Challenges of EU Data Act in Home Appliance business
As we started 2026, the EU Data Act (Regulation (EU) 2023/2854), which is now in force in whole European Union, is mandatory for all “connected” home appliance manufacturers. IT is applicable since 12 September 2025.
Compared to other industries, like automotive or agriculture, the situation is far more complicated. The implementation of connected services varies between manufacturers, and lack of connectivity is not often considered important factor, especially for lower-segment devices.
The core approaches to connectivity in home appliances are:
- Devices connected to Wi-Fi network and sharing the data constantly to the cloud.
- Devices which can be connected through bluetooth and mobile app (those devices technically expose local API which should be accessible to owner)
- Devices with no connectivity available to customer (no mobile app), but still collecting data for diagnostic and repair purposes, accessible through undocumented service interface.
- Devices with no data collection at all (even diagnostic data).
Apart from the last bullet point, all of the mentioned approaches to building Smart HomeAppliance require the EU Data Act implementation, and those devices are considered “connected product”, even without actual internet connectivity.
The rule of thumb would be - if there is data collected by the home appliance or mobile app associated with its functions, it falls under the EU Data Act.
Short overview of EU Data Act
To make the discussion more concrete, it helps to name the key roles and the types of data upfront. In EU Data Act language, the user is the person or entity entitled to access and share the data; the data holder is typically the manufacturer and/or provider of the related service (mobile app, cloud platform); and a data recipient is the third party selected by the user to receive the data. In home appliances, “data” usually means both product data (device signals, status, events) and related-service data (app/cloud configuration, diagnostics, alerts, usage history, metadata), and access often needs to cover both historical and near-real-time datasets.
Another important dimension is balancing data access with trade secrets, security, and abuse prevention. Home appliances are not read-only devices. Many can be controlled remotely, and exposing interfaces too broadly can create safety and cybersecurity risks, so strong authentication and fine-grained authorization are essential. On top of that, direct access must be resilient:rate limiting, anti-scraping protections, and audit logs help prevent major misuse. Direct access should be self-service, but not unrestricted.
Current market situation
As of the 01.2026, most of the home appliance manufacturers (>85% of the 40manufacturers researched, responsible for 165 home appliance brands currently present on the European market) either provide the data access through a manual process (ticket, contact form, email, chatbot) or does not recognize the need of sharing data with owner at all.
If we look at the market from the perspective of how manufacturer treats the requirementsEU Data Act imposes on them, we can see that only 12,5% of 40 companies researched (which means 5 manufacturers) provide the full data access with portal allowing to easily, in self-service manner access your data (green on chart below). 55% companies researched (yellow on the diagram below) recognize the need of sharing the data with their customers, but as a manual service request or email, not in automated or direct way.
The red group (32,5%) is a group of manufacturers, which according to our researchers:
- does not provide an easy way to access your data,
- does not recognize EU Data Act legislation at all,
- recognizes EDA, but their interpretation is that they don’t need to share data with devices owners.
A contact form or email can be treated as a temporary solution, but it fails to fulfill the next set of requirements around direct data access. Although direct access can be understood differently and can be fulfilled in different ways, a manual request requiring manufacturer permission and interaction is generally not considered “direct”. (Notably, “access by design” expectations intensify for products placed on the market from September 2026.)
API access
We can’t talk about EU Data Act implementation without understanding the current technical landscape. For home appliance industry, especially high-end devices, the competitive edge is smart features and Smart Home integration support.That’s why many manufacturers already have the cloud API access to their devices.
Major manufacturers, like Samsung, LG, Bosch, allow to access the appliance (like electric ovens, air conditioning system, humidifier, or dishwasher) data and control its functions. This API is then use by mobile app (which is a related service in terms of EU Data Act), or by owners building popular Smart Home systems.
There are two approaches: either device itself provides local API through server running on it (very rare), or the API is provided in the manufacturer cloud (most common), making the access easier from outside world, securely through their authentication mechanism, but requiring data storage in the cloud.
Both approaches in the light of EDA can be treated as direct access. The access does not require specific permission from the manufacturer, anyone can configure, and if all functions and data is available, this might be considered the solution.
Is API access enough?
The unfortunate part is that it rarely is, and for more than one reason. Let’s get through all of them to understand why Samsung, which has great Smart Things ecosystem, still developed separate EU Data Act portal for data access.
1. The API does not make all data accessible
The APIs are mostly developed for Smart Home and integration purposes, not with the goal of sharing all the data collected by the appliance or by the related service(mobile app).
Adding endpoints for every single datapoint, especially for metadata, will be costly and not really useful for both customers and the manufacturer. It’s easier and better to provide all supplementary data as a single package.
2. The APIs were developed with device owner in mind
EU Data Act streamlines the data access for all data market participants - not only device owners, but also other businesses in B2B scenarios. Sharing data to other business entities under fair, reasonable and non-discriminatory terms is the core of EDA.
This means that there must be a way to share data with the company selected by the data owner in a simple and secure way. This effectively means that the sharing must be coordinated by the manufacturer, or at least the device should be designed in a way which allows to securely share the data, which in most cases requires a separate account or access API for B2B.
3. The API does not make all data accessible
The B2B data access scenarios require a carefully designed consent management system to make sure the owner has full control regarding the scope of data sharing, the way it’s shared and with whom. The owner can also revoke the data sharing permission any time.
This system falls under the partner portal purposes, not Smart Home API. Some of the global manufacturers already have partner portals which can be used for this purpose, but a sole API is not enough.
If API is not enough - what is enough?
The EU Data Act problem is not really the problem of expanding the API with new endpoints.The recommended approach, as taken by previously mentioned Samsung, is to create a separate portal solving compliance problems. Let’s briefly look also at the potential solutions for direct access to data:
- Self-service export (download package, machine-readable +human-readable - as long as the export is fast, automatic and allows to access the data as fast as the manufacturer can.
- Delegated access to a third party (OAuth-style authorization, scoped consent, logs).
- Continuous data feed (webhook/stream for authorized recipients).
Those are approaches which OEMs currently take to solve the problem.
Other challenges bound to home appliance market
Home appliance connectivity is different to the automotive market. Because devices are bound to Wi-Fi or Bluetooth networks, or in rare cases smart home protocols(ZigBee, Z-Wave, Matter), they are not moving and changing owners that often.
The device ownership change happens only when the whole residence changes owners, which is either the specific situation of businesses like AirBnB, or current owners moving out - which very often means the Wi-Fi and/or ISP (Internet ServiceProvider) is changed anyway.
On the other hand, it is hard to point at the specific “device owner”. If there is more than one resident, so effectively any scenario outside “single-person household”, there is no way to effectively separate the data applicable to specific individuals. Of course, every reasonable system would create a check box or notification, that the data can only be requested when there is legal basis under GDPR, but selecting correct user or admin to authorize data sharing is challenging.
From the business perspective, the challenge also arises from the fact that there are white label OEMs manufacturing for global brands in specific market segments.The good example here is the TV market - to access the system data there can beGoogle/Android access point, diagnostic data is separate and should be provided by the manufacturer (which can be the brand selling the device, but not always). If you purchase a TV branded by Toshiba, Sharp, or Hitachi, it can be all manufactured by Vestel. At the same time the other home appliances with the same brand can be manufactured elsewhere. Gathering all the data and helping the user understand where his data is, can be tricky at least.
The one other important challenge is the broad spectrum of devices with different functions and collecting different signals. This requires complex data catalogs, potentially also integrating different data sources, and different data formats. It’s not uncommon for users to purchase multiple different devices from the same brand and request access to all data at once. The user shouldn’t have to guess whether the brand, OEM, or platform provider holds specific datasets - the compliance experience must reconcile identities and data sources to make it easy to use.
Conclusion
Navigating the EU Data Act is complicated, it does not matter which industry we focus on.When we were researching the home appliance market we have seen very different approaches - from state-of-the-art system created by Samsung compliant with allEDA requirements, to manfuacturers who explain in user manual that to “access the data” you need to open system settings and reset the device to factory settings, effectively removing the data instead of sharing. The market as a whole is clearly not ready.
Making your company compliant with EU Data Act is not that hard. The overall idea and approach is similar, does not matter which industry you represent, but building or procuring the new system to fulfill all requirements is for most of the manufacturers a must.
That’s why Grape Up designed and developed Databoostr, the EU Data Act compliance platform which can be either installed on customer infrastructure, or integrated as a SaaS system. This is the quickest and most cost-effective way to become compliant, especially considering the shrinking timeline, while also enabling data monetization.
Data Sharing & Monetization Platform
Databoostr - your customized solution for handling data sharing challenges
Check related articles
Read our blog and stay informed about the industry's latest trends and solutions.
Interested in our services?
Reach out for tailored solutions and expert guidance.