Who holds the data? The EU Data Act's access by design rules take effect

The EU Data Act (Regulation (EU) 2023/2854) (the 'Act') came into force on 11 January 2024, before becoming generally applicable on 12 September 2025. The Act ushered in new rules for digital economy providers and users, primarily by granting users more control over data generated by 'smart' products and devices, whilst also adding additional flexibility around data switching and portability for customers of data processing services. 

To mark the first anniversary of the Act's general applicability, one of the deferred areas of the Act – the access by design rules for connected products and related services (Article 3(1)) comes into effect, applying to any connected products or related services placed onto the EU market after 12 September 2026. 

Key requirements of Article 3(1)

Under the Act, a 'connected product' is a product or item that:

• collects data about its use or its environment;
• can transmit this product data via an electronic communications service or similar; and
• does not have the primary function of storing, processing or transmitting data for anyone other than the user.

Examples of connected products include IoT devices, wearables, smart appliances and devices, in addition to 'smart' machinery and medical devices and connected vehicles. 

Article 3(1) requires that in the design of connected products (and related services), providers must ensure that product data and related service data are more accessible to users – with the Act requiring this data, including the underlying metadata needed to interpret and use it, to be easily, securely and freely accessible, in an industry standard machine readable format, and where technically feasible, directly accessible to users. 

This is important in standardising the minimum requirements around data accessibility in the IoT and smart device market, where the functionality offered by connected product vendors is not uniform or necessarily comprehensive, despite the adoption of such products becoming more widespread, resulting in increased volumes of relevant product and service data. 

What does this mean for IoT providers?

Providers will need to provide at least the following information regarding data access to users before contracting (Article 3(2-3)) (i.e. as part of the product description, pre-contractual information or technical information):

• type, format and volume of product data generated by the connected product;
• how the connected product stores data; and
• the retention periods of data, and how users can manage their data.

Providers should also consider whether it is relevant and technically feasible for the connected product to provide direct access to product and service data, such as via a direct data feed from the product. Where this is not relevant or technically feasible, the provider would require this data to be indirectly available to users through suitable alternative means (Article 3(1) and 4(1)). 

These rules apply to new connected products or related services, where relevant contracts are entered into after 12 September 2026. 

The Act has extraterritorial effect, meaning it applies to non-EU manufacturers and service providers placing connected products (and/or related services) onto the EU market.

What steps should providers take?

• Product assessment: providers will need to consider whether their products and services are connected products or related services, and therefore in scope of these new rules. 
• Data mapping and access assessment: if in scope, providers should map what product and service data (including underlying metadata) is being generated, including how this data can be accessed and whether it is directly held by the provider or held by a subprocessor.
• Updating contractual documents: contractual documents and technical documentation, including relevant pre-contractual information, should be updated to reflect the requirements of these new rules, in addition to any other relevant areas of the Act. 
• Access by design: products will need to now be developed to incorporate the access by design principles of either making product and service data available via a direct access route, or otherwise via an indirect route upon user request, including building the mechanism for users to make such requests. 

For advice on access by design compliance or other EU Data Act compliance matters or if you have any questions on this topic, please get in touch with your usual Withers contact or the author of this article.