Saturday's Data Act obligation covers the machines you have not bought yet

What starts on Saturday and what does not

On 12 September 2026 a single obligation of Regulation (EU) 2023/2854, the Data Act, starts to apply. It is Article 3(1). It requires connected products to be designed and manufactured so that the data generated by their use, together with the metadata needed to interpret it, is by default accessible to the user easily, securely, free of charge and in a machine-readable format.

Article 50 draws the boundary in one line. The obligation resulting from Article 3(1) applies to connected products and related services placed on the market after 12 September 2026. There is no retroactivity of any kind. The forklift with the SIM card, the machine tool hooked to the manufacturer's portal, the packaging line with telemetry: everything already sold stays designed as it was.

One part of the rule only becomes clear when you try to use it. Machine-readable means an endpoint or a structured file, not a web dashboard with charts. What a manufacturer offers today, when you ask for the data of a production line to feed an automation, is a CSV export on request or a portal with no API documentation. From Saturday that answer is no longer enough — but only on new machines.

The obligation that kicked in a year ago

The rest of the regulation was not waiting for 2026. The same Article 50 establishes that the Data Act applies from 12 September 2025. Inside Chapter II sits the provision that first touches anyone who already has connected plants on the factory floor.

A data holder shall use any readily available data that is non-personal data only on the basis of a contract with the user.

That is Article 4(13). It goes on to prohibit the manufacturer from using that data to derive insights about the user's economic situation, assets or production methods. Paragraph 14 adds that non-personal product data must not be made available to third parties for purposes other than performing the contract with the user.

Brought into everyday work it means this. A manufacturer that has been collecting cycles, alarms and downtime from machines installed at its customers' sites in order to train its own predictive maintenance model, and then sell that service back to the whole fleet, has needed a contract with each customer allowing it for the past twelve months. Not a privacy notice, which covers personal data and not machine data. A contract. I look for the word data in the service contracts that come across my desk and almost always end up on a generic licence that states no purpose, or on nothing at all.

In the opposite direction, Article 5 gives the user the right to have that data sent to a third party of their choosing. An independent workshop, a software provider, a consultant who has to build a model on machine downtime. It is the provision that makes enforceable what until yesterday was negotiated case by case, and it is also the one the manufacturer has the strongest interest in slowing down.

Trade secrets are the switch

Summaries of the Data Act tend to lose the part that decides how this ends. Article 4 devotes three paragraphs to trade secrets. Paragraph 6 requires protected data to be identified as such both in the data and in the metadata, with confidentiality measures agreed between manufacturer and user. Paragraph 7 allows the data holder to withhold or suspend the sharing if those measures are not agreed or not implemented. Paragraph 8 allows it, in exceptional circumstances and by demonstrating the likelihood of serious economic damage, to refuse an access request outright.

These are valves written inside the very article that grants the right. Read in sequence, they tell you that accessibility by design matters less than the clause. A manufacturer that wants to hold on to the data does not need to breach the regulation: it is enough to mark most of the telemetry as a trade secret and fail to reach an agreement on the measures. That is why, if the choice is between waiting for the compliant models of 2027 and negotiating now the list of data and the confidentiality measures for the plant you are about to buy, the second road is more useful than the first. The date of placing on the market is decided by the supplier; the wording of the contract is not.

Who gets the notification, in Italy

When the manufacturer refuses or suspends, Article 4 requires it to justify that in writing to the user and to notify the competent authority designated under Article 37. Article 40 required Member States to lay down penalties and to notify them to the Commission by 12 September 2025, with the Commission required to maintain an easily accessible public register of those measures.

Looking for the Italian act designating the competent authority for the Data Act, I could not find it published. The public register of notified measures is not accessible where the regulation says it should be. There is a documented precedent for how these things go. On 23 May 2024 the Commission sent a letter of formal notice to eighteen Member States that had not designated the authorities responsible under the Data Governance Act, the twin regulation on data sharing. Italy was among them, procedure INFR(2024)2062. European law applies directly all the same. A customer who wants their data can enforce it before an ordinary court. Except that you go before a court holding a contract, not a calendar date.

One last detail remains, and it overturns a good part of what comes above. Article 7(1) excludes from the Chapter II obligations the data generated by the use of connected products manufactured or designed by a micro or small enterprise. The same exclusion applies to a company that has been a medium enterprise for less than a year, and to products in their first year after being placed on the market. In Italian mechanical engineering, special-purpose machines often come out of workshops of a few dozen people. The access right that starts on Saturday therefore also depends on how many people work at the company that sold you the plant — a number no purchasing specification ever asks for.