REPAIR Act and State Laws: What automotive OEMs must prepare for
Right to Repair is becoming a key issue in the U.S., with the REPAIR Act (H.R. 906) at the center. This proposed federal law would require OEMs to give vehicle owners and independent repair shops access to vehicle-generated data and critical repair tools.
The goal? Protect consumer choice and promote fair competition in the automotive repair market, preventing manufacturers from monopolizing repairs.
For OEMs, it means growing pressure to open up data and tools that were once tightly controlled. The Act could fundamentally change how repairs are managed , forcing companies to rethink their business models to avoid risks and stay competitive.
We’ll walk you through the REPAIR Act’s key provisions and practical steps automotive OEMs can take to adapt early and avoid compliance risks.
What’s inside the REPAIR Act (H.R. 906)
The REPAIR Act (H.R. 906), also known as the Right to Equitable and Professional Auto Industry Repair Act, aims to give consumers and independent repair shops access to vehicle data, tools, and parts that are crucial for repairs and maintenance.
Its goal is to level the playing field between manufacturers and independent repairers while protecting consumer choice. This could mean significant changes in how OEMs manage vehicle data and repair services.
REPAIR Act timeline – where are we now
The REPAIR Act (H.R. 906) was introduced in February 2023 and forwarded to the full committee in November 2023.
As of January 3, 2025, the bill has not moved beyond the full committee stage and was marked "dead" because the 118th Congress ended before its passage. But the message remains clear - Right to Repair isn’t going away. The growing momentum behind repair access and data rights is reshaping the conversation.
REPAIR Act provisions
Which obligations for manufacturers are covered by the Repair Act?
1) Access to vehicle-generated data
- Direct data access: OEMs would be required to provide vehicle owners and their repairers with real-time, wireless access to vehicle-generated data. This includes diagnostics, service, and operational data.
- Standardized access platform: OEMs must develop a common platform for accessing telematics data to provide consistent and easy access across all vehicle models.
2) Standardized repair information and tools
- Fair access: Critical repair manuals, tools, software, and other resources must be made available to consumers and independent repair shops at fair and reasonable costs.
- No barriers: OEMs cannot restrict access to essential repair information. The aim is to prevent them from monopolizing repair services.
3) Ban on OEM part restrictions
- Aftermarket options: The Act prohibits manufacturers from requiring the use of OEM parts for non-warranty repairs. Consumers can choose aftermarket parts and independent service providers.
- Fair competition: This provision supports competition by allowing aftermarket parts manufacturers to offer compatible alternatives without interference.
4) Cybersecurity and data protection
- Security standards: The National Highway Traffic Safety Administration (NHTSA) will set standards to balance data access with cybersecurity.
- Safe access: OEMs can apply cryptographic protections for telematics systems and over-the-air (OTA) updates, provided they do not block legal access to data for independent repairers and vehicle owners.]
These provisions go beyond theory and will directly affect how OEMs handle repairs and manage data access. Even more challenging? The existing patchwork of state laws that already demand similar access makes compliance tricky.
Complex regulatory landscape: How Right to Repair influences automotive OEMs
The regulatory environment for the Right to Repair in the U.S. is becoming increasingly complex, with state-level laws already in effect and a potential nationwide federal law still pending. This evolving framework presents both immediate and long-term challenges for automotive OEMs, requiring them to navigate overlapping requirements and conflicting standards.
State-level laws: A growing patchwork
As of February 2025, several states have enacted comprehensive Right to Repair laws.
Massachusetts and Maine have laws explicitly targeting automotive manufacturers. (Automakers have sued to block the law’s implementation in Maine.)
These regulations require manufacturers to provide vehicle owners and independent repairers with access to diagnostic and repair information, as well as a standardized telematics platform.
Other states like California, Minnesota, New York, Colorado, and Oregon have focused on consumer electronics or agricultural equipment without directly impacting automotive OEMs.
However, the broader push for repair rights means automotive manufacturers cannot ignore the implications of this trend.
Additionally, as of early 2025, 20 states had active Right to Repair legislation, reflecting the momentum behind this movement. While most of these bills remain under consideration, they highlight the growing pressure for more open access to repair information and vehicle data.
Federal vs. state regulations: Compliance challenges
The pending federal REPAIR Act (H.R. 906) aims to create a unified national framework for the Right to Repair, focusing on vehicle-generated data and repair tools. However, until it becomes law, OEMs must comply with varying state laws that could contradict or go beyond future federal requirements.
Key scenarios:
- If the REPAIR Act includes a preemption clause , federal law will override conflicting state laws, providing a single set of rules for OEMs.
- If preemption is not included , OEMs will face a dual compliance burden, adhering to both federal and state-specific requirements.
This uncertainty complicates planning and increases the risk of non-compliance, making it essential for OEMs to prepare now.
Global pressures: The EU's Right to Repair mandates
The U.S. isn’t the only region focusing on the Right to Repair. European Union regulations are setting global standards for OEMs selling internationally.
- European Court of Justice Ruling (October 2023): Automotive manufacturers cannot limit repair data access under cybersecurity claims, expanding rights for independent repairers.
- EU Data Act (September 12, 2025): Requires OEMs to provide third-party access to vehicle-generated data, making open data compliance mandatory for the EU market.
For OEMs operating internationally, aligning early with these standards is a smart move. While the 2024 Right to Repair Directive doesn’t directly target vehicles, it reflects the broader trend toward increased data access and repairability.
How automotive OEMs should prepare for the Right to Repair (Even without a federal law)
Waiting is risky. Regardless of whether the REPAIR Act becomes law, preparation is key. Waiting for final outcomes could lead to costly adjustments and missed opportunities. Here’s where to start:
1. Develop a standardized vehicle data access platform
Why: Regulations require open and transparent data-sharing for diagnostics and updates. Without a standardized platform, compliance becomes difficult.
How: Focus on building a secure platform that gives vehicle owners and independent repair shops transparent access to the necessary data.
2. Provide open access to repair information and tools
Why: Some states already require OEMs to provide critical repair information and tools at fair prices. This trend is likely to expand.
How: Start creating a centralized repository for repair manuals, diagnostic tools, and other key resources.
3. Strengthen cybersecurity without restricting repair access
Why: Protecting data is critical, but legitimate repairers need safe entry points for service.
How: Develop security protocols that protect key vehicle functions without blocking legitimate access. This means securing software updates and repair-related data while allowing repairers safe entry points for diagnostics and service.
4. Improve OTA software update capabilities
Why: Having strong OTA capabilities helps comply with future regulations requiring real-time access and updates.
How: Upgrade your current OTA systems to allow secure updates and diagnostics. Include tools authorized third parties can use for updates and software repairs.
5. Transition to modular and repairable product design
Why: Designing products for easier repair reduces costs and improves compliance.
How: Shift toward using modular components that can be replaced individually. Avoid locking parts to specific manufacturers, as some states have banned this practice. Modular designs also support longer spare part availability, which many laws will require.
6. Align supply chain and warranty systems with Right-to-Repair laws
Why: Warranty terms and parts availability are common regulatory targets.
How: Make spare parts available for several years after the sale of a vehicle. Update warranty policies to allow third-party repairs and non-OEM parts without penalty.
7. Monitor regulations and adapt quickly
Why: The regulatory landscape is evolving rapidly. Staying informed about new laws and adjusting plans early will help avoid costly last-minute changes.
How: Track new laws and build flexible systems that can easily adjust as regulations change.
How an IT enabler helps OEMs prepare for Right to Repair
Managing compliance can feel overwhelming, but it doesn’t have to disrupt operations. An IT enabler helps manufacturers build systems and processes that meet regulatory demands without adding unnecessary complexity.
Here’s how:
Turning regulations into practical solutions
Right to Repair regulations vary across states and countries. An IT enabler translates these requirements into practical tools - systems for managing access to repair data, diagnostics, and tools – to make compliance more manageable.
Building the right technology
OEMs need reliable platforms that allow repairers to access diagnostic data and tools while keeping vehicle systems secure. IT experts develop scalable solutions that work across different models and markets without compromising safety.
Balancing security and access
Access to repair data must be balanced with strong security. IT solutions help protect sensitive vehicle functions while providing authorized repairers with the necessary information.
Keeping operations simple
Compliance shouldn’t add complexity. Automating key processes and streamlining workflows lets internal teams focus on core operations rather than administrative tasks.
Long-term support
Laws and standards evolve. IT partners provide continuous updates and maintenance to keep systems aligned with the latest regulations, reducing the risk of falling behind.
Delivering custom solutions
Every manufacturer has unique needs. Whether it’s updating your warranty system for third-party repairs, improving OTA update capabilities, or adapting your supply chain for spare part availability, custom solutions help you stay compliant and competitive.
At Grape Up , we help OEMs adapt to Right to Repair regulations with practical solutions and long-term support.
We have experience working with automotive, insurance, and financial enterprises, building systems that account for differences in regulations across various states.
Preparing for changes? Contact us today.
From secure diagnostics to repair information management, we provide the expertise and tools to help you stay compliant and ready for what’s next.
Data Sharing & Monetization Platform
Databoostr - your customized solution for handling data sharing challenges
Check related articles
Read our blog and stay informed about the industry's latest trends and solutions.
EU Data Act vehicle guidance 2025: What automotive OEMs must share by September 2026
The European Commission issued definitive guidance in September 2025 clarifying which vehicle data automotive manufacturers must share under the EU Data Act.
With enforcement beginning September 2026, OEMs must provide access to raw and pre-processed vehicle data while protecting proprietary algorithms. Direct user access is free, but B2B data sharing can be monetized under reasonable compensation rules.
As the September 2026 deadline nears, the European Commission has issued comprehensive guidance that clarifies exactly which vehicle data must be shared and how. For automotive manufacturers still planning their compliance strategy, it’s now essential to understand these details.
Why this guidance matters for automotive OEMs?
EU Data Act becomes enforceable in September 2026, requiring all connected vehicle manufacturers to provide direct data access to end users and their chosen third parties. While the regulation itself established the legal framework, the Commission's guidance document - published September 12, 2025 - provides automotive specific interpretation that removes much of the ambiguity manufacturers have faced.
This is no longer just a paper exercise. If you fall short, expect:
- Heavy financial consequences
- Serious business risk and reputational damage
- Potential legal exposure across EU markets
- A competitive disadvantage as compliant competitors gain market access
For OEMs without appropriate technological infrastructure or clear understanding of these requirements, the deadline is rapidly approaching.
At Grape Up, our expert team and Databoostr platform have already helped multiple OEMs achieve compliance before the September deadline. Learn more about our solution .
What vehicle data must be shared?
The September 2025 guidance establishes clear boundaries between data that falls within and outside the Data Act's scope, resolving one of the most contested issues in implementation planning.
In-scope data: Raw and pre-processed vehicle data
Manufacturers must provide access to data that characterizes vehicle operation or status. The guidance defines two categories that must be shared:
Raw Data Examples:
- Sensor signals: wheel speed, tire pressure, brake pressure, yaw rate
- Position signals: windows, throttle, steering wheel angle
- Engine metrics: RPM, oxygen sensor readings, mass airflow
- Raw image/point cloud data from cameras and LiDAR
- CAN bus messages
- Manual command results: wiper on/off, air conditioning usage; component status: door locked/unlocked, handbrake engaged
Pre-Processed Data Examples:
- Temperature measurements (oil, coolant, engine, battery cells, outside air)
- Vehicle speed and acceleration
- Liquid levels (fuel, oil, brake fluid, windshield wiper fluid)
- GNSS-based location data
- Odometer readings
- Fuel/energy consumption rates
- Battery charge level
- Normalized tire pressure
- Brake pad wear percentage
- Time or distance to next service
- System status indicators (engine running, battery charging status) and malfunction codes and warning indicators
Bottom line is this: If the data describes real-world events or conditions captured by vehicle sensors or systems, it's in scope - even when normalized, reformatted, filtered, calibrated, or otherwise refined for use.
The guidance clarifies that basic mathematical operations don't exempt data from sharing requirements. Calculating current fuel consumption from fuel flow rate and vehicle speed still produces in-scope data that must be accessible.
Out-of-scope data: Inferred and derived information
Data excluded from mandatory sharing requirements represents entirely new insights created through complex, proprietary algorithms:
- Dynamic route optimization and planning algorithms
- Advanced driver-assistance systems outputs (object detection, trajectory predictions, risk assessment)
- Engine control algorithms optimizing performance and emissions
- Driver behavior analysis and eco-scores
- Crash severity analysis
- Predictive maintenance calculations using machine learning models
The main difference is this: The guidance emphasizes that exclusion isn't about technical complexity alone - it's about whether the data represents new information beyond describing vehicle status. Predictions of future events typically fall out of scope due to their inherent uncertainty and the proprietary algorithms required to generate them.
However, if predicted data relates to information that would otherwise be in-scope, and less sophisticated alternatives are readily available, those alternatives must be shared. For example, if a complex machine learning model predicts fuel levels, but a simpler physical fuel sensor provides similar data, the physical sensor data must be accessible.
How must data access be provided?
The Data Act takes a technology-neutral approach as of September 2025, allowing manufacturers to choose how they provide data access - whether through remote backend solutions, onboard access, or data intermediation services. However, three essential requirements apply:
1. Quality equivalence requirement
Data provided to users and third parties must match the quality available to the manufacturer itself. This means:
- Equivalent accuracy - same precision and correctness
- Equivalent completeness - no missing data points
- Equivalent reliability - same uptime and availability
- Equivalent relevance - contextually useful data
- Equivalent timeliness - real-time or near-real-time as per manufacturer's own access
The guidance clearly prohibits discrimination: data cannot be made available to independent service providers at lower quality than what manufacturers provide to their own subsidiaries, authorized dealers, or partners.
2. Ease of access requirement
The "easily available" mandate means manufacturers cannot impose:
- Undue technical barriers requiring specialized knowledge
- Prohibitive costs for end-user access
- Complex procedural hurdles
In practice: If data access requires specialized tools like proprietary OBD-II readers, manufacturers must either provide these tools at no additional cost with the vehicle or implement alternative access methods such as remote backend servers.
3. Readily available data obligation
The guidance clarifies that “readily available data” includes:
- Data manufacturers currently collect and store
- Data they “can lawfully obtain without disproportionate effort beyond a simple operation”
For OEMs implementing extended vehicle concepts where data flows to backend servers, this has significant implications. Even if certain data points aren’t currently transmitted due to bandwidth limitations, cost considerations, or perceived lack of business use-case, they may still fall within scope if retrievable through simple operations.
When assessing whether obtaining data requires “disproportionate effort,” manufacturers should consider:
- Technical complexity of data retrieval
- Cost of implementation
- Existing vehicle architecture capabilities
What are vehicle-related services under the Data Act?
The September 2025 guidance distinguishes between services requiring Data Act compliance and those that don’t.
Services requiring compliance (vehicle-related services)
Vehicle-related services require bi-directional data exchange affecting vehicle operation:
- Remote vehicle control: door locking/unlocking, engine start/stop, climate pre-conditioning, charging management
- Predictive maintenance: services displaying alerts on vehicle dashboards based on driver behavior analysis
- Cloud-based preferences: storing and applying driver settings (seat position, infotainment, temperature)
- Dynamic route optimization: using real-time vehicle data (battery level, fuel, tire pressure) to suggest routes and charging/gas stations
Services NOT requiring compliance
Traditional aftermarket services generally aren't considered related services:
- Auxiliary consulting and analytics services
- Financial and insurance services analyzing historical data
- Regular offline repair and maintenance (brake replacement, oil changes)
- Services that don't transmit commands back to the vehicle
The key distinction: services must affect vehicle functioning and involve transmitting data or commands to the vehicle to qualify as "vehicle-related services" under the Data Act.
Understanding the cost framework for data sharing
The guidance issued in September 2025 draws a clear line in the Data Act's cost structure that directly impacts business models.
Free access for end users
When vehicle owners or lessees request their own vehicle data - either directly or through third parties they've authorized - this access must be provided:
- Easily and without prohibitive costs
- Without requiring expensive specialized equipment through user-friendly interfaces or methods
Paid access for B2B partners
Under Article 9 of the Data Act, manufacturers can charge reasonable compensation for B2B data access. This applies when business partners request data, including:
- Fleet management companies
- Insurance providers
- Independent service providers
- Car rental and leasing companies
- Other commercial third parties
For context: The Commission plans to issue detailed guidelines on calculating reasonable compensation under Article 9(5), which will provide specific methodologies for determining fair pricing. This forthcoming guidance will be crucial for manufacturers developing their data plans to monetize data while ensuring compliance.
Key Limitation: These compensation rights have no bearing on other existing regulations governing automotive data access, including technical information necessary for roadworthiness testing. The Data Act's compensation framework applies specifically to the new data sharing obligations it creates.
Practical implementation considerations for September 2026
Backend architecture and extended vehicle obligations
The extended vehicle concept, where data continuously flows from vehicles to manufacturer backend servers, creates both opportunities and obligations. This architecture makes data readily available to OEMs, who must then provide equivalent access to users and third parties.
Action items:
- Audit which data points your current architecture makes readily available
- Ensure access mechanisms can deliver this data with equivalent quality to all authorized recipients
- Evaluate whether data points not currently collected could be obtained "without disproportionate effort"
Edge processing and data retrievability
Data processed "on the edge" within the vehicle and immediately deleted isn't subject to sharing requirements. However, the September 2025 guidance encourages manufacturers to consider the importance of certain data points for independent aftermarket services when deciding whether to design these data points as retrievable.
Critical data points for aftermarket services:
- Accelerometer readings
- Vehicle speed
- GNSS location
- Odometer values
Making these retrievable benefits the broader automotive ecosystem and may provide competitive advantages in partnerships.
Technology choices and flexibility
While the Data Act is technology-neutral, chosen access methods must meet quality requirements. If a particular implementation - such as requiring users to physically connect devices to OBD-II ports - results in data that is less accurate, complete, or timely than backend server access, it fails to meet the quality obligation.
Manufacturers should evaluate access methods based on:
- Data quality delivered to recipients
- Ease of use for different user types
- Cost-effectiveness of implementation
- Scalability for B2B partnerships
- Integration with existing digital infrastructure
Databoostr: Purpose-built for EU Data Act compliance
Grape Up's Databoostr platform was developed specifically to address the complex requirements of the EU Data Act. The solution combines specialized legal, process, and technological consulting with a proprietary data sharing platform designed for automotive data compliance.
Learn more about Databoostr and how it can help your organization meet EU Data Act requirements.
Addressing the EU Data Act requirements
Databoostr's architecture directly addresses the key requirements established in the Commission's guidance:
Quality Equivalence: The platform ensures data shared with end users and third parties matches the quality available to manufacturers, with built-in controls preventing discriminatory access patterns.
Ease of Access: Multiple access methods—including remote backend integration and user-friendly interfaces - eliminate technical barriers for end users while supporting sophisticated B2B integrations.
Readily Available Data Management : The platform handles both currently collected data and newly accessible data points, managing the complexity of determining what constitutes "readily available" under the guidance.
Check our case studies : EU Data Act Connected Vehicle Portal and Connected Products Data Sharing Platform
Modular architecture for compliance and monetization
Databoostr's modular design addresses both immediate compliance needs and strategic opportunities. Organizations implementing the platform for EU Data Act requirements can seamlessly activate additional modules for data monetization:
- Data catalog management for showcasing available data products
- Subscription and package sales for B2B partners
- Automatic usage calculation tracking data sharing volumes
- Billing infrastructure supporting the Article 9 reasonable compensation framework
This setup supports both compliance and revenue growth from a single platform, reducing IT complexity while meeting the guidance's technical requirements.
Comprehensive implementation methodology
The Databoostr implementation approach aligns with the guidance's requirements through:
Legal Consulting
- Analyzing regulatory requirements specific to your vehicle types
- Translating Data Act provisions into specific organizational obligations
- Interpreting the September 2025 guidance within your business context
- Creating individual implementation roadmaps
Process Consulting
- Designing compliant data sharing workflows for end users and B2B partners
- Determining which data points fall in-scope based on your architecture
- Establishing quality equivalence controls
- Planning for reasonable compensation structures
Technical Consulting
- Pre-implementation analysis of existing data infrastructure
- Solution architecture tailored to your extended vehicle implementation
- Integration planning with backend systems
- Addressing readily available data retrieval requirements
Platform Customization
- Integration with existing digital ecosystems
- Custom components for specific vehicle architectures
- Access method implementation (backend, onboard, or hybrid)
- Quality assurance mechanisms
Comprehensive Testing
- Quality equivalence validation
- Integration verification with existing IT infrastructure
- Security testing ensuring compliant data sharing
- Functional testing confirming alignment with guidance requirements
Post-implementation support
With the extended vehicle concept creating readily available data obligations, manufacturers need ongoing platform management. Databoostr provides:
- Continuous monitoring of platform operation
- Response to technical or functional issues
- Supervision of ongoing compliance with Data Act requirements
- Platform updates reflecting evolving regulatory interpretations
Timeline: What automotive OEMs should do now
Now - March 2026: Complete data inventory, classify according to guidance definitions, design technical architecture, begin platform implementation
March - July 2026: Finalize platform integration, conduct comprehensive testing, establish B2B partnership frameworks, train internal teams
July - September 2026: Run parallel systems, validate compliance, prepare documentation for regulatory authorities, establish monitoring processes
September 2026 and Beyond: Full enforcement begins, ongoing compliance monitoring, response to Commission's forthcoming compensation calculation guidelines
The path forward: Clear requirements, fixed deadline
The Commission's September 2025 guidance removes ambiguity that has delayed planning for some organizations. With regulatory requirements now precisely defined and less than eleven months until enforcement begins, manufacturers should be finalizing their compliance plans and beginning implementation.
The guidance encourages affected industry stakeholders to engage in dialogue achieving balanced implementation. The Commission also emphasizes coordination between Data Act enforcement authorities and other automotive regulators, including those overseeing type approval and data protection, to ensure smooth interplay between regulations.
For automotive manufacturers, three facts are now clear:
- The requirements are defined: The September 2025 guidance specifies exactly which data must be shared, at what quality level, and through what access methods
- The deadline is fixed: September 2026 enforcement is approaching rapidly
- The consequences are significant: Non-compliance risks financial penalties, business disruption, and competitive disadvantage
Organizations that haven't yet begun implementation should treat the Commission's guidance as a final call to action.
Interested in our services?
Reach out for tailored solutions and expert guidance.