EU Data Act: Access to Machine Data as a Requirement and an Opportunity

The EU Data Act As of September 12, 2025, it provides users with the right to access data from their connected machines. One year later, the next phase—Access by Design—will be introduced. In many companies, the analysis of their own operational data is still conducted exclusively through the manufacturer’s portal.

For production management and maintenance, this is more than just legal fine print. Anyone who gains access to their own operational data can set up their own monitoring system instead of remaining dependent on the metrics in the manufacturer’s portal.

The situation as of August 2026

Two key concepts define the EU Data Act, and they are frequently confused in practice. The Regulation (EU) 2023/2854 It entered into force on January 11, 2024, and has been directly applicable in large parts since September 12, 2025, without a national implementing law. This applies to the right of access to product data under Chapter II, which already applies to existing machines as long as the manufacturer retains the data anyway—for example, in its service backend.

The second deadline is September 12, 2026. As of that date, the stricter “Access by Design” requirement under Article 3, paragraph 1, will take effect, as stated in a recent Classification of Deadlines . It applies only to connected products newly placed on the market as of that date; nothing changes for existing systems. A national implementing law has also been in effect since May 30, 2026, and designates the Federal Network Agency as the central regulatory authority.

EU Data Act: Who Is Entitled to What Machine Data?

Article 4 of the regulation governs the user’s access to their own machine data. In addition to owners, the term “user” expressly includes renters and lessees, as the Federal Network Agency FAQ clarifies. If the user cannot access the data directly, the data controller—usually the machine manufacturer—must make the data available immediately, free of charge, and in a common, machine-readable format; in real time, where technically feasible.

This claim applies to raw and preprocessed data that is readily available. Derived analyses that the manufacturer must first calculate at its own expense are generally not covered. Contracts that make a blanket reference to a manufacturer’s portal leave this distinction undefined.

Disclosure to Third Parties and Trade Secrets

Article 5 also grants users the right to disclose the same data directly to a third party of their choice, such as a provider of predictive maintenance services. This is free of charge for the user, and the third party may be subject to fair terms and conditions. Gatekeepers, as defined by the Digital Markets Act, are excluded as recipients.

Trade secrets do not automatically override this right. The data owner must designate protected data as such prior to disclosure and agree on protective measures with the user, such as confidentiality agreements or strict access protocols. The data owner may refuse disclosure only on a case-by-case basis if they can demonstrate an imminent risk of serious economic harm, provide written justification, and report the matter to the competent authority. A blanket statement such as „this is a trade secret“ is not sufficient.

Access by Design, starting September 12, 2026

Until now, manufacturers were required to provide data upon request, but there was no technical requirement to do so directly on the device. With “Access by Design,” this will change for new products: Data access must then be available by default, easily, and free of charge—either directly on the device or via a server, as applicable.

For manufacturers, this means planning for interfaces right from the development phase rather than adding them later. For operators, it’s now worth reviewing the requirements specification for every replacement or expansion investment, because this decision will shape the data architecture for many years to come.

What "Data Act Ready" Means for Machine Operators

„Data Act ready“ is not a protected term, but in practice it has come to refer to a checklist. Data access under the EU Data Act It begins with an inventory of connected machines and the question of who already has access to the generated data today, without the operator having access to it. It often turns out that a manufacturer has long been analyzing operational data on its own service portal, while the operator sees nothing more than a traffic-light indicator on the control panel.

The second step concerns new contracts. Phrases such as “data access as specified by the manufacturer” should be struck from specifications; instead, the format, access method and conditions for sharing data with third parties belong in every new tender. The third step is technical: how machine data can be translated into reliable metrics for overall equipment effectiveness depends on how consistently raw data from different manufacturer formats is processed. The same data path often also covers requirements from NIS2 and OT security or from energy monitoring, because all three topics draw on the same raw data. What this data path looks like in practice, from the individual sensor to the finished dashboard, is described in the article From Sensor to Dashboard: The Data Chain in Plant Monitoring.

Frequently Asked Questions

Does the EU Data Act also apply to existing machines?

Yes. The right of access under Chapter II has applied since September 12, 2025, to all connected products, regardless of their year of manufacture, as long as the manufacturer retains the relevant data. Only the “Access by Design” requirement applies exclusively to products newly placed on the market on or after September 12, 2026. There is no retrofitting requirement for older machines; the right of access under Chapter II is independent of this and, according to the regulation, depends solely on whether the manufacturer holds the data. The year of manufacture of the equipment is irrelevant in this regard.

Can the manufacturer deny access to machine data on the grounds of trade secrets?

Only in exceptional cases and with justification. The manufacturer must first attempt to agree with the user on protective measures such as confidentiality agreements or strict access protocols. A complete refusal is permissible only if the manufacturer can demonstrate that serious economic harm is imminent in a specific case, provide a written justification, and report this to the competent authority. A general reference to trade secrets is not sufficient under the regulation. In the event of a dispute, the regulation provides for recourse to the competent supervisory authority, which in Germany is the Federal Network Agency.

How much does it cost to access my own machine data?

Users may access their own data free of charge, as well as share it with a third party of their choice. If this third party requests direct access, the manufacturer may charge it a reasonable fee, but not the user directly. In practice, additional costs usually arise elsewhere, such as in the technical integration of the delivered data into the user’s own system or in the adaptation of existing contracts and interfaces.

For years, torck has been developing custom software for industry and retail and consolidating machine data from established, diverse fleets of equipment into a single dashboard. This very task is now arising anew because the EU Data Act grants legal access but does not relieve anyone of the responsibility for the technical integration. Our teams in Maxhütte-Haidhof, Vienna, and Rabat operate within a single time zone with a time difference of no more than one to two hours, under German-speaking project management and a contract governed by German law with the German company torck GmbH. How a newly established data entitlement translates into a Plant Monitoring It's best to discuss what needs to be translated in person.

Schedule a meeting