A packaging system reports operating times, temperatures, and malfunctions to its manufacturer’s customer portal. The customer uses the system daily, and the manufacturer analyzes the data for maintenance and product development. Many contracts do not specify who is authorized to use this data, or mention it only in a subordinate clause of the terms and conditions.
The Data Act changes that. As of September 12, 2025, users of connected products have the right to access the data generated by their devices. Manufacturers must have a contract with the user in order to use this data for their own purposes. And for new products, data access must now be built into the product design from the outset.
For small and medium-sized industrial companies, this is primarily a matter of their existing contracts. This article follows a medium-sized machinery manufacturer that sells connected packaging systems, provides maintenance services, and uses cloud services itself. Using this company as an example, you’ll see which contracts are affected by the Data Act, what applies to existing contracts, and which clauses you should review.
The Data Act at a Glance
The Data Act is an EU regulation (Regulation (EU) 2023/2854). It governs who may use data from networked products and connected services, and under what conditions. As a regulation, it is directly applicable in all member states.
Connected products are devices that generate and can transmit data when in use, such as machines, systems, vehicles, or measuring instruments. Connected services are digital services without which the product could not perform a function or that complement its functions, such as a portal for remote maintenance. The scope includes the raw data and metadata generated during use. Results of complex analyses derived by the manufacturer from this data are generally not included.
Who is affected: Data subjects, users, data recipients
The Data Act distinguishes between three roles:
Many small and medium-sized businesses fulfill multiple roles at once. Our machine manufacturer is the data owner for its equipment, but also a user of the connected compressors, vehicles, and cloud services that it deploys itself.
Exemptions apply to smaller manufacturers. If a microenterprise or small business manufactures the product or provides the related service, the obligations to provide data do not apply. This does not apply if the business has partners or affiliated companies that exceed these size thresholds, or if it acts as a subcontractor. Medium-sized enterprises are granted a one-year transition period following the placing of a product on the market; according to the Federal Network Agency, this does not apply to data from related services. As users or data recipients, small and medium-sized enterprises retain their full rights.
What deadlines apply to which contracts?
And for new products placed on the market after September 12, 2026, data access must already be incorporated into the product design.
Access by Design: What Applies to New Products
"Access by Design" means that the product must be designed so that users can obtain their data by default in a simple, secure, and free manner, and in a common, machine-readable format. Where relevant and technically feasible, users should be able to access their data directly, for example through an interface on the device or a server. If this is not possible, indirect access upon request remains an option, for example through a web portal.
For our machine manufacturer, this means that if he launches a new generation of equipment in November 2026, the technical infrastructure for data access must already be in place.
Regardless of the product stage, a pre-contractual disclosure requirement has been in effect since 2025. Before entering into a purchase, rental, or lease agreement, the user must be informed about what data is collected, in what format and to what extent, how to access it, and whether the provider intends to use the data itself. In addition to product management, the sales department therefore also needs appropriate proposal documents, product data sheets, and terms and conditions.
Which contracts are affected by the Data Act?
The Data Act does not apply equally to all contracts. Three questions are key: When was the product placed on the market, when was the contract entered into, and how long does it last? This results in three groups:
- New Products (released after September 12, 2026): Access by Design, user rights, and contractual obligations apply in full.
- Legacy products (previously placed on the market): no obligation to redesign, but user rights regarding data effective September 12, 2025, and a contractual basis for data use.
- Existing contracts (entered into on or before September 12, 2025): The clause review will take effect only as of September 12, 2027, and only for open-ended or long-term contracts.
Customer Contracts for Connected Products
The focus is on purchase, rental, and lease agreements. The data owner may use non-personal product data only on the basis of a contract with the user. In practice, this is a data use agreement, either standalone or as part of the customer contract. It should specify the purposes for which the manufacturer uses the data.
Two restrictions apply even under a contract. The manufacturer may not use the data to gain insights into the user’s financial situation or production methods that could harm the user’s market position. Furthermore, clauses that exclude or restrict the user’s rights to the user’s detriment are not binding on the user.
A typical clause in the terms and conditions, such as “All machine data is the exclusive property of the manufacturer,” is therefore hardly tenable anymore. Instead, our machine manufacturer should specify which data it uses for maintenance and product improvement, how the customer gains access to it, and how trade secrets are protected.
Service, Maintenance, and Cloud Contracts
Maintenance contracts are affected in two ways. A remote maintenance portal can itself be a connected service. And if the customer engages an independent service provider, the customer may require the manufacturer to transfer the data to that provider. This transfer requires an agreement under fair, reasonable, and non-discriminatory terms. The manufacturer may charge a fee, but in the case of small and medium-sized enterprises, only the costs of providing the data. The recipient of the data, in turn, may not use the data to develop a competing product.
In the case of cloud contracts, the machine manufacturer is usually the customer. The Data Act requires a written contract with clear rules for switching providers: a notice period of no more than two months, a transition period of generally no more than 30 calendar days, and at least 30 days to retrieve one’s own data. Starting January 12, 2027, switching fees will be eliminated entirely. Anyone who offers their own software should also review their software license agreements for compliance.
As a guide, the European Commission published model contractual clauses for data access and data use, as well as standard contractual clauses for cloud contracts, on November 19, 2025. Formally, this is a draft Commission recommendation, which is currently available in English; versions in all EU languages have been announced. The clauses are non-binding and can be adapted to specific circumstances.
Existing Contracts: What Applies to the Portfolio
For existing contracts, the rules take effect on a phased basis. User rights apply—regardless of the contract’s effective date—to all data generated on or after September 12, 2025. The prohibition on unfair terms, however, initially applies only to contracts entered into after September 12, 2025.
For existing contracts, it takes effect on September 12, 2027, provided they are open-ended or expire no earlier than January 11, 2034 (Art. 50 of the Data Act). Existing fixed-term contracts with shorter terms are not covered by this provision.
For our machinery manufacturer, this means that a perpetual maintenance contract from 2019 must be reviewed for its data clauses by September 2027. The same applies to contracts that were acquired along with purchased companies. In “buy-and-build” structures in particular, contracts with very different terms often come together.
Unfair Data Clauses Between Companies
The Data Act protects companies from data provisions that have been unilaterally imposed on them. This applies to provisions regarding data access and use, liability, and remedies in the event of a breach of duty or termination of the contract. The main subject matter of the contract and the reasonableness of the price are not reviewed.
A clause is considered unfair if it deviates significantly from sound business practice and violates the principle of good faith. In addition, there are two lists:
- For example, disclaimers of liability for willful misconduct or gross negligence, the exclusion of legal remedies in the event of nonperformance, or a unilateral right to determine the interpretation of the contract are always unfair.
- Clauses that are likely to be unfair include, for example, those that unreasonably restrict remedies; permit the use of the other party’s confidential data to its significant detriment; prevent the use of data generated by the party itself; exclude the right to a copy of the data upon termination of the contract; or provide for an unreasonably short notice period .
An unfair clause is not binding on the disadvantaged party. The remainder of the contract generally remains valid. In the event of a dispute, the party that included the clause must prove that it was not imposed unilaterally. Negotiations and amendments should therefore be documented in a transparent manner.
Checklist: You Should Review These Clauses
The following Data Act checklist helps the legal department, sales, and product management review the data inventory in a structured manner.
(For informational purposes only. This tool does not constitute legal advice.)
How " contract management" Software Can Help
The biggest hurdle is rarely a single clause, but rather keeping track of the big picture. With hundreds of customer, maintenance, and supplier contracts, it’s nearly impossible to reliably determine manually which contract falls under which regulatory framework.
contract management software provides the data foundation for this. If the product, effective date, and term are recorded as contract metadata, the portfolio can be filtered by new products, legacy products, and legacy contracts. The AI analysis scans contracts for provisions regarding data access and data use and identifies contracts that lack such clauses.
For our machine manufacturer, this means he can see at a glance which open-ended maintenance contracts were signed before September 2025 and do not contain a data clause. For each of these contracts, he assigns the review to a designated person in the legal department or sales. A reminder before September 12, 2027, ensures that the necessary adjustments are made in a timely manner. The overview of “contract management ” in manufacturing and industry illustrates exactly what this entails for industrial companies and their legal departments.
Conclusion
The Data Act governs contracts, not just interfaces. It changes how manufacturers and users of connected products contractually regulate data rights, and it applies to both new and existing contracts. As of September 12, 2026, “Access by Design” also applies to new products; the next deadline for existing products is September 12, 2027.
It is therefore crucial to clearly categorize your own contract portfolio into new products, legacy products, and legacy contracts. If you know which contracts are affected and where data clauses are missing, you can renegotiate them in a targeted manner instead of having to review the entire portfolio under time pressure.
Would you like to see how you can analyze your contract portfolio based on Data Act criteria? Schedule a demo or get started right away with the Starter Plan.
.svg){kind=logo}
_BestSupport_QualityOfSupport%20(5).png)
.avif)