EU Data Act & IoT 2026: What Makers of Connected Products Must Do by September

WZ-IT operates thingshost. Current hosting starts from €159.80 net/month; setup and service level follow the proposal. Former package prices, location lists and cost comparisons in this dated article describe the previous offer, not current WZ-IT terms. View current service scope.

The EU Data Act is the most consequential data regulation since the GDPR — and for makers of connected products, a concrete date is approaching: from 12 September 2026, newly placed connected products must be designed so that the data they generate is accessible by default — "by design and by default." Anyone building sensors, machines, vehicles, or smart-building technology must now treat data access as an architecture decision, not a later feature. This article explains what the Data Act requires, which deadlines apply, and which technical building blocks a sovereign IoT platform can contribute.

Note: This article is a technical and organizational framing based on official EU sources — not legal advice. For the legal assessment of your specific product and contracts, please consult qualified legal counsel.

Also worth reading: ThingsBoard vs. AWS IoT Core: Open Source vs. Amazon Cloud · ThingsBoard Hosting: Cloud vs. Self-Hosted vs. Managed

Table of Contents

• What the EU Data Act Is — In One Paragraph
• The Deadlines: Why "September 2026" Is the Relevant Date
• Scope: What Counts as a "Connected Product"?
• The Core Obligations for Manufacturers and Data Holders
  • 1. Data Access "By Design and By Default" (Article 3)
  • 2. Pre-Contractual Transparency
  • 3. The User's Right of Access (Article 4)
  • 4. Right to Share With Third Parties (Article 5)
  • 5. Switching & Interoperability (Chapter VI)
• Sanctions: What Violations Risk
• Where an IoT Platform Helps Technically — and Where It Doesn't
• Data Sovereignty and the Data Act: Two Sides of One Coin
• A Practical Checklist Through September 2026
• thingshost: Managed ThingsBoard With Data Sovereignty
• Conclusion
• Sources

What the EU Data Act Is — In One Paragraph

The EU Data Act (Regulation (EU) 2023/2854) is a cross-sectoral regulation governing who may access the data that connected products and related services generate. Its goal is a fairer data economy: users should be able to access the data they co-generate by using their devices and pass that data to third parties — while manufacturers retain incentives to invest. The Data Act complements the GDPR (it does not replace it) and also applies where non-personal machine data is concerned — an area the GDPR does not cover at all [1][2].

The Deadlines: Why "September 2026" Is the Relevant Date

This is where the most common confusion arises. The Data Act has several dates:

So the regulation has applied since 12 September 2025 [1][2]. But the most consequential date for product makers is 12 September 2026: from then on, every connected product newly placed on the EU market must meet the design obligation in Article 3(1) [3][4]. In other words, products first sold, rented, or leased after that date must already have data access built in. For devices with long development cycles — industrial machines, vehicles, medical technology — this is practically a now topic, not a September one.

Scope: What Counts as a "Connected Product"?

The Data Act is deliberately broad. A connected product is an item that obtains, generates, or collects data about its use or environment and can communicate that data over a service or a physical interface. The European Commission explicitly spans devices "ranging from smartphones and smart household appliances to intelligent industrial machines" [2]. Typical real-world examples:

• Industry & manufacturing: connected machines, PLCs, production-line sensors (Industry 4.0)
• Energy: wind turbines, PV inverters, smart-meter gateways
• Mobility: connected vehicles, telematics, charging infrastructure
• Smart building: HVAC systems, meters, access control and building management
• Medical & agriculture: connected devices, sensors, machines

Crucially, the obligation applies to manufacturers regardless of where they are established — as soon as the product enters the EU market, the Data Act applies [3]. A US or Asian manufacturer is just as affected as a European one.

The Core Obligations for Manufacturers and Data Holders

1. Data Access "By Design and By Default" (Article 3)

The central obligation: connected products must be designed and manufactured, and related services designed, so that the product and related service data — including the metadata needed to interpret it — are accessible by default in an easy, secure, free, comprehensive, structured, commonly used, and machine-readable format; where relevant and technically feasible, directly from the device [3][4]. Data access is thus an architecture requirement. Anyone storing telemetry today in proprietary formats with no export path must rebuild.

2. Pre-Contractual Transparency

Already before the sale, rental, or lease contract, manufacturers and sellers must clearly inform users — among other things about the type and volume of data generated, the collection frequency, whether the data is produced continuously and in real time, how the user accesses it, and how they can request access or lodge a complaint [5][6].

3. The User's Right of Access (Article 4)

Where data is not directly accessible from the product, the data holder must make it available to the user on request — free of charge, in a comprehensive, structured, commonly used, and machine-readable format, and, where feasible, continuously and in real time [3][5].

4. Right to Share With Third Parties (Article 5)

Upon the user's request, the data holder must transmit the data to a third party of the user's choice — on the same technical terms as for the user [3][5]. The Commission's famous example: the operator of a wind turbine can instruct the manufacturer to hand usage data to an independent maintenance provider of its choice [2].

5. Switching & Interoperability (Chapter VI)

The Data Act also addresses switching between data-processing services (cloud switching): providers must enable switching, remove obstacles, and — from 12 January 2027 — drop switching charges [1][2]. For IoT architectures this means vendor lock-in becomes not only commercially expensive but regulatorily undesirable.

Sanctions: What Violations Risk

The Data Act leaves the concrete design of sanctions to the Member States. Article 40 requires them to be "effective, proportionate and dissuasive" and lists six assessment criteria — including the nature, gravity, and duration of the infringement and the offender's EU annual turnover [7]. Two levels matter:

• GDPR level: if an infringement of Chapters II, III, or V concerns personal data, data protection authorities can impose fines under Article 83 GDPR — up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher [7][8].
• National level (Germany): the Data Act Implementation Act (DADG) was adopted by the Bundestag on 26 March 2026; the Bundesrat raised no objection on 8 May 2026 [9]. The competent authority is the Bundesnetzagentur; for personal data, the BfDI is also involved [9][10]. For Data Act infringements within the BNetzA's remit, § 15 DADG provides for fines up to EUR 500,000 [10][11].

In sum: the direct Data Act fines in Germany are more moderate than GDPR sanctions — but once personal data is involved, the full GDPR framework applies.

Where an IoT Platform Helps Technically — and Where It Doesn't

To be honest up front: an IoT platform does not produce legal compliance. The question of which data is shared with whom on what legal basis is not answered by a software feature. What a platform delivers are the technical building blocks with which the operational requirements of Articles 3 to 5 can be met: structured storage, machine-readable export, programmatic access.

ThingsBoard — the open-source IoT platform under Apache 2.0 — brings useful properties here:

The underlying time-series data sits in PostgreSQL/TimescaleDB or Cassandra, depending on volume — in open, exportable databases [13]. The choice of operating model (self-hosted, cloud, or managed) does not change this: the data stays in a structured, retrievable format.

Data Sovereignty and the Data Act: Two Sides of One Coin

The Data Act is not only an obligation — it is also an argument for data sovereignty. Anyone who takes the requirements for data access, data sharing, and provider switching seriously inevitably arrives at two questions: Is my data in an open, exportable format? And: Do I have the autonomy to switch providers?

Here the Data Act and the sovereignty argument reinforce each other:

• Open formats instead of a black box. Article 3 requires structured, machine-readable data. An open-source platform with documented APIs delivers that out of the box — unlike a proprietary cloud IoT stack from which a complete export is often laborious.
• Switching instead of lock-in. Chapter VI aims at easy switching. An Apache 2.0 platform can be moved to new infrastructure via backup — days instead of years. How painful the reverse can be shows in the forced migration when a US provider deprecates a service: for example, the end of support for AWS IoT Events.
• Hosting location & the CLOUD Act. If IoT data is processed by a US provider, the structural conflict with the US CLOUD Act remains — regardless of storage location. European, sovereign hosting takes that uncertainty out of the equation and simplifies the GDPR assessment that the Data Act explicitly carries along for personal data [7].

So data sovereignty does not replace a legal review — but it makes the operational fulfillment of Data Act obligations considerably easier. For many manufacturers, a second regulation with its own evidence obligations runs in parallel: what NIS2 and Section 30 BSIG actually demand of OT and IIoT environments is set out in the matching guide.

A Practical Checklist Through September 2026

A pragmatic roadmap — without any claim to completeness and without legal advice:

1. Inventory: which of your products are "connected products" within the meaning of the Data Act? What data do they generate?
2. Map data flows: where does the data sit? In what format? Who has access today?
3. Check accessibility: is the data structured, machine-readable, and retrievable via an API? If not — that is the biggest rebuild.
4. Prepare transparency information: draft the pre-contractual details on data type, volume, and access.
5. Establish processes for user and third-party requests (Articles 4 and 5) — including authentication and authorization.
6. Assess lock-in: can you export data and switch providers? If not, an open platform is a strategic answer.
7. Secure it legally: have your contracts, trade-secret protection, and GDPR interfaces reviewed by qualified legal counsel.

thingshost: Managed ThingsBoard With Data Sovereignty

For those running ThingsBoard in production while wanting data sovereignty and predictable costs, use thingshost:

• Dedicated ThingsBoard instance (CE or PE) in 8 regions worldwide
• Germany region: data centers with ISO 27001 and BSI C5 certification (certificates held by the operators), other regions ISO 27001 and SOC 2 Type II, no US group, no CLOUD Act conflict
• Open APIs (REST/WebSocket) for structured, machine-readable data access
• Apache 2.0 open source — exportable and migrable, no vendor lock-in
• Standard (CE) from €149.90/month (Germany region), recommended for up to 100 devices, 24/7 monitoring, backups

What the plans cost and how the device tiering works is set out in the ThingsBoard hosting pricing overview.

Agree scope and provisioning with WZ-IT. Provisioning and contract terms are agreed with WZ-IT in the proposal. There is no self-service portal or automatic trial subscription.

Conclusion

The EU Data Act turns data access from an optional extra into an obligation. General application has run since 12 September 2025, but the decisive deadline for product makers is 12 September 2026: from then on, newly placed connected products must bring data access "by design and by default" — structured, machine-readable, free, and, where feasible, directly from the device.

An IoT platform does not deliver legal compliance, but it provides the technical prerequisites: structured storage, machine-readable APIs, and export paths. An open-source platform like ThingsBoard — operated in European, sovereign data centers — meets these building blocks without proprietary lock-in and at the same time simplifies the GDPR assessment that the Data Act carries along for personal data. Data sovereignty and Data Act conformity are therefore not a contradiction but the same direction. If you want to take that route with a German operator, services and regions are listed under managed ThingsBoard with German data residency. The legal classification of your specific product, however, remains a matter for qualified legal counsel.

Recommended reading: ThingsBoard vs. AWS IoT Core: Open Source vs. Amazon Cloud · ThingsBoard Hosting: Cloud vs. Self-Hosted vs. Managed

How data location, processing agreement and exit rights play out in day-to-day operation is covered on the ThingsBoard hosting in Germany page.

Sources

• [1] European Commission – Data Act explained (applies since 12 Sept 2025, cloud switching from 12 Jan 2027)
• [2] European Commission – Data Act (scope, user rights, wind-turbine example)
• [3] Alston & Bird – The Data Act: Connected Products (Article 3(1) from 12 Sept 2026, Articles 4/5)
• [4] Data Act – Article 50 (entry into force and application; Article 3(1) for products after 12 Sept 2026)
• [5] Data Act – Article 3 (data access by design/by default)
• [6] Regulation (EU) 2023/2854 (Data Act) – Article 3(2): pre-contractual information duties (type and scope of data, frequency, access, complaints)
• [7] Data Act – Article 40 (penalties; reference to GDPR Art. 83 for Chapters II/III/V)
• [8] GDPR Article 83 (fines up to EUR 20M / 4% of worldwide annual turnover)
• [9] German Bundestag – Implementation of EU data access rules (adopted 26 March 2026, Bundesnetzagentur)
• [10] activeMind.legal – The Data Act Implementation Act (DADG; fines, BNetzA, BfDI)
• [11] HÄRTING Rechtsanwälte – DADG: what companies need to know
• [12] ThingsBoard – REST API (time-series query, telemetry)
• [13] ThingsBoard – Time-Series Data (PostgreSQL/TimescaleDB/Cassandra, export)
• [14] ThingsBoard – WebSocket API (real-time subscriptions)
• [15] ThingsBoard – Official website (Apache 2.0, cloud & on-premises)
• thingshost.de – Managed ThingsBoard Hosting