Data Act From 12 September 2026: Why the Deadline Covers Only New Products and the Real Obligation Has Applied for a Year

12 September 2026 is in a lot of calendars right now, usually under a heading like Data Act comes into force. That heading is wrong on two counts. The regulation has been in force since January 2024 and applicable since September 2025. What happens on 12 September 2026 is narrow, and it is almost certainly not the part of the Data Act that will reach your company first.

Three dates, routinely confused

The final article of Regulation (EU) 2023/2854 sets out a staggered application, and reading it carefully answers most of the questions people are currently asking.

Read the middle row again, because it is the one that gets summarised away. The obligation under Article 3(1) applies to connected products and related services placed on the market after 12 September 2026. Your installed base is untouched by that date. And the top row is the one that matters today.

What Article 3(1) demands, and why the deadline has effectively passed

The wording is a construction requirement, not a documentation duty. Connected products must be designed and manufactured, and related services designed and provided, such that product data and related service data, including the metadata needed to interpret and use it, are by default easily, securely and free of charge accessible to the user in a comprehensive, structured, commonly used and machine-readable format, and where relevant and technically feasible directly accessible.

By default. Directly. Free of charge. Machine-readable. Those four words describe an architecture, and architecture is decided early. In machinery, a development cycle from concept to market runs somewhere between one and three years. Which means that for anything currently in that pipeline and destined for release after 12 September 2026, the decision has already been taken, correctly or otherwise. This deadline does not ask what you will do next month. It reveals what you decided last year.

That is uncomfortable but also freeing: if the answer is no, no amount of work between now and September changes the status of those products. The useful question is a different one, and it concerns the machines already out in the field.

The obligation nobody is talking about

Article 4(1) has applied since September 2025, and it covers everything, new and old alike. Where the user cannot access the data directly from the product, the data holder must make readily available data and the metadata needed to interpret it available to the user without undue delay, easily, securely, free of charge, in a comprehensive, commonly used and machine-readable format, and where relevant and technically feasible continuously and in real time.

Then comes the sentence that decides how this plays out in practice: this happens upon a simple request by electronic means, as far as technically feasible. No form. No stated reason. No negotiation. An email from a customer is enough to trigger the obligation.

And Article 5(1) extends it. At the user’s request, the data holder must make the same data available to a third party, again without undue delay, free of charge to the user, and in the same quality the data holder has. For a manufacturer with its own service business, that is the commercially sharpest edge in the regulation. The customer can direct the operating data of their machine to an independent maintenance provider. If your service margin rested on being the only party who could read the machine, that assumption expired a year ago.

Whether this concerns you at all

The definition in Article 2(5) is broad. A connected product is an item that obtains, generates or collects data about its use or environment and can transmit that product data over an electronic communications service, a physical connection or on-device access, provided its main function is not storing or processing data on behalf of someone else. That last clause excludes servers and cloud platforms. It does not exclude machines.

A machine tool with condition monitoring is covered. A commercial vehicle with telematics. A heating system with remote maintenance. A medical device that logs. A packaging line that reports cycle counts. The fact that the data is currently only read internally, or only by your own service team, changes nothing about the classification. And under Article 2(12) a user is any natural or legal person owning the product or holding temporary contractual rights to it, which puts commercial buyers and lessees squarely inside the scope.

Germany now has an authority for this

Article 40 does not set penalty levels itself. It leaves them to the member states and requires only that they be effective, proportionate and dissuasive. Germany’s implementing act was published in the Federal Law Gazette on 29 May 2026 and entered into force the next day, naming the Bundesnetzagentur as the competent authority.

For day-to-day purposes, Article 38 matters more than any fine. It gives users a right to lodge a complaint with that authority. A customer whose data request goes unanswered does not need a lawyer or a court; they need a form. That lowers the threshold for enforcement considerably compared with regimes where the only route is litigation, and it means the first contact with this regulation is more likely to arrive as a letter from Bonn than as a claim.

On waiting for the Omnibus

The Commission proposed amendments to the Data Act in November 2025 as part of the Digital Omnibus package, and the procedure in Parliament and Council is still running. Some of the proposals touch commercially sensitive parts of the regime. None of them is law.

We watched exactly this pattern with the AI Act. A softening was announced, widely reported, and taken by many as a reason to pause, and in the end only one part moved while the obligations most companies actually faced arrived on schedule. Until a change stands in the Official Journal, the text in force is the text that applies. Planning around a softening means planning around a draft.

What is worth doing in the next four weeks

• Decide who answers the first request. An email arrives asking for machine data. Who reads it, who decides, in what timeframe? Without a named owner, “without undue delay” becomes three weeks of internal forwarding, and that alone is the breach.
• Establish what you can actually export today. Not what the system could do in principle. Take one machine type, request its data as a customer would, and time it. That measurement is worth more than any gap analysis.
• Look at your service contracts before someone else does. Clauses that make data access exclusive to your own service organisation are the ones that collide with Article 5. Better to find them yourself than to have a customer’s lawyer find them.
• Separate personal from non-personal data in the export. Machine data frequently carries operator identifiers, shift patterns or badge numbers. The Data Act does not suspend the GDPR; where both apply, both apply.
• Put the pre-contractual information from Article 3(2) into your sales documents. Type, format and estimated volume of the data, whether it is generated continuously, whether it is stored on the device or remotely, how access works. This is comparatively cheap and it is the part a customer notices first.

Conclusion

12 September 2026 is a real deadline, but a narrow one: it covers the design obligation in Article 3(1), and only for products placed on the market after that day. If your development pipeline did not account for it, September will not fix that, and pretending otherwise wastes the four weeks that remain. The obligation that reaches your installed base has been in force for a year, arrives by simple email, extends to third parties your customer names, and now has an authority behind it with a complaint form. That is the one worth preparing for, and preparing means knowing who answers, how fast, and with which file. If you want to know what your systems can actually deliver today rather than in principle, that is what a first conversation is for, and the wider budget picture is in IT strategy for the mid-market.

Frequently asked questions about the Data Act for connected products