EU DATA ACT

A data holder is the party that has the right or obligation to make data from a connected product or related service available. In practice this is usually the manufacturer of the connected product or the provider of the related service. The user is the person or company that owns, rents, or leases the product. Determining who holds which role is the first step in any Data Act assessment, because the obligations follow the role, not the industry.

The access and sharing obligations have applied since 12 September 2025, regardless of when a product was placed on the market. The design requirement for direct data access applies to connected products and related services placed on the market from 12 September 2026. For existing fleets this means access has to be organized even where the product was never designed for it, often through gateways, backends, or platform-side interfaces rather than changes to the device itself.

In practice, data access by design means the product and its backend are built so that users can get to their data without a manual process on the manufacturer's side. That involves documented interfaces, a data model that makes clear which data points exist and what they mean, authentication and permission management so that only entitled parties get access, delivery in a structured, machine-readable format, and access close to real time where the use case requires it. The obligation applies where relevant and technically feasible, which makes the technical assessment part of the compliance work.

To comply with the EU Data Act, organizations must identify relevant data use cases, assess how data is generated and shared, and implement mechanisms for data access and portability. This includes aligning technical systems, contractual frameworks, and governance structures. Compliance also requires continuous monitoring to keep pace with evolving requirements and integrate them into existing data governance strategies.

The three regulations overlap but answer different questions.

GDPR governs personal data and applies whenever data can be linked to an individual.

The EU Data Act governs access to and sharing of data from connected products, including non-personal data.

The EU AI Act governs how AI systems are developed and used, which matters as soon as product data feeds AI models. Connected products often fall under all three at once, which is why access rights, privacy safeguards, and AI documentation are best designed together rather than in sequence.

Penalties are set by the EU member states and must be effective, proportionate, and dissuasive. Where a violation involves personal data, fines can reach GDPR levels. In practice, the more immediate consequence is commercial: late implementation puts data access rights and the partnerships built on them at risk, and products that cannot deliver data as required become harder to sell into the EU market.

Diconium supports organizations through a structured end-to-end approach, starting with an in-depth assessment of products, services, and data flows to determine where the EU Data Act applies. Based on this, we design tailored implementation strategies that integrate legal, technical, and organizational measures. Compliance is then not only achieved but embedded into existing IT systems and business processes.