 2026. Earlier products are covered by the access-on-request rules that have applied since September 2025, which are less demanding.
Can a manufacturer charge me for my data?
Under the new obligation, relevant data must be accessible to users free of charge. Costs may legitimately arise elsewhere — for example, if you ask a third-party repairer to act on the data — but the access itself should not carry a fee.
Do these rules apply outside the EU?
They apply to products placed on the EU market, which means non-EU manufacturers selling into Europe are in scope. The rules do not directly govern products sold only elsewhere, though similar ideas are being discussed in other jurisdictions.
Is this the same as the GDPR?
No. The GDPR governs personal data processing. The Data Act is broader: it covers non-personal product and service data as well, and is specifically about access, portability and fair use of the data connected products generate.
Sources
