If your product collects data about how it’s used or where it works, your European distributors will ask you for a document you have probably never written.
The EU Data Act has required it since September 12, 2025, and since September 12, 2026 it also sets rules on how new connected products must be designed.
The Data Act applies to any item that obtains, generates or collects data about its use or its environment and can communicate that data. The connection can be a network, a cable, or simply on-device access: data that never leaves the product still counts if the product was designed to let someone retrieve it.
Industrial machinery, home appliances, consumer electronics and medical devices are all named examples. The rules apply to manufacturers of connected products placed on the EU market wherever they are established. Products whose main job is storing or transmitting data for others, like servers and routers, fall outside, and so do prototypes.
Before a connected product is sold, rented or leased in the EU, the buyer must receive clear information on the type, format and estimated volume of data the product can generate, whether it generates data continuously and in real time, whether it stores data on the device or on a remote server and for how long, and how the user can access, retrieve or delete that data.
The obligation falls on the seller, which may be the manufacturer. When you sell through a distributor, the distributor is the seller, but you are the one who knows what data the product generates. That’s why the request lands on your desk. The Regulation sets no format: several manufacturers already publish this information as a web page reachable by link or QR code, and it must be updated if the information changes. If your product works with an app or cloud service that controls it, the provider of that service owes the buyer a longer list of information under Article 3(3).
Connected products placed on the EU market after September 12, 2026 must be designed so that the data they generate, with the metadata needed to use it, is accessible to the user by default: easily, securely, free of charge and in a structured, machine-readable format. The date applies to each individual unit, not to the product model, so every unit placed on the market after that date must comply, even if the model was launched years ago.
Your customers’ right to access the data has applied since September 12, 2025. You can choose between direct access, where the user downloads the data, and indirect access, where the user asks and you deliver without undue delay. The user can also ask you to share the data with a third party of their choice, such as an independent repair shop, and you need a contract with the user to use the non-personal data yourself. Trade secrets stay protected, within limits: you can require confidentiality measures, and you can refuse only in exceptional cases where serious economic damage is highly likely.
If you make connected products available in the EU and you are not established there, you must designate a legal representative in one EU Member State under Article 37(11). This obligation has applied since September 12, 2025.
The representative is the contact point for national authorities, which can address it instead of you, and it must show them on request what you have done to comply. Its location decides which Member State oversees you. Until you designate one, the authorities of every Member State can act against you.
This is a different role from the CE marking Authorised Representative. An EU importer can make the CE marking Authorised Representative unnecessary, while the Data Act contains no such exception for its legal representative.
Micro and small enterprises, meaning fewer than 50 employees and up to €10 million in turnover or balance sheet, are exempt from all the obligations of Chapter II, including the Article 3(2) statement and the design rules. The exemption follows the product: if a small company manufactured or designed it, the distributor selling it doesn’t owe the statement either. It doesn’t apply if the company belongs to a larger group or manufactures under contract for another company, and medium-sized enterprises only get a one-year transition.
Some data stays out for everyone: content such as photos, videos or audio recorded by the user, data derived through proprietary algorithms, and data generated before September 12, 2025. The legal representative rule sits in a different chapter of the Regulation, so check it separately even if your company is exempt.
| Term | Definition |
|---|---|
| Connected product | An item that obtains, generates or collects data about its use or environment and can communicate it through a network, a physical connection or on-device access. Its main function is not storing or processing data for others. |
| Related service | A digital service, including software, linked to the connected product in a way that affects its functions, such as an app that sends commands to the device. Connectivity and power supply are not related services. |
| Product data | Data generated by the use of a connected product that the manufacturer designed to be retrievable by the user, the data holder or a third party, including the manufacturer. |
| Related service data | Data representing user actions or events related to the connected product, generated while the related service is provided. |
| Readily available data | Product data and related service data that the data holder can obtain without disproportionate effort. These are the data covered by the access and sharing obligations. |
| User | The person or company that owns, rents or leases the connected product, or receives the related service. The user has the right to access the data and share it with third parties. |
| Data holder | The entity that has the right or obligation to use and make available the data. Usually the manufacturer or the provider of the related service. |
| Third party | A business chosen by the user to receive the data, such as an independent repair or maintenance provider. It cannot use the data to develop a competing product. |
| Pre-contractual information | The information required by Article 3(2) before a connected product is sold, rented or leased: type, format and volume of data, generation mode, storage and retention, and means of access. Often called the Data Act statement. |
| Placing on the market | The first making available of a connected product on the EU market. It applies to each individual unit, not to the product model. |
| Content | Photos, videos, audio or text recorded by the user, typically covered by intellectual property rights. Excluded from the Data Act access obligations. |
| Derived or inferred data | Data resulting from additional investment, such as proprietary and complex algorithms. Outside the scope of the access obligations unless agreed otherwise. |
| Micro and small enterprise | A company with fewer than 50 employees and up to €10 million in turnover or balance sheet, calculated at group level. Exempt from Chapter II obligations for the products it manufactures or designs. |
| Competent authority | The national authority designated by each Member State to apply and enforce the Data Act. |
| Data coordinator | When a Member State designates more than one competent authority, it appoints one of them as data coordinator, the single point of contact for companies and users. |
| Legal representative | A person or company established in the EU that non-EU manufacturers must designate under Article 37(11). Its location decides which Member State, and so which authorities and data coordinator, oversee the manufacturer. A different role from the CE marking Authorised Representative. |
GetReady Compliance supports manufacturers of machinery, electrical equipment and other connected products at every stage of Data Act compliance. Our services cover: