---
title: "Data from connected products: design duties since 12-09-2026"
description: "What Articles 3 to 7 of the Data Act, Regulation (EU) 2023/2854, require of makers and sellers of connected products and providers of related services, from…"
url: https://pitch.law/academy/data-act-connected-products-design-duties
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# Data from connected products: design duties since 12-09-2026

What Articles 3 to 7 of the Data Act, Regulation (EU) 2023/2854, require of makers and sellers of connected products and providers of related services, from access by design for products placed on the market after 12 September 2026 to pre-contract information, user access, sharing with third parties and trade secrets.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

The [Data Act, Regulation (EU) 2023/2854](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854), has applied since 12 September 2025. One duty was given an extra year: the obligation in Article 3(1) to design connected products and related services so that their data are accessible to the user applies to products and services placed on the market after 12 September 2026 ([Article 50](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_50)).

This deep dive covers Chapter II, Articles 3 to 7. For the Act as a whole, see our [overview of the Data Act](https://pitch.law/academy/eu-data-act).

### Who is caught

The Act works with defined roles ([Article 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_2)):

- A **connected product** is an item that obtains, generates or collects data about its use or environment and can communicate product data via an electronic communications service, a physical connection or on-device access, and whose primary function is not storing, processing or transmitting data for someone other than the user (point (5)). Recital 14 mentions vehicles, health and lifestyle equipment, ships, aircraft, home equipment and consumer goods, medical and health devices, and agricultural and industrial machinery.
- A **related service** is a digital service, including software, without which the product cannot perform a function, or which is connected later to add, update or adapt its functions (point (6)), such as the app that controls a heat pump.
- **Product data** are data generated by the use of a connected product that the manufacturer designed to be retrievable (point (15)). **Related service data** represent user actions or events recorded during the related service (point (16)). **Readily available data** are those a data holder can lawfully obtain without disproportionate effort going beyond a simple operation (point (17)).
- The **user** owns the product, has contractual rights to use it, or receives the related service (point (12)). The **data holder** has the right or obligation to use and make available the data (point (13)), often the manufacturer or the service provider.

### Duty 1: access by design (Article 3(1))

Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, with the metadata needed to interpret and use them, are by default accessible to the user "easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format", and, where relevant and technically feasible, directly ([Article 3(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_3)).

In practice this usually takes the form of an export function, a local interface or an API, built in and documented. It applies to connected products and related services placed on the market after 12 September 2026. Placing on the market is the first making available of a connected product on the Union market (Article 2, point (22)). The text ties the duty to that date for each connected product; it does not exempt a model as such because the model was launched earlier.

### Duty 2: information before the contract (Article 3(2) and (3))

Before a contract to buy, rent or lease a connected product, the seller, rentor or lessor, which may be the manufacturer, must tell the user clearly at least (Article 3(2)):

- the type, format and estimated volume of product data the product can generate;
- whether it can generate data continuously and in real time;
- whether it can store data on the device or on a remote server, and for how long;
- how the user can access, retrieve or erase the data, with the technical means, terms of use and quality of service.

Before a contract for a related service, the provider must give a longer list (Article 3(3)), including the data it will obtain and generate, storage and retention, its own intended use and any use by third parties, its identity and contact details, how to request sharing with a third party, the right to complain, who holds trade secrets in the data, and the contract's duration and termination.

### Duty 3: access on request (Article 4)

Where the user cannot access the data directly, the data holder must make readily available data and the necessary metadata accessible without undue delay, in the same quality as available to the data holder, free of charge, in a structured machine-readable format and, where relevant and feasible, continuously and in real time, on a simple electronic request ([Article 4(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_4)). The data holder may not make choices difficult through the design of its interface (Article 4(4)) and may not ask for more information than needed to verify the user (Article 4(5)).

The data holder may only use non-personal readily available data on the basis of a contract with the user, and may not use them to derive insights into the user's economic situation, assets or production methods in a way that could undermine the user's commercial position (Article 4(13)). It may not pass non-personal product data to third parties except to fulfil its contract with the user (Article 4(14)). The user in turn may not use the data to build a competing connected product (Article 4(10)).

### Duty 4: sharing with third parties (Articles 5 and 6)

On request of the user, the data holder must make readily available data available to a third party, free of charge to the user, under the same quality conditions ([Article 5(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_5)). Towards the third party, the data holder may agree compensation under Articles 8 and 9. Gatekeepers under the Digital Markets Act are not eligible third parties (Article 5(3)). The third party may only use the data for the purposes agreed with the user, must erase them when no longer needed, may not use them to develop a competing product, and may not pass them to a gatekeeper ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_6)).

Where personal data are involved and the user is not the data subject, the data holder may only share them if there is a legal basis under the GDPR (Article 4(12) and Article 5(7)).

### Trade secrets

Trade secrets are disclosed only if the data holder and the user, or third party, first agree proportionate technical and organisational measures to preserve confidentiality. The data holder must identify the trade secrets, including in the metadata (Article 4(6) and Article 5(9)). Without agreement, or if the measures are breached, the data holder may withhold or suspend sharing, in writing, and must notify the competent authority (Article 4(7) and Article 5(10)). Only in exceptional circumstances, where serious economic damage is highly likely despite the measures, may the data holder refuse a specific request, again with written reasons and notice to the authority (Article 4(8) and Article 5(11)). Our article on [database rights and trade secrets](https://pitch.law/academy/database-rights-and-trade-secrets) explains how these protections fit together.

### Who is exempt (Article 7)

Chapter II does not apply to data generated by connected products made or related services provided by a microenterprise or small enterprise, as long as it has no partner or linked enterprise above that size and is not subcontracted to make the product or provide the service. The same goes for an enterprise that has qualified as medium-sized for less than one year, and for a medium-sized enterprise's products for one year after it placed them on the market ([Article 7(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_7)). Any contract term that excludes or varies the user's rights under Chapter II to the user's detriment is not binding (Article 7(2)).

### Enforcement

Users can complain to the competent authority under [Article 38](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_38) or use a dispute settlement body. Member States set penalties ([Article 40](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_40)).

## In practice

A Belgian manufacturer of agricultural robots launches a new model in October 2026. Because it is placed on the market after 12 September 2026, Article 3(1) applies: the farmer must be able to download field and machine data in a structured, machine-readable format, free of charge, from the robot or its app. The dealer that sells the robot gives the Article 3(2) information before the sale, so the manufacturer supplies a standard data sheet to every dealer.

Robots of the older model that the manufacturer placed on the market before 12 September 2026 need no retrofit under Article 3(1). Because the duty is tied to the date each connected product is placed on the market, the manufacturer also checks the units of the old model it still supplies after that date. The other duties apply to all robots in use: a farmer can ask for the readily available data under Article 4 and have them sent to an independent agronomist under Article 5.

A start-up with 20 staff makes smart beehive sensors and has no larger partner or linked enterprise. It falls under the Article 7 exemption. If a large agricultural group acquires a majority stake, the exemption is lost, because the start-up then has a linked enterprise that is not small.

A thermostat maker may use non-personal usage data to improve its products under its contract with the user (Article 4(13)), but may not sell them to an energy trader outside that contract (Article 4(14)).

### Practical steps

1. List the connected products and related services you place on the market, and when they are placed on the market.
2. For products placed on the market after 12 September 2026, check that the access-by-design feature exists, is free, secure and machine-readable, and is documented.
3. Draft the Article 3(2) and (3) information sheets and get them to every dealer and lessor.
4. Set up a request channel for Article 4 and Article 5 requests, with identity checks that ask no more than needed.
5. Identify trade secrets in your data and metadata, and prepare a standard confidentiality package.
6. Check whether you qualify for the Article 7 exemption, and watch for changes in group structure.

### Contracts

You need a contract with each user to use non-personal data yourself (Article 4(13)). Give it clear purposes and check it against Article 13 for business users. The Commission's model contractual terms in Annex II of [Recommendation (EU) 2026/2394](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026H2394) cover exactly this relationship between data holders and users, and Annex IV covers the contract with third parties receiving data at the user's request; we discuss them in our [overview of the Data Act](https://pitch.law/academy/eu-data-act). In dealer and leasing contracts, allocate who gives the Article 3(2) information and who answers access requests.

## Frequently asked questions

### Do we have to redesign products already on the market?

Not those already placed on the market before 12 September 2026. Article 3(1) applies to connected products and related services placed on the market after that date, so check products you still place on the market today. The other Chapter II duties, such as access on request and sharing with third parties, already apply to products on the market.

### Does the user need to pay for access?

No. Access for the user is free of charge (Articles 3(1) and 4(1)). Sharing with a third party is free of charge to the user, but the data holder may agree reasonable compensation with the third party (Articles 5(1) and 9).

### Can we refuse because the data reveal our know-how?

Rarely. The rule is sharing with confidentiality measures agreed in advance. Refusal is reserved for exceptional cases with a highly likely serious economic damage, must be reasoned in writing and notified to the authority.

## How this connects

Our [data licensing and sharing](https://pitch.law/solutions/data-licensing-sharing) service drafts the user contract, the dealer information and the third-party terms, and [data and database rights protection](https://pitch.law/solutions/data-and-database-rights-protection) helps you identify and protect trade secrets before you share. [Document Studio](https://pitch.law/technologies/contract-studio) produces the information sheets and contract sets, and the [rights and obligations register](https://pitch.law/technologies/contract-obligations) tracks agreed purposes, confidentiality measures and erasure duties.

### At a glance

**Provisions cited:** Regulation (EU) 2023/2854, Article 2, points (5), (6), (12), (13), (15), (16), (17) and (22), Articles 3 to 7, 9, 13, 38, 40 and 50; Commission Recommendation (EU) 2026/2394, Annexes II and IV.

**Key dates:** Data Act in force 11 January 2024; applies from 12 September 2025; access by design (Article 3(1)) for connected products and related services placed on the market after 12 September 2026.

**Related:** [the EU Data Act overview](https://pitch.law/academy/eu-data-act), [Cyber Resilience Act I, products and classes](https://pitch.law/academy/cyber-resilience-act-products-and-classes) for the security requirements of the same products, and [database rights and trade secrets](https://pitch.law/academy/database-rights-and-trade-secrets).

## In short

- Which products and services count as connected products and related services
- Access by design under Article 3(1) for products placed on the market after 12 September 2026
- The information to give before the sale, rent, lease or service contract
- User access, third-party sharing and the limits on use
- Trade secrets, the exemption for small enterprises and the contract you need

## Related solutions

- [Solutions](https://pitch.law/solutions/data-licensing-sharing)
  ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing)
  [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing)
- [Solutions](https://pitch.law/solutions/data-and-database-rights-protection)
  ### [Data and Database Rights Protection](https://pitch.law/solutions/data-and-database-rights-protection)
  [How to protect the data and databases you build, through database rights, trade secrets, copyright and the contracts that hold them together.](https://pitch.law/solutions/data-and-database-rights-protection)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/contract-obligations)
  ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations)
  [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)