Stuttgart: A washing machine designed in 2024 and still rolling off a line this autumn has quietly become a legal problem. As of 12 September, every connected product newly placed on the European market has to be built so that the data it generates can be reached by the person who owns it, directly from the device where that is feasible, and without the manufacturer standing in the middle as gatekeeper.
This is the second and structurally harder half of the Data Act. The first half, applicable since September 2025, told data holders what they must do when a user asks: hand over product data and related service data, in a usable format, without undue delay. That obligation could be satisfied by a portal, a support desk and a reasonably patient lawyer. The obligation that began last Saturday cannot. It is a design requirement, and design requirements bite at the point where a product is specified rather than at the point where a request arrives.
The practical consequence is visible in the product-planning cycles of exactly the industries Europe keeps saying it wants to defend. A premium vehicle takes four to five years from concept freeze to showroom. Industrial machinery runs on similar timescales, agricultural equipment longer. Engineering teams working today on model years that will not reach customers until 2029 are the first cohort for whom access-by-design was a requirement from the beginning. Everyone shipping between now and then is retrofitting, and retrofitting data access into a closed telematics stack is not a firmware patch. It is an architecture question about where data is buffered, which identifiers are exposed, and how a consent flow reaches a screen that may not exist.
Manufacturers have spent much of the past year arguing that the rule’s reach is broader than its drafters intended. A connected product under the Act is any item that obtains, generates or collects data about its use or environment and can communicate that data. That definition covers a thermostat and a combine harvester with equal indifference. Trade associations in the machine-building sector have pressed for clarity on components sold into other products, on second-hand goods, and on the point at which a firmware update turns an old device into a new placement on the market. The Commission’s guidance has narrowed some of these questions without closing them.
Then there is the trade-secret argument, which has proved the most durable of the industry objections and the only one to have made it into a legislative text. The Digital Omnibus package tabled last November proposes letting a trade-secret holder refuse disclosure case by case where release is highly likely to cause serious economic damage, or where it carries a high risk of unlawful acquisition by an entity in a third country. That second limb is the interesting one. It converts a commercial-confidentiality carve-out into something closer to an economic-security instrument, and it will be read closely by anyone whose aftermarket competitors are headquartered outside the Union.
The Omnibus would also drop the Act’s smart-contract provisions entirely and exempt certain bespoke cloud arrangements concluded before September 2025 from the switching rules. Neither change is yet law. Co-legislators are still working through a package that touches the GDPR, the AI Act, the ePrivacy Directive and the cybersecurity framework alongside the Data Act, and nothing in it suspends an obligation that is already applicable.
That gap is where the discomfort sits. A manufacturer can reasonably expect the trade-secret defence to exist in some form within a year or two. It cannot rely on it now. The repair shops, fleet operators, insurers and farm-data cooperatives who were promised access have a right that applies today, and a national enforcement authority with no reason to wait. The Act’s own review clause arrives in 2028. The question by then will not be whether the access obligation worked, but how much of it survived the Omnibus.
