Prior to the passage of the EU Data Act (Regulation (EU) 2023/2854), the manufacturers of smart or connected products effectively had exclusive ownership of the data generated by their products. The EU Data Act has ended this assumption. For companies that make, sell, or service connected products in Europe, data generated from such products is now a shared asset, and certain contractual terms are no longer enforceable.
What the Act Is
The EU Data Act went into effect on September 12, 2025. The Act applies to manufacturers of connected products, providers of related digital services, and to cloud and data processing providers that place products on, or offer services in, the EU market (“Data Holders”), regardless of where they are headquartered. A U.S. company selling smart equipment to European customers is squarely within its scope. The primary impact of the Act is on B2B relationships.
Key Dates
- September 12, 2025 — IN FORCE: Core obligations apply; national enforcement is live.
- September 12, 2026 — IN FORCE: Access-by-design requirements apply to connected products and related services placed on the market after this date.
- January 12, 2027 — UPCOMING: Cloud switching and data egress charges must be fully eliminated.
- September 12, 2027 — UPCOMING: Unfair-terms rules extend to older long-term contracts with an indefinite term or expiring at least 10 years from January 11, 2024.
Mandatory Access and Sharing
Users of connected products in the EU, including business customers, now have the right to access the data that is generated by their use promptly and free of charge, and to direct that such generated data be shared with third parties such as competing repair or analytics providers (“Data Recipients”). Products placed on the EU market on and after September 12, 2026 must be designed to make that data accessible by default. However, Data Holders may still protect certain trade secret information through confidentiality safeguards, and may charge Data Recipients reasonable, non-discriminatory compensation for providing the data (which does allow a margin).
Prohibited Contractual Provisions
The Act declares certain data-related terms unilaterally imposed on another business unfair and unenforceable. (Terms are considered unilaterally imposed where the non-drafting party has not been able to influence its content despite an attempt to negotiate it.) Blacklisted terms include those that exclude liability for a party’s gross negligence or intentional acts, strip the other party of remedies for non-performance, or give the imposing party sole power to interpret the contract. Additionally, terms that unduly limit liability, restrict a party’s use of data that it has contributed, permit termination on unreasonably short notice, or allow significantly detrimental data use are presumed to be per se unfair.
The rules prohibiting unfair contract terms apply to contracts entered into on and after September 12, 2025, and as of September 12, 2027, apply to any contracts that are indefinite in term or expire at least 10 years from January 11, 2024. The Act therefore may result in the quiet erosion of protections a business may otherwise believe it has under its commercial agreements.
The Commercial Impact
The practical burden of the Act on Data Holders is substantial. Data Holders must audit their B2B contracts, rework standard terms, and redraft data licensing and data-sharing agreements to eliminate any prohibited contractual terms. Additionally, product teams must re-engineer their products to build in required data access and sharing capabilities, and cloud providers must support customer switching, with switching charges prohibited starting as of January 12, 2027. Business models that monetize equipment data or lock in aftermarket services face new competition and complications.
Key Takeaways
- Map your exposure. Identify connected products, related services, and data flows touching the EU.
- Update contracts. Flag one-sided data, liability, and termination terms, prioritizing evergreen and long-term agreements before 2027. Update standard terms and data agreements to reflect user access rights and incorporate the EU Commission’s model contractual terms.
- Engage product teams. Confirm new products enable data access and sharing by design.
- Protect trade secrets. Establish documented confidentiality measures before access requests arrive.
- Rethink strategy. Treat data access as both a compliance obligation and a competitive opportunity.
The EU Data Act rewards companies that act early. Those that wait may discover that portions of their contracts are no longer enforceable, or that their products are unable to support legally required data access. While the Act does not have centralized enforcement like the GDPR, EU member states can appoint enforcement authorities and establish fines and penalties, and companies should watch for member state guidance and enforcement mechanisms and penalties as they emerge.
This article may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgement of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2026 THOMPSON HINE LLP. ALL RIGHTS RESERVED.