Stuttgart: A machine tool leaving a Swabian factory floor this month carries an obligation its predecessor did not. From 12 September 2026 the EU Data Act requires connected products placed on the market to be designed so that the data they generate is accessible to the people who use them. The design rule has arrived. The enforcement behind it has not arrived evenly.
The regulation has applied since September 2025, and its first year focused on access rights to data already being produced. This anniversary shifts the burden upstream, into engineering. A manufacturer can no longer satisfy the rule with a portal bolted onto a closed system. Data pathways must exist by default in the product, which changes hardware specifications, firmware roadmaps and supplier contracts written long before the text was final.
Industrial equipment makers feel this first. A press or a harvester sold into fifteen markets carries telemetry that its manufacturer has historically treated as proprietary, and service revenue often depends on that exclusivity. The Data Act does not abolish the business model, but it removes the technical barrier that protected it, and a customer who can export sensor data can take it to an independent repairer.
The cloud half of the regulation moves on a separate clock. Providers may still levy reduced switching charges, capped at costs directly linked to the switch, and those charges disappear entirely on 12 January 2027. Four months out, buyers are timing renewals accordingly, and providers are repricing the services that will no longer carry an exit fee.
Enforcement is where the single market frays. The regulation leaves each member state to designate competent authorities and set penalties, requiring only that they be effective, proportionate and dissuasive. Germany has pointed to its Federal Network Agency and drafted fines of up to 4 percent of global turnover or five million euros, whichever is higher. France routed its rules through the SREN law, with ceilings of 3 percent rising to 5 percent for repeated breaches. Several capitals have named no authority at all.
That divergence produces a familiar result. A complaint filed in one country reaches a regulator with staff, statutory powers and a fine schedule. The same complaint in another reaches a ministry still deciding who owns the file. Companies will read the map and calibrate compliance to the strictest plausible enforcer, which is roughly how the General Data Protection Regulation settled, several years late.
Manufacturers argue that the design obligation asks for retrofitting on a product cycle that runs longer than the legislative one. A tractor designed in 2023 for sale in 2026 could not anticipate the final text. The Commission’s answer is that the rule applies to products placed on the market from this month, not to the installed base, which is accurate and still leaves inventory questions for anyone holding stock built to the old specification.
The obligations sit in Regulation (EU) 2023/2854, and the drafting is clearer than most. What the text cannot supply is a regulator in every capital willing to use it. Until that exists, the Data Act will work best in the three or four markets that built the enforcement machinery early, and will function as guidance everywhere else.
