Achieve EU Data Act readiness with ease

The EU Data Act (Regulation (EU) 2023/2854) changes who controls the data generated by connected products. From September 2025, manufacturers of IoT and connected devices have to give users access to the data their products generate, let them share it with third parties, and - in business-to-business settings - handle compensation under FRAND terms. Articles 3, 4, and 5 are the core of it: access by design, user access, and third-party sharing.

If you make connected products, this is now an engineering and legal problem at the same time. A handful of vendors have built software to handle it. Others position broad privacy or governance platforms as adjacent help. This article ranks seven of them by how directly they address the Data Act, based on product documentation, pricing pages, and published case studies reviewed in June 2026.

A note on scope before the ranking: not every tool here was built for the Data Act. Three were. The rest cover it partially, indirectly, or not at all - and we say so plainly in each entry. We’ve left out pure consent-management platforms (cookie banners, GDPR/CCPA consent) because they don’t touch the Data Act’s access and sharing obligations, which is a different problem.

The ranking at a glance

How we scored the tools

Each tool received a fit score from 0 to 10 for how well it addresses the EU Data Act specifically - not privacy or governance in general. The factors: whether the product is dedicated to the Data Act, which articles it covers, the breadth of relevant functionality, deployment model, target users, pricing transparency, and whether there are published case studies tied to the regulation.

The ranking

1. Databoostr (Grape Up) - 9.5/10

Databoostr is built specifically for the EU Data Act and covers the widest functional range of any tool reviewed. It provides a B2C portal for user data access and consent, a B2B portal for partners, and - unusually - handles the compensation and FRAND-terms side of Articles 3, 4, 5, and 9. It’s the only tool in this comparison that pairs compliance with data monetization, treating the regulation as a data-sharing capability rather than only a cost.

It is built by Grape Up, an EU-based company headquartered in Poland, so it offers EU data residency and is developed under EU jurisdiction - relevant where sovereignty is a requirement. It targets OEMs and manufacturers of connected products across automotive, home appliances, manufacturing, and material handling. Deployment is flexible: SaaS or on-premises on the customer’s own infrastructure. It also supports related regulations including Right to Repair and preparation for FIDA, and works alongside GDPR.

It’s the only tool here with published case studies tied to the Data Act: two automotive OEM deployments, one in Europe and one in Japan, covering six relevant articles.

The trade-offs: pricing isn’t public and depends on the scope of integrations and deployment, and a full rollout with integrations can take weeks to months. There may be associated consulting work on the legal, process, and technical sides.

2. Steelbridge - 8.5/10

Steelbridge, from Helsinki, Finland, is fully dedicated to the EU Data Act and offers one of the broadest module sets among the dedicated tools. It covers consent management (GDPR-aligned), a data-access API (REST and webhooks), a compliance dashboard with audit logs, emergency data access for public bodies under Article 15, trade-secret protection, and - like Databoostr - a billing and monetization layer that turns third-party access into a revenue stream rather than only a cost. There is also a white-label option for OEMs and resellers.

It is one of only two tools here with fully public pricing: EUR 250, 500, or 750 per month, billed monthly with cancel-anytime terms, plus optional onboarding at EUR 1,500 and custom enterprise/white-label tiers. It targets IoT manufacturers, industrial machinery makers, energy companies, and mobility providers, quotes go-live in roughly 6–8 weeks, and - being based in Finland - offers EU data residency. It has also received innovation funding from Business Finland.

It lands neck-and-neck with Data Act Kit (both 8.5): Steelbridge edges ahead on breadth of modules and the white-label option, Data Act Kit on raw speed of integration. The shared limitation is maturity - Steelbridge is an early-stage company with no published customer case studies yet, so the product and pricing are well developed but the market track record isn’t there.

3. Data Act Kit - 8.5/10

Data Act Kit, built in Germany, is the fastest route to compliance among the dedicated tools. It’s a “plug-and-play” set of APIs plus a white-label portal: one API connects to your backend, and the kit handles real-time data distribution to an unlimited number of third parties. It covers Articles 4 and 5 - user and third-party access.

It’s also one of only two tools in this comparison with public pricing. The Standard plan is EUR 690 per month for the full feature set, with an Enterprise tier above it. There’s a 21-day full-access trial with no card required, and onboarding and implementation support are included. Because there’s no infrastructure to build, integration runs in days to weeks.

The main limitation is vendor maturity. It’s a young, very small operation with no published case studies yet. For teams that need a fast, narrow path to Articles 4 and 5 and can accept a small vendor, it’s a strong option.

4. EU Data Act Software - 8/10

This Danish product is dedicated to the EU Data Act and states its coverage of Articles 3, 4, and 5 explicitly. It provides a data-request portal for both users and third parties, request handling, and governance rules. Hosting is in the EU with multiple options, and the architecture is multi-tenant, aimed at everyone from small IoT firms to large enterprises.

It’s a sensible choice where EU data residency and sovereignty matter, given EU-only hosting and GDPR rules built into governance. There’s a free trial and a demo.

What’s missing is public proof. There’s no published pricing (you request a quote), no case studies yet, and the company is young with a limited public track record. It runs a partner program for advisors.

5. Stream Analyze (SA Data Broker) - 6.5/10

Stream Analyze, from Sweden, is primarily an Edge AI and streaming-analytics platform, with a dedicated Data Broker module for the Data Act layered on top. The core technology is genuinely strong: an on-device agent with an engine as small as 17 kB, paired with a Data Broker that runs in the cloud or on-premises. It addresses Article 3 (access by design), 4, and 5 (porting and streaming), and is unusual in starting from the device rather than the cloud.

It fits industrial settings - transport, manufacturing, energy, mobile machinery - where data originates on the device and low footprint matters. Stream Analyze has published case studies, but they’re about Edge AI (for example, failure prediction for mining loaders), not the EU Data Act.

The reason it sits mid-table: the EU Data Act is a side product relative to the Edge AI core, there are no EU Data Act-specific case studies, pricing is by individual quote, and deployment requires access to device firmware and software, which lengthens rollout to weeks or months.

6. BigID - 5/10

BigID (US/Israel) is a broad data security, privacy, and AI-governance platform - DSPM at its core - rather than a Data Act tool. Its strength as a foundation is data discovery and classification across IoT, SaaS, and structured and unstructured sources, which is genuinely useful groundwork for the access and transparency the regulation requires. It addresses Data Act concerns indirectly: portability, processing transparency, FRAND-adjacent governance.

It’s aimed at large enterprises and regulated sectors, and supports a long list of other regulations: GDPR, CCPA, the EU AI Act, data sovereignty, and more.

But there’s no dedicated Data Act module - the positioning lives in a blog post about the regulation going live, not a product. Pricing is enterprise-scale: typically USD 15,000 to 175,000 per year, with large deployments much higher (one public figure reaches USD 698,000). Rollout is a multi-week-to-month enterprise project, and addressing the Data Act through governance modules adds complexity..

7. OneTrust - 4/10

OneTrust (US) is the broadest compliance platform in the comparison - consent and preferences, privacy automation (DSAR), data-use governance, and AI governance, supporting GDPR, the EU AI Act, SOC 2, and hundreds of regulations. With 14,000+ customers, it’s also the most established vendor here.

For the Data Act specifically, though, there’s no product or module - only educational blog content. The relevant capabilities (consent, access requests, governance) touch the regulation indirectly at best. Pricing starts around USD 10,000 per year (as of Q2 2026), with a median near USD 11,500; implementation fees typically run 20-40% of the annual subscription, and time to deploy is commonly 3-6 months. There are no Data Act case studies, only the educational material. Strong privacy and GRC platform; not an EU Data Act solution.

What these tools have in common - and where they diverge

The four dedicated tools (Databoostr, Steelbridge, Data Act Kit, EU Data Act Software) share a functional core: a data-request portal, consent and access management, and third-party sharing aligned to Articles 3-5. The broader platforms (BigID, OneTrust) come at it from the other direction - they grew out of GDPR/CCPA privacy and governance, and treat the Data Act as one more regulation among many rather than a built-for-purpose product.

Dedication. Fully dedicated: Databoostr, Steelbridge, Data Act Kit, EU Data Act Software. Dedicated module: Stream Analyze. Indirect via governance: BigID, OneTrust.

Architecture starting point. From the device (edge agent): Stream Analyze. From the cloud or API: the dedicated tools and the platforms.

Pricing transparency. Public pricing: Data Act Kit (EUR 690/month) and Steelbridge (EUR 250–750/month) among the serious Data Act options. Everyone else quotes individually.

Time to compliance. Fastest: Data Act Kit (one API, days to weeks), with Steelbridge close behind (about 6–8 weeks). Slower: tools requiring device-level integration or enterprise rollouts (Stream Analyze, BigID, OneTrust, at 3–6 months for the platforms).

Data monetization. Two tools build billing for third-party access into the product, turning compliance into a possible revenue stream: Databoostr and Steelbridge.

Market evidence. Data Act case studies exist for only one tool: Databoostr (two automotive OEMs). Others have case studies in adjacent domains, or - like Steelbridge - only illustrative examples, but nothing tied to the regulation.

Data residency. EU-based options: Databoostr (Grape Up, Poland), Steelbridge (Finland), EU Data Act Software (Denmark, EU hosting), and Data Act Kit (Germany) lead here, which matters where sovereignty is a requirement.

How to choose

If you need the widest functional coverage and want to treat data sharing as a capability rather than only a compliance cost, Databoostr covers the most ground and is the only option with Data Act case studies behind it. If you want broad module coverage with transparent pricing and a monetization layer, Steelbridge is the closest alternative. If your priority is the fastest, cheapest path to Articles 4 and 5 and you can work with a small vendor, Data Act Kit is the most direct. If EU data residency is non-negotiable, EU Data Act Software is built around it (and Steelbridge, Databoostr, and Data Act Kit are also EU-based). If your data lives on industrial edge devices, Stream Analyze’s architecture is the natural fit. And if you already run BigID or OneTrust for privacy and governance, they can support parts of the work - but you’ll be assembling compliance from general-purpose modules rather than buying a Data Act product.

The honest summary: four tools were built for this regulation, and they should be the starting point for most connected-product manufacturers. The broad platforms are worth considering only if you already own them and want to extend what you have.

Frequently asked questions

What does the EU Data Act require from manufacturers of connected products?

From September 2025, makers of IoT and connected devices must give users access to the data their products generate (Article 4), let users share that data with third parties (Article 5), and design products so the data is accessible in the first place (Article 3, access by design). In business-to-business settings, data sharing has to happen on fair, reasonable, and non-discriminatory (FRAND) terms, which can include compensation (Article 9).

Which tools are dedicated to the EU Data Act?

Four of the seven reviewed are built specifically for the Data Act: Databoostr (Grape Up, an EU-based company from Poland), Steelbridge (Finland), Data Act Kit, and EU Data Act Software. Stream Analyze offers a dedicated Data Broker module on top of an Edge AI core. BigID and OneTrust address the regulation only indirectly through general privacy and governance features.

Which EU Data Act tool is the fastest and cheapest to deploy?

Data Act Kit is the fastest dedicated route: a single API plus a white-label portal, integration in days to weeks, public pricing at EUR 690 per month, and a 21-day free trial. It covers Articles 4 and 5. Steelbridge is the other publicly priced option (EUR 250–750 per month) and goes live in about 6–8 weeks with a broader module set. The shared trade-off is vendor maturity - both are young, with no published case studies yet.

Which EU Data Act tool has the widest coverage?

Databoostr covers the most ground in this comparison: B2C and B2B portals, consent and access management, and the compensation/FRAND side of Articles 3, 4, 5, and 9. It is also the only reviewed tool with published case studies tied to the Data Act (two automotive OEM deployments). Pricing is by individual quote, and a full rollout can take weeks to months.

Do privacy platforms like OneTrust or BigID cover the EU Data Act?

Not directly. Both are strong privacy, security, and governance platforms (GDPR, CCPA, the EU AI Act, and more), and their data discovery, consent, and governance features can support parts of Data Act work. But neither has a dedicated Data Act product or module - OneTrust offers only educational content, and BigID positions through a blog post. Neither has Data Act-specific case studies.

Which tools support EU data residency?

Databoostr (Grape Up) is an EU-based company headquartered in Poland and offers EU data residency. Steelbridge (Finland), EU Data Act Software (Denmark, EU hosting with GDPR rules built into governance), and Data Act Kit (Germany) are also EU-based. These are the strongest fits where data sovereignty is a hard requirement.

‍

‍

The EU Data Act became applicable on September 12, 2025. For manufacturers of connected home appliances‚ washing machines, dishwashers, heat pumps, ovens, air purifiers‚ this is not a future-state regulation. It is current law. Under the Act, any product that generates data must give users access to that data. It must allow them to share it with third parties‚ including competing service providers and independent repair workshops‚ on demand. Manufacturers who cannot fulfill those obligations face enforcement action, fines, and reputational risk. Most companies understand what the law requires in theory. The hard part is the operational reality: Who owns the data pipeline? How do you grant access without exposing your entire data architecture? How do you handle consent, revoke access, and price data for commercial partners, all without building a custom platform from scratch? Databoostr is a data sharing and monetization platform built specifically for manufacturers of connected products. This article breaks down what the EU Data Act demands from home appliance makers and shows‚ concretely, based on a working product demo‚ how Databoostr addresses each requirement.

Section 1: What does the EU Data Act actually change for home appliance manufacturers?

What is the EU Data Act?

The EU Data Act (Regulation (EU) 2023/2854) is a horizontal regulation governing who can access and use data generated by connected products and related services. It applies across sectors, but its most direct impact falls on manufacturers of IoT-connected hardware‚ including home appliances.

The EU Data Act requires that data generated by connected products must be accessible to users by default, shareable with third parties upon user request, and handled under clear, enforceable data access rules.

The regulation is now in force. The full text is available here.

Key obligations for home appliance manufacturers

1. Data accessibility by design. Products must be designed so that users can access the data they generate. If your connected washing machine logs cycle data, energy consumption, or fault codes, that data belongs to the user‚ and must be retrievable.
2. Third-party data sharing upon request. Users must be able to direct manufacturers to share their product data with any third party they choose. This includes insurance companies, energy management platforms, and independent repair workshops‚ not just OEM-approved service partners.
3. Non-discriminatory access.Third parties receiving data under user consent must receive it under fair, reasonable, and non-discriminatory (FRAND) conditions. Manufacturers cannot give their own affiliates preferential data access.
4. Portability and standardization. Data must be provided in a machine-readable format. For companies without a structured data catalog or API layer, this is a significant technical build.
5. Right to repair implications. One of the most consequential elements for home appliances: users can share diagnostic and usage data with any repair service, not just the manufacturer's network. This breaks a longstanding lock-in mechanism.

What happens if you don't comply?

The Data Act leaves enforcement to each Member State’s national authority. A single incident could trigger parallel investigations in multiple countries with materially different fine structures -Germany’s draft rules and Malta’s legislation already diverge significantly.

Section 2: The operational challenges behind EU Data Act compliance for home appliances

What are the biggest compliance gaps for connected product manufacturers?

Understanding the regulation is step one. Building the infrastructure to comply‚ at scale, for millions of devices, across multiple markets‚ is where most organizations run into trouble.

"We have the data, but not the access layer"

Most home appliance manufacturers collect product data. The challenge is not generation, it is structured, secure, and auditable exposure. Existing data lakes and telemetry pipelines were not built to handle consent-gated, per-device, per-user, per-third-party data access. Retrofitting them is expensive and slow.

Key pain points:

- No unified data catalog mapping datasets to device types

- No consent management layer tied to the data pipeline

- No audit log for who accessed what data, and when

"We need to demonstrate it, not just do it"

Compliance is not self-certifying. Supervisory authorities will ask for evidence: records of consent, logs of data transfers, documented data retention policies. Without a system that generates these records automatically, compliance becomes a manual, fragile process dependent on spreadsheets and email chains.

Key pain points:

- No centralized record of user data sharing approvals and revocations

- No automated trail for third-party access requests

- No mechanism to enforce FRAND conditions at the data-transfer level

"We can't build this and also ship product features"

For product teams, the EU Data Act is a platform requirement dropped into an already full roadmap. Building a compliant data sharing portal, with user-facing consent flows, partner onboarding, API access, and an admin panel‚ is a multi-quarter engineering project. Most product organizations do not have that bandwidth.

Key pain points:

- Consumer-facing data portals require significant UX investment

- Partner onboarding and access management is operationally complex

- Pricing and monetization of data access has no existing infrastructure

Section 3: How Databoostr Addresses EU Data Act Compliance for Home Appliances

Databoostr is a data sharing and monetization platform designed specifically for manufacturers of connected products. Here is how the platform maps to the compliance requirements outlined above.

What does Databoostr actually do?

Databoostr helps manufacturers turn product usage data into a secure, reliable, compliant data stream while meeting EU Data Act obligations‚ without requiring manufacturers to build the infrastructure themselves.

The system is divided into two portals:  B2C portal for device owners and B2B portal for commercial data partners.

B2C Portal: User-facing data access and consent management

The customer portal gives device owners a real-time view of all their connected appliances‚ including serial numbers, registration data, and device type. Users can:

- Request their own data by selecting a device, choosing a dataset (e.g., accessories data, performance diagnostics, usage metrics), and specifying a data period. This directly satisfies the data accessibility obligation under Article 4 of the EU Data Act.

- Manage third-party access - when a partner‚ an insurer, an energy platform, a repair service‚ requests access to a user's device data, the user sees the request here and can approve or revoke it with a single action.

- Share data manually to any third party of their choosing, not just pre-registered partners. This satisfies the right-to-repair sharing requirement: a user can send diagnostic data to an independent workshop without going through the manufacturer's service network.

The data catalog within the B2C portal shows users exactly which signals their device generates, what datasets are available, the retention period, and average daily data volume. This level of transparency is foundational to the EU Data Act's informed-consent model.

B2B Portal: Partner access, data streaming, and transaction management

For commercial data users‚ insurers, energy companies, maintenance providers, the B2B portal handles the full lifecycle of data access requests.

Partners can:

- Import device lists in bulk via CSV or XLSX, enabling them to request access across large customer fleets without manual entry.

- Track request status across pending, approved, and expired requests from a single dashboard.

- Access real-time data via streaming connectors, configurable per device type and per dataset. This is critical for partners who need live telemetry, fault monitoring, energy consumption tracking, predictive maintenance signals.

The transaction summary layer records price per data catalog, per partner, per month. Pricing is configured in the admin panel and can differ by partner type‚ enabling manufacturers to apply FRAND pricing at the system level, not as a manual agreement process.

Admin Panel: System-level governance

The admin panel gives the manufacturer's internal teams control over:

- Partner registration and management

- Data catalog configuration (datasets, signals, retention policies)

- Pricing per catalog and per partner category

- Operational monitoring and support dashboards

Section 4: What you gain from Databoostr?

For Heads of Data

- Structured data catalog mapped to device types and signal categories, with retention periods and volume metrics built in

- Consent-gated data pipeline ‚no direct exposure of raw data infrastructure to external parties

- Real-time streaming connectors for partners who require live telemetry, configurable per device type and dataset

- Audit trail of all data transfers, timestamps, and access statuses

For Heads of Compliance

- Automated consent records ‚every user approval and revocation is logged with a timestamp

- Third-party access management that enforces the FRAND principle through configurable, catalog-level pricing

- Built-in EU Data Act guidelines surfaced in the user-facing portal, supporting informed consent

- Revocation capability ‚users can withdraw third-party access at any time, and the system enforces it immediately

For Heads of Product

- Ready-to-deploy B2C portal ‚no internal engineering required for user-facing data access flows

- Partner onboarding handled at the platform level ‚B2B registration, request management, and access control are out of the box

- Monetization infrastructure ‚pricing per data catalog and partner type is configured in the admin panel, not coded per integration

- Configurable content ‚FAQ sections, data act guidance, and additional tabs can be updated without a code release

Summary: EU Data Act compliance is an infrastructure problem

The EU Data Act for home appliances is not a policy document that legal teams can simply sign off on. It requires a functioning system: consent management, data access portals, partner onboarding, audit logging, and pricing governance‚ all tied together and operational at scale.

Most home appliance manufacturers are not in the business of building data platforms. Databoostr exists to close that gap‚ providing the infrastructure layer so that manufacturers can meet their EU Data Act obligations without diverting product engineering resources to compliance plumbing.

If you are evaluating how to make your connected product portfolio compliant, or if you are already past the deadline and need to move quickly, Databoostr offers a product demo tailored to home appliance use cases.

Request a demo to see how Databoostr maps to your specific compliance requirements.

FAQ

What is the EU Data Act and when does it apply?

The EU Data Act (Regulation (EU) 2023/2854) is an EU regulation that governs access to and use of data generated by connected products and related services. It became applicable on September 12, 2025, and applies to all manufacturers placing connected products on the EU market.

Which home appliances are covered by the EU Data Act?

Any connected product that generates data by virtue of its use is covered. This includes smart washing machines, dishwashers, ovens, heat pumps, air purifiers, refrigerators, and any other IoT-enabled home appliance sold in the EU.

What are the key data sharing obligations for home appliance manufacturers?

Manufacturers must make product-generated data accessible to users, allow users to share that data with third parties upon request, apply FRAND (fair, reasonable, and non-discriminatory) conditions to third-party data access, and provide data in a machine-readable format.

How does Databoostr help manufacturers comply with the EU Data Act?

Databoostr provides a ready-to-deploy data sharing platform with a user-facing B2C portal for consent management and data access, a B2B portal for commercial partner access, real-time data streaming connectors, and an admin panel for pricing, catalog management, and audit logging ‚all aligned with EU Data Act requirements.

Can third-party repair workshops access appliance data under the EU Data Act?

Yes. The EU Data Act includes provisions that support the right to repair: users can direct manufacturers to share diagnostic and usage data with any third-party repair service, not just OEM-approved workshops. Databoostr supports this flow through its manual data sharing feature in the B2C portal.

‍

Key facts

Why wasn't product data access designed for regulated sharing?

In industrial manufacturing, the Data Act obligation applies to data generated by the use of the product-telemetry, logs, performance metrics, or error events produced by an industrial robot operating in      a customer's plant.

In practice, this data is handled through the product's own technical stack: controllers, gateways, edge collectors, embedded software, OEM applications, and sometimes manufacturer-operated cloud or service platforms. These components are designed to operate the product, support maintenance, and enable value-added services-not to serve as regulated access points for external data consumers.

According to Latham &Watkins, "The EU Data Act is the most significant overhaul of European data law since the GDPR, with its impact being more disruptive than the EU AIAct." The regulation introduces a fundamentally different access paradigm: data access becomes externally initiated, user-directed, and subject to legal and contractual constraints.

Requests may be episodic or continuous, may involve third parties, and must be handled consistently across products, customers, and jurisdictions. Product runtime and service systems are simply not designed to absorb external variability, enforce regulatory access logic, or act as governed interfaces to broader data ecosystems.

How to decouple data sharing from product systems?

A dedicated Data Act enablementlayer reframes the problem entirely. It introduces a buffered, governedboundary between product-generated data and external data consumers.

Product data is collected, normalized, and exposed through this layer-not directly from controllers, gateways, or operational service components. External users never interact with the product runtime itself. They interact with a controlled access surface that enforces policy, security, scope, and contractual constraints by design.

As Gibson Dunn notes, "TheData Act will touch companies of all sizes in almost every sector of theEuropean economy, including manufacturers of smart consumer devices, cars, connected industrial machinery, smart fridges and other home appliances."

This decoupling allows manufacturers to evolve compliance logic independently from product software and service architectures, protecting both product integrity and regulatory readiness.

Why does scalable compliance benefit from robust data access infrastructure?

The Data Act does not create a single access event. It creates a continuous expectation of availability. Users and third parties may request data at different times, at different scales, and for different purposes.

Meeting these obligations at scale requires robust data access infrastructure as a regulatory capability-not just a developer convenience.

Rate limiting, throttling, monitoring, and fair-access enforcement are essential controls for meeting obligations without destabilizing product or service operations. By centralizing these mechanisms, a dedicated enablement layer allows manufacturers to respond predictably to demand without redesigning product integrations for each new request.

What access models does industrial data sharing require?

Industrial data sharing spansdistinct interaction models:

A dedicated data access layer supports both models cleanly-enabling controlled, request-based access where appropriate and governed event-based distribution where justified-while insulating product operation from variability.

Why do manual compliance solutions fail at scale?

Many manufacturers initially respond to Data Act requests using familiar mechanisms: spreadsheet exports, manual data pulls, or custom APIs built for specific customers. These approaches may work in isolation, but they do not survive repetition.

Each manual exception introduces inconsistency, draws engineering teams into compliance activities, and weakens auditability.

Critically, the Data Act is not an isolated requirement. Manufacturers are already facing-or will soon face-additional, structurally similar obligations:

Treating each obligation as a separate exception multiplies complexity. Only standardized, repeatable, and automated mechanisms can support this shift without turning compliance into a permanent operational bottleneck.

How to move beyond product-by-product compliance?

Without a shared enablement layer, Data Act logic is implemented repeatedly-product by product, customer by customer, and integration by integration. This fragments behavior across the product portfolio and makes governance increasingly difficult.

A centralized approach allows manufacturers to implement Data Act rules once and apply them consistently across product lines, deployments, and markets.

Compliance becomes an architectural capability rather than a feature of individual products.

How to enable compliance without compromising product operation?

The most important requirement remains unchanged: compliance must not interfere with how products operate inthe field. Industrial products cannot absorb regulatory experimentation or unstable access patterns.

By decoupling regulated data sharing from product runtime and service systems, manufacturers can meet DataAct obligations while preserving safety, reliability, and performance. A dedicated enablement layer acts as a governed interface between product-generated data and the outside world.

What's at stake: from tactical fixes to architectural readiness

The EU Data Act is not temporary. Expectations around product data access will continue to grow as industrial data ecosystems mature.

The European Commission projects the EU data economy will reach €743–908 billion by 2030, up from €630 billion in 2025. Manufacturers that invest in a dedicated Data Act enablement layer gain predictable compliance, scalable data sharing, and long-term architectural resilience.

Those that rely on tactical fixes will find that each new request increases cost, complexity, and operational risk.

Frequently Asked Questions

When does the EU Data Act come into effect?

The EU Data Act became enforceable on September 12, 2025. Companies selling connected products in theEU must be compliant by this date. Design requirements for new products apply from September 12, 2026.

What data must manufacturers share under the Data Act?

Manufacturers must provide access to data generated by the use of connected products, including telemetry, logs, performance metrics, sensor readings, and error events. This applies to both personal and non-personal data that is "readily available"without disproportionate effort.

What are the penalties for non-compliance?

Penalties can reach up to €20million or 4% of global annual turnover, whichever is higher. This mirrors theGDPR penalty structure. Additionally, the Data Act allows for collective civil lawsuits similar to US class actions.

Does the Data Act apply to B2B products?

Yes. The regulation applies to all connected products sold in the EU, regardless of whether customers are consumers or businesses. Industrial machinery, manufacturing equipment, and B2BIoT devices are all in scope.

Does the Data Act require a specific technical architecture?

No. The Data Act specifies what out comes must be achieved... A dedicated data access layer is one architectural approach that can help meet these requirements, but it is not mandated by the regulation itself.

How is the Data Act different from GDPR?

GDPR focuses on personal data protection and minimization. The Data Act focuses on access rights to product-generated data, including non-personal industrial data. Both regulations can apply simultaneously-where personal data is involved, GDPR requirements also apply.

What is a Digital Product Passport and how does it relate to the Data Act?

Digital Product Passports(DPPs) are digital records containing product lifecycle data, materials, and sustainability information. Starting February 2027 for batteries and expanding to other product categories, DPPs represent a parallel data-sharing obligation that will benefit from the same architectural approach as Data Act compliance.