Data Act: What Applies to New Products Since 12 September 2026, and Why the Real Obligation Is Older

12 September 2026 was in a lot of calendars, usually under a heading like Data Act comes into force. That heading was wrong on two counts. The regulation has been in force since January 2024 and applicable since September 2025. What changed on 12 September 2026 is narrow, and it is almost certainly not the part of the Data Act that will reach your company first.

Since 12 September 2026, the design obligation in Article 3(1) applies to connected products and related services placed on the market after that day. Exempt under Article 7(1) are connected products of micro and small enterprises without larger partner or linked enterprises, unless they are subcontracted to manufacture or design a connected product or to provide a related service; the exemption covers all of Chapter II, including the hand-over on request. The same applies to enterprises that have qualified as medium-sized for less than one year, and to connected products of a medium-sized enterprise for one year after they were placed on the market (Article 7(1)). Nothing changes for the installed base: the duty to hand over data on simple request has applied since 12 September 2025 to every connected product not covered by these exemptions, and the Bundesnetzagentur has been the competent authority with a complaints procedure since late May 2026. The amendments proposed in November 2025 under the Digital Omnibus package had not been adopted by 17 October 2026, and on that date the procedure in Parliament was still awaiting a committee decision (procedure 2025/0360(COD)); the published text applies unchanged.

For machinery and plant manufacturers two further dates follow: the reporting duty under the Cyber Resilience Act has been running since 11 September 2026, and from 20 January 2027 the Machinery Regulation applies, which treats software as a safety component.

Three dates, routinely confused

The final article of Regulation (EU) 2023/2854 sets out a staggered application, and reading it carefully answers most of the questions people are currently asking.

Read the middle row again, because it is the one that gets summarised away. The obligation under Article 3(1) applies to connected products and related services placed on the market after 12 September 2026. Your installed base is untouched by that date. And for your installed base, the top row is the one that matters.

What Article 3(1) demands, and why the deadline has effectively passed

The wording is a construction requirement, not a documentation duty. Connected products must be designed and manufactured, and related services designed and provided, such that product data and related service data, including the metadata needed to interpret and use it, are by default easily, securely and free of charge accessible to the user in a comprehensive, structured, commonly used and machine-readable format, and where relevant and technically feasible directly accessible.

By default. Directly. Free of charge. Machine-readable. Those four words describe an architecture, and architecture is decided early. In our machinery projects, a development cycle from concept to market runs somewhere between one and three years. Which means that for anything released after 12 September 2026, the decision was taken long before the deadline, correctly or otherwise. The deadline does not ask what you did in the month before it. It reveals what you decided one to three years earlier.

That is uncomfortable but also freeing: if the answer is no, it could not be changed in the weeks before 12 September 2026. The useful question is a different one, and it concerns the machines already out in the field.

The obligation nobody is talking about

Article 4(1) has applied since September 2025, and it covers new and old products alike. Where the user cannot access the data directly from the product, the data holder must make readily available data and the metadata needed to interpret it available to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and where relevant and technically feasible continuously and in real time.

Then comes the sentence that decides how this plays out in practice: this happens upon a simple request by electronic means, as far as technically feasible. No form. No stated reason. No negotiation. An email from a customer is enough to trigger the obligation.

And Article 5(1) extends it. At the user’s request, the data holder must make the same data available to a third party, again without undue delay, free of charge to the user, and in the same quality the data holder has. For a manufacturer with its own service business, that is the commercially sharpest edge in the regulation. The customer can direct the operating data of their machine to an independent maintenance provider. If your service margin rested on being the only party who could read the machine, that assumption expired on 12 September 2025.

Whether this concerns you at all

The definition in Article 2(5) is broad. A connected product is an item that obtains, generates or collects data about its use or environment and can transmit that product data over an electronic communications service, a physical connection or on-device access, provided its main function is not storing or processing data on behalf of someone else. That last clause excludes servers and cloud platforms. It does not exclude machines.

A machine tool with condition monitoring is covered. A commercial vehicle with telematics. A heating system with remote maintenance. A medical device that logs. A packaging line that reports cycle counts. The fact that the data is currently only read internally, or only by your own service team, changes nothing about the classification. And under Article 2(12) a user is any natural or legal person owning the product or holding temporary contractual rights to it, which puts commercial buyers and lessees squarely inside the scope.

Germany has had an authority for this since May 2026

Article 40 does not set penalty levels itself. It leaves them to the member states and requires only that they be effective, proportionate and dissuasive. Germany’s implementing act was published in the Federal Law Gazette on 29 May 2026 and entered into force the next day, naming the Bundesnetzagentur as the competent authority.

For day-to-day purposes, Article 38 matters more than any fine. It gives users a right to lodge a complaint with that authority. A customer whose data request goes unanswered does not need a lawyer or a court; they need a form. That lowers the threshold for enforcement considerably compared with regimes where the only route is litigation, and it means the first contact with this regulation is more likely to arrive as a letter from Bonn than as a claim.

On waiting for the Omnibus

The Commission proposed amendments to the Data Act in November 2025 as part of the Digital Omnibus package. On 17 October 2026 the procedure in Parliament and Council was still running, and none of the proposals was law. Some of them touch commercially sensitive parts of the regime.

We watched exactly this pattern with the AI Act. A softening was announced, widely reported, and taken by many as a reason to pause, and in the end only one part moved while the obligations most companies actually faced arrived on schedule. Until a change stands in the Official Journal, the text in force is the text that applies. Planning around a softening means planning around a draft.

What is worth doing now

• Decide who answers the first request. An email arrives asking for machine data. Who reads it, who decides, in what timeframe? Without a named owner, “without undue delay” becomes three weeks of internal forwarding, and that alone is the breach.
• Establish what you can actually export today. Not what the system could do in principle. Take one machine type, request its data as a customer would, and time it. That measurement is worth more than any gap analysis.
• Look at your service contracts before someone else does. Clauses that make data access exclusive to your own service organisation are the ones that collide with Article 5. Better to find them yourself than to have a customer’s lawyer find them.
• Separate personal from non-personal data in the export. Machine data frequently carries operator identifiers, shift patterns or badge numbers. The Data Act does not suspend the GDPR; where both apply, both apply.
• Put the pre-contractual information from Article 3(2) into your sales documents. Type, format and estimated volume of the data, whether it is generated continuously, whether it is stored on the device or remotely, how access works. This is comparatively cheap and it is the part a customer notices first.

Conclusion

12 September 2026 is a real deadline, but a narrow one: it covers the design obligation in Article 3(1), and only for products placed on the market after that day. If your development pipeline did not account for it, the deadline did not fix that. The obligation that reaches your installed base has applied since 12 September 2025, arrives by simple email, extends to third parties your customer names, and has had an authority with a complaint form behind it since May 2026. That is the one worth preparing for, and preparing means knowing who answers, how fast, and with which file. If you want to know what your systems can actually deliver today rather than in principle, that is what a first conversation is for, and the wider budget picture is in IT strategy for the mid-market.

Frequently asked questions about the Data Act for connected products