Data Act: your machines' data is (also) yours
5 min read
The Data Act — Regulation (EU) 2023/2854 — has applied since 12 September 2025. Ten months on, many companies still have not noticed. Yet the principle it introduces is the kind that shifts the balance of power: data generated by a connected product also belongs to whoever uses it, not only to whoever built it. And cloud service providers can no longer lock customers in with technical and contractual obstacles. The next milestone is close: from 12 September 2026, connected products placed on the market will have to give access to data by design.
The principle: the press is yours, and so is the data
Until yesterday, the practice was this: you buy a connected machine, the machine generates operating data — cycles, temperatures, vibrations, consumption, alarms — and that data ends up in the manufacturer’s cloud. You, who paid for the machine and put it to work, only see it through the supplier’s portal. If you want to use it for your own predictive maintenance, or hand it to an independent maintenance provider, you depend on the manufacturer’s goodwill and price list.
The Data Act reverses this arrangement. The user of a connected product — a company or an individual — has the right to access the data generated by its use, free of charge, promptly and in a machine-readable format. And has the right to have it shared with a third party of their choosing: a maintenance provider, an insurer, an analytics service provider. The data holder may protect its own trade secrets with appropriate measures, but cannot use confidentiality as a pretext to deny everything. For anyone buying machinery, the clause “the data stays with the manufacturer” stops being an inevitability: it becomes a matter for negotiation, with the law on the buyer’s side.
Cloud: switching provider becomes a regulated right
The second pillar concerns data-processing services — cloud and edge, from IaaS to SaaS. Since 12 September 2025, contracts must include switching clauses: a maximum notice period of two months to begin the transition, a 30-day transition period (extendable only where technically necessary), the obligation to export data and digital assets in a structured format, and the removal of obstacles — technical, contractual, organisational — to changing provider or bringing workloads back in-house.
On costs, the regulation has set a two-stage path. Until 11 January 2027, providers may charge only reduced fees, not exceeding the costs actually incurred for the transition. From 12 January 2027, the charge disappears altogether: the end of switching-related egress fees, today one of the heaviest items in migration quotes. Mind the distinction: the service’s ordinary charges remain payable until the end of the contract; what is being abolished is the surcharge for leaving.
The timeline: what has already kicked in, what’s coming
- 12 September 2025 — the regulation applies: rights to access and share data, switching clauses, protections against unfair terms in business-to-business data-sharing contracts.
- 12 September 2026 — connected products and related services placed on the market after this date must be designed so that data is accessible to the user by default (Article 3).
- 12 January 2027 — total abolition of switching charges between cloud services (Article 29).
- 12 September 2027 — protections against unfair terms extend to contracts concluded before September 2025 as well, if open-ended or of very long duration.
In Italy, the decree designating the national supervisory authorities has not yet been adopted. But the regulation is directly applicable: the obligations hold regardless, and the rights — above all — can already be exercised.
Why it strengthens those who want their data in-house
For a manufacturing company or a utility that buys connected machinery and cloud services, the Data Act is a new contractual lever. Machine data can feed your own operating model, not just the supplier’s portal: predictive maintenance built on plant-floor data is the most immediate example. And the end of egress fees removes the main argument against bringing data back into an in-house infrastructure or a hybrid model governed by the company: the exit cost, which until now made every migration an uphill negotiation, now has a deadline written into the regulation.
The point is not to switch provider on principle. It is that you can now ask for the data, obtain it in a usable format and take it where you need it — and whoever denies it to you must answer to a regulation, not to a request of courtesy on your part.
What to do
- Take stock of the connected products in your company: machinery, vehicles, devices, plant. For each one: who holds the data, with what access, under what contract.
- In new machinery purchases, put data access, format, frequency and the right to share with third parties in writing. From 12 September 2026, access by design is a requirement: ask for it now.
- Re-read your cloud contracts: check that switching clauses, notice periods and migration assistance are compliant; note down what you pay in egress fees today and what you will no longer pay from 12 January 2027.
- Decide where you want your data: which flows make sense within your own operating model, which can stay with the supplier. The right of access is only worth something if you have somewhere to put the data and a use for it.
- Try an access request on an existing machine: it’s the quickest practical test of how ready your supplier base is — and how ready you are.
Want to understand which data from your machines you can claim, and what to actually do with it? Let’s talk: 30 minutes with one of our experts.