The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025, but its second milestone is the one that changes product engineering: connected products placed on the EU market after 12 September 2026 must be designed so users can access the data they generate. In parallel, the cloud-switching chapter is rewriting provider contracts ahead of the January 2027 fee cut-off. Here is the engineering view of both.
What changes on 12 September 2026 under the EU Data Act?
From 12 September 2026, the access-by-design obligation in Article 3(1) applies: connected products and related services placed on the EU market after that date must make the data they generate directly and easily accessible to users by default. Most other Data Act obligations have applied since 12 September 2025. Always verify dates against the regulation text on EUR-Lex.
The timeline in one place:
- ▸11 January 2024, the regulation entered into force.
- ▸12 September 2025, general application: user data access and sharing rights (Articles 4 and 5), the unfair-contract-terms rules for B2B data clauses, and the cloud switching contract requirements (Chapter VI).
- ▸12 September 2026, Article 3(1) access-by-design applies to connected products and related services placed on the market after this date.
- ▸12 January 2027, switching charges for data processing services must be withdrawn entirely (Article 29); until then they are capped at the provider's directly incurred costs.
Two nuances matter. "Placed on the market" means existing device fleets are not retroactively caught by Article 3(1), but the Article 4 right of users to obtain data from the data holder already applies to them. And the November 2025 Digital Omnibus package proposed simplifications across the EU digital rulebook, so verify every date and detail against EUR-Lex and the Commission's Data Act FAQ before committing budget.
Does the Data Act apply to your product or cloud service?
It applies if you manufacture connected products sold in the EU, supply related digital services for them, hold data those products generate, or offer data processing services, IaaS, PaaS, SaaS, edge, to customers in the EU, regardless of where your company is established. Micro and small enterprises get limited carve-outs from some data-sharing duties.
The scope is much wider than consumer IoT:
- ▸Connected products: anything that obtains or generates data about its use or environment and can communicate it, industrial machinery, vehicles, medical devices, building sensors, agricultural equipment.
- ▸Related services: the digital service the product depends on, the companion app, the fleet dashboard, the predictive-maintenance backend.
- ▸Data holders: whoever has the technical ability and legal right to make product data available, typically the manufacturer.
- ▸Data processing services: effectively all cloud and edge offerings sold to EU customers.
Users with access rights are businesses as well as consumers; a factory operating a fleet of CNC machines holds the same Article 4 rights as a consumer with a smart thermostat.
What does access-by-design require engineers to build?
Products and related services placed on the EU market after 12 September 2026 must make readily available data accessible to the user "easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format", directly on the device where relevant and technically feasible, otherwise through the data holder without undue delay.
In practice this is a product backlog, not a policy document:
- ▸Data inventory: enumerate every signal the product and backend generate, telemetry, events, configuration, derived metrics, and mark what is readily available without disproportionate effort.
- ▸Access path: an on-device interface (local API, documented export) where feasible; otherwise an authenticated cloud API. OAuth 2.0 with granular scopes is a sensible default for user-authorized access.
- ▸Formats and metadata: documented schemas (JSON, CSV or Parquet with a data dictionary); the metadata needed to interpret the data has to travel with it.
- ▸Third-party sharing: under Article 5 the user can direct you to share data with a third party, that means permission management, revocation, and audit logging, on fair, reasonable and non-discriminatory terms.
- ▸Trade-secret handling: proportionate technical and contractual protections are allowed; blanket refusal is not. Build redaction and aggregation into the export path.
- ▸Pre-contractual transparency: buyers must be told before purchase what data the product generates and how to access it.
Device credentials and update channels are the other half of a trustworthy access surface; we covered that in Device Identity and Firmware Supply Chain: Securing the IoT Edge in 2026.
How do the cloud switching rules change provider contracts?
Since 12 September 2025, contracts for data processing services must let the customer switch provider or move on-premises with a maximum two-month notice period, a transition period of typically 30 days (extendable only where technically unfeasible), export of all exportable data and digital assets in machine-readable formats, and erasure of remaining data after the switch.
If you sell cloud services, Chapter VI is your compliance surface:
- ▸Article 25 contract terms: switching rights, notice, transition length, a complete specification of exportable data categories, and erasure duties belong in the MSA, silence is non-compliance.
- ▸Functional equivalence: for switching between services of the same type (mainly IaaS), the source provider must support the customer in reaching materially comparable outcomes on the target service.
- ▸Open interfaces: PaaS and SaaS providers must make open interfaces and documentation available to enable switching and interoperability (Article 30).
- ▸Narrow carve-outs: genuinely custom-built services and short-lived test previews escape most, not all, switching duties, assess per service and disclose it.
The pragmatic provider response: publish an exit runbook per service, ship export tooling you have actually tested, and version your service descriptions so sales cannot promise what engineering has not built.
When do egress and switching fees actually end?
From 12 January 2027, providers may no longer charge customers for the switching process itself, which typically covers switching-related data egress. Until then, charges are capped at costs directly incurred. Ordinary operational egress in a continuing multicloud setup is not automatically banned, so read Article 29 and your contract closely.
Details worth knowing before you negotiate:
- ▸The major hyperscalers announced free-egress-on-exit programs in 2024, ahead of the deadline, but with process conditions, typically a formal request and account closure within a window, not a blanket zero on the egress line.
- ▸Early-termination penalties for fixed-term commitments are a separate lever and still exist; the Data Act constrains switching charges, not every commercial term, model exit cost with and without commitments before signing a renewal.
What should cloud customers do before the next renewal?
Treat the switching right as an engineering capability, not a legal clause. Inventory your lock-in surface, proprietary managed services, IAM coupling, data gravity, rehearse an export of your largest dataset, and write Article 25 terms into every renewal. For steady-state workloads, the fee phase-out strengthens the repatriation business case.
- ▸Map the lock-in surface: list every proprietary service (queues, serverless runtimes, ML endpoints) and its nearest portable equivalent.
- ▸Rehearse the export: a switching right you have never exercised is a hope; time a full export of your largest data store and note where throughput, formats, or API limits bite.
- ▸Negotiate now: providers know the 2027 deadline; renewals signed in 2026 are the moment to demand tested exit tooling and contractual transition support.
- ▸Re-run the platform math: if egress killed your repatriation case before, that argument is weakening, see When to Repatriate: A FinOps Decision Framework for Steady-State Workloads.
How does the Data Act interact with GDPR, the CRA, and the AI Act?
GDPR prevails wherever product data is personal: the Data Act adds access rights but does not create a lawful basis to hand personal data to whoever asks. September 2026 also starts the Cyber Resilience Act's reporting obligations, and the AI Act timeline continues, one product team can be in scope of all three.
- ▸If the user requesting data is not the data subject, a fleet operator requesting driver telemetry, for example, you still need a GDPR basis before sharing personal data, plus a classification step in the export pipeline.
- ▸Article 32 requires providers of data processing services to guard non-personal data held in the EU against unlawful third-country governmental access, the same concern driving sovereign architectures; see Sovereign Cloud and EU Data Residency in 2026: An Engineering Playbook.
- ▸Products with digital elements shipping after September 2026 also face CRA vulnerability-reporting duties, mapped in The Cyber Resilience Act Countdown: What to Ship Before September 2026.
- ▸For AI features built on product data, the current obligation set is summarized in EU AI Act, August 2026: What Actually Applies Now (and What the Digital Omnibus Deferred).
How do you build a Data Act backlog in one quarter?
Run four workstreams in parallel: a product data inventory plus access API design; contract and transparency updates; cloud exit engineering for the services you buy; and switching duties for any cloud you sell. Sequence by market-entry dates, a product shipping after September 2026 needs access-by-design in the current firmware cycle.
- ▸Weeks 1-3: data inventory, trade-secret classification, gap analysis against Article 3(1); draft the access API specification.
- ▸Weeks 4-8: implement export endpoints and permission flows; update MSAs and pre-contractual documents; write exit runbooks for your two most locked-in cloud services.
- ▸Weeks 9-12: game-day the export, run legal review of transparency texts, and record which obligations you deferred and why.
- ▸Continuously: track the Digital Omnibus and national enforcement laws, penalties are set at Member State level and are still landing in places. Primary sources: Regulation (EU) 2023/2854 on EUR-Lex and the Commission's Data Act FAQ.
How TuniCyberLabs helps
We build the engineering half of Data Act readiness: data inventories and access APIs for connected products, exit runbooks and portability game-days for cloud estates, and contract-to-architecture reviews that show which obligations your stack actually meets. If a September 2026 product launch or a 2026 cloud renewal is on your calendar, talk to our engineers before the quarter fills up.