Framework
Data Act (EU) 2023/2854
The Data Act gives users of connected products a right to their data and requires manufacturers to plan access into the design. Complass guides you from the data inventory through data access and contracts to your rights as an operator.
What is Data Act?
The Data Act is Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data. It has applied directly in all Member States since 12 September 2025 and governs access to the data of connected products and related services, making data available to third parties, unfair contractual terms between enterprises, data requests by public sector bodies and switching between data processing services.
Content as of:
Does it apply to me?
The Data Act applies to manufacturers of connected products placed on the market in the EU and to providers of related services, irrespective of their place of establishment. This includes connected machinery, plants and control systems as well as apps, service portals and remote maintenance. It also covers data holders, users, data recipients and providers of data processing services such as cloud and SaaS services.
The data access obligations of Chapter II do not apply to connected products and related services of microenterprises and small enterprises without larger partner or linked enterprises. The rules on unfair contractual terms and on cloud switching, by contrast, apply regardless of company size. As an operator of connected machinery you are a user and have your own rights to the data.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- Art. 1 Data ActArticle 1 Data Act Subject matter and scope1. This Regulation lays down harmonised rules, inter alia, on: - (a) the making available of product data and related service data to the user of the connected product or related service; - (b) the making available of data by data holders to data recipients; - (c) the making available of data by data holders to public sector bodies, the Commission, the European Central Bank and Union bodies, where there is an …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Subject matter and scope
- Art. 2 Data ActArticle 2 Data Act DefinitionsFor the purposes of this Regulation, the following definitions apply: (1) ‘data’ means any digital representation of acts, facts or information and any compilation of such acts, facts or information, including in the form of sound, visual or audio-visual recording; (2) ‘metadata’ means a structured description of the contents or the use of data facilitating the discovery or use of that data; (3) ‘personal data’ …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Definitions
- Art. 3 Data ActArticle 3 Data Act Obligation to make product data and related service data accessible to the user1. Connected products shall be designed and manufactured, and related services shall be designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use those data, are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Making data accessible and pre-contractual information
- Art. 4 Data ActArticle 4 Data Act The rights and obligations of users and data holders with regard to access, use and making available product data and related service data1. Where data cannot be directly accessed by the user from the connected product or related service, data holders shall make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Data access for users
- Art. 5 Data ActArticle 5 Data Act Right of the user to share data with third parties1. Upon request by a user, or by a party acting on behalf of a user, the data holder shall make available readily available data, as well as the relevant metadata necessary to interpret and use those data, to a third party without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Sharing data with third parties
- Art. 7 Data ActArticle 7 Data Act Scope of business-to-consumer and business-to-business data sharing obligations1. The obligations of this Chapter shall not apply to data generated through the use of connected products manufactured or designed or related services provided by a microenterprise or a small enterprise, provided that that enterprise does not have a partner enterprise or a linked enterprise within the meaning of Article 3 of the Annex to Recommendation 2003/361/EC that does not qualify as a microenterprise or a …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Exemption for microenterprises and small enterprises
- Art. 13 Data ActArticle 13 Data Act Unfair contractual terms unilaterally imposed on another enterprise1. A contractual term concerning access to and the use of data or liability and remedies for the breach or the termination of data related obligations, which has been unilaterally imposed by an enterprise on another enterprise, shall not be binding on the latter enterprise if it is unfair. 2. A contractual term which reflects mandatory provisions of Union law, or provisions of Union law which would apply if the …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Unfair contractual terms between enterprises
- Art. 23 Data ActArticle 23 Data Act Removing obstacles to effective switchingProviders of data processing services shall take the measures provided for in Articles 25, 26, 27, 29 and 30 to enable customers to switch to a data processing service, covering the same service type, which is provided by a different provider of data processing services, or to on-premises ICT infrastructure, or, where relevant, to use several providers of data processing services at the same time. In particular, …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗Switching between data processing services
Key dates
- Entry into force of the Regulation (twentieth day after publication on 22.12.2023); start of the period of reduced switching charges · Art. 50, first subparagraph, Art. 29(2)Article 50 Data Act Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 12 September 2025. The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026. Chapter III shall apply in relation to obligations to make data available under …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
- General application; Chapter IV for contracts concluded after this date · Art. 50, second and fifth subparagraphsArticle 50 Data Act Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 12 September 2025. The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026. Chapter III shall apply in relation to obligations to make data available under …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
- Design for access (Art. 3(1)) applies to connected products and related services placed on the market after this date · Art. 50, third subparagraphArticle 50 Data Act Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 12 September 2025. The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026. Chapter III shall apply in relation to obligations to make data available under …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
- No more switching charges when switching between data processing services · Art. 29(1)Article 29 Data Act Gradual withdrawal of switching charges1. From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process. 2. From 11 January 2024 to 12 January 2027, providers of data processing services may impose reduced switching charges on the customer for the switching process. 3. The reduced switching charges referred to in paragraph 2 shall not exceed the costs incurred by the provider …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
- Chapter IV (Art. 13) also applies to contracts concluded on or before 12.09.2025 that are of indefinite duration or due to expire at least 10 years from 11.01.2024 · Art. 50, sixth subparagraphArticle 50 Data Act Entry into force and applicationThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 12 September 2025. The obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026. Chapter III shall apply in relation to obligations to make data available under …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
- Evaluation of the Regulation by the Commission · Art. 49(1), (2)Article 49 Data Act Evaluation and review1. By 12 September 2028, the Commission shall carry out an evaluation of this Regulation and submit a report on its main findings to the European Parliament and to the Council, and to the European Economic and Social Committee. That evaluation shall assess, in particular: - (a) situations to be considered to be situations of exceptional need for the purpose of Article 15 of this Regulation and the application of …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
Key dates according to Art. 50 of the Regulation as published on 22.12.2023, including the corrigendum of 09.09.2025. The Commission has proposed amendments with the Digital Omnibus (COM(2025) 837); this proposal has not yet been adopted.
How Complass helps
- 11phases
- 47guided steps
- 12document templates
- 43requirements in the catalogue
Guided Data Act project
Eleven phases from scope, roles and SME check through the data inventory, design for access and pre-contractual information to data access, sharing with third parties, trade secrets, contractual terms, cloud switching, user rights and access by public sector bodies.
Catalogue of obligations by role
The obligations for manufacturers and providers of related services, data holders, data recipients, providers of data processing services and all enterprises as well as the rights of users, with original wording, status and evidence.
Templates
Role analysis, data inventory, design-for-access concept, pre-contractual information, data use contract, access process, trade secret protection concept, terms for making data available, review of contractual terms and switching clauses. Templates for customer-facing texts contain example wording that you should have legally reviewed before use.
Training R-DATAACT
Course on the Data Act for those responsible in product management, development, sales and legal, with assignment, progress and participation certificate.
The phases in the module
- Scope, roles and SME exemption
- Data inventory: product data, related service data and metadata
- Design for access: provide data access in the product
- Information duties before the contract is concluded
- Data access for users and data use by the data holder
- Sharing with third parties, fair terms and compensation
- Trade secrets and technical protection measures
- Fair contract terms between businesses
- Cloud switching: role check and short path for providers of data processing services
- Your rights as a user (operator of connected machinery)
- Access by public authorities, interoperability, supervision and penalties
Catalogue: Catalogue of obligations by role and article
Matching modules
Compliance management
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreSupplier Management
Classify suppliers, request self-assessments and evidence directly from the supplier, review them and ask for more. With questionnaires for NIS2, GDPR, ISO 27001, the CRA and IEC 62443-2-4.
Learn moreAsset management
IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.
Learn moreFrequently asked questions
Does the Data Act also apply to machines we have already sold?
Partly. The obligation to design products for data access only applies to connected products and related services placed on the market after 12 September 2026; what counts is each individual unit, not the product type. Users’ rights to access readily available data and to have it shared with third parties, by contrast, have no separate start date and have applied since 12 September 2025. According to the European Commission’s FAQ, they also cover machines already in the field.
We are a small company. Do we have to implement the Data Act?
The data access obligations of Chapter II do not apply to microenterprises and small enterprises, provided they have no larger partner or linked enterprises and have not been subcontracted to manufacture or design a connected product. The rules on unfair contractual terms and on cloud switching still apply. Complass guides you through this check.
We operate connected machines from other manufacturers. What does the Data Act give us?
As a user you can request the readily available data of your machines from the data holder, free of charge and in a machine-readable format, and have them shared with a third party of your choice, for example a service partner. Complass helps you request data, review contracts and set requirements for purchasing new machines.
Does Complass replace a legal review?
No. Complass structures roles, obligations and evidence based on the legal text and provides templates with example wording; have contracts and customer-facing texts legally reviewed before use.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.