How to comply with the EU Data Act in industrial manufacturing?
Key facts
Why wasn't product data access designed for regulated sharing?
In industrial manufacturing, the Data Act obligation applies to data generated by the use of the product-telemetry, logs, performance metrics, or error events produced by an industrial robot operating in a customer's plant.
In practice, this data is handled through the product's own technical stack: controllers, gateways, edge collectors, embedded software, OEM applications, and sometimes manufacturer-operated cloud or service platforms. These components are designed to operate the product, support maintenance, and enable value-added services-not to serve as regulated access points for external data consumers.
According to Latham &Watkins, "The EU Data Act is the most significant overhaul of European data law since the GDPR, with its impact being more disruptive than the EU AIAct." The regulation introduces a fundamentally different access paradigm: data access becomes externally initiated, user-directed, and subject to legal and contractual constraints.
Requests may be episodic or continuous, may involve third parties, and must be handled consistently across products, customers, and jurisdictions. Product runtime and service systems are simply not designed to absorb external variability, enforce regulatory access logic, or act as governed interfaces to broader data ecosystems.
How to decouple data sharing from product systems?
A dedicated Data Act enablementlayer reframes the problem entirely. It introduces a buffered, governedboundary between product-generated data and external data consumers.
Product data is collected, normalized, and exposed through this layer-not directly from controllers, gateways, or operational service components. External users never interact with the product runtime itself. They interact with a controlled access surface that enforces policy, security, scope, and contractual constraints by design.
As Gibson Dunn notes, "TheData Act will touch companies of all sizes in almost every sector of theEuropean economy, including manufacturers of smart consumer devices, cars, connected industrial machinery, smart fridges and other home appliances."
This decoupling allows manufacturers to evolve compliance logic independently from product software and service architectures, protecting both product integrity and regulatory readiness.
Why does scalable compliance benefit from robust data access infrastructure?
The Data Act does not create a single access event. It creates a continuous expectation of availability. Users and third parties may request data at different times, at different scales, and for different purposes.
Meeting these obligations at scale requires robust data access infrastructure as a regulatory capability-not just a developer convenience.
Rate limiting, throttling, monitoring, and fair-access enforcement are essential controls for meeting obligations without destabilizing product or service operations. By centralizing these mechanisms, a dedicated enablement layer allows manufacturers to respond predictably to demand without redesigning product integrations for each new request.
What access models does industrial data sharing require?
Industrial data sharing spansdistinct interaction models:
A dedicated data access layer supports both models cleanly-enabling controlled, request-based access where appropriate and governed event-based distribution where justified-while insulating product operation from variability.
Why do manual compliance solutions fail at scale?
Many manufacturers initially respond to Data Act requests using familiar mechanisms: spreadsheet exports, manual data pulls, or custom APIs built for specific customers. These approaches may work in isolation, but they do not survive repetition.
Each manual exception introduces inconsistency, draws engineering teams into compliance activities, and weakens auditability.
Critically, the Data Act is not an isolated requirement. Manufacturers are already facing-or will soon face-additional, structurally similar obligations:
Treating each obligation as a separate exception multiplies complexity. Only standardized, repeatable, and automated mechanisms can support this shift without turning compliance into a permanent operational bottleneck.
How to move beyond product-by-product compliance?
Without a shared enablement layer, Data Act logic is implemented repeatedly-product by product, customer by customer, and integration by integration. This fragments behavior across the product portfolio and makes governance increasingly difficult.
A centralized approach allows manufacturers to implement Data Act rules once and apply them consistently across product lines, deployments, and markets.
Compliance becomes an architectural capability rather than a feature of individual products.
How to enable compliance without compromising product operation?
The most important requirement remains unchanged: compliance must not interfere with how products operate inthe field. Industrial products cannot absorb regulatory experimentation or unstable access patterns.
By decoupling regulated data sharing from product runtime and service systems, manufacturers can meet DataAct obligations while preserving safety, reliability, and performance. A dedicated enablement layer acts as a governed interface between product-generated data and the outside world.
What's at stake: from tactical fixes to architectural readiness
The EU Data Act is not temporary. Expectations around product data access will continue to grow as industrial data ecosystems mature.
The European Commission projects the EU data economy will reach €743–908 billion by 2030, up from €630 billion in 2025. Manufacturers that invest in a dedicated Data Act enablement layer gain predictable compliance, scalable data sharing, and long-term architectural resilience.
Those that rely on tactical fixes will find that each new request increases cost, complexity, and operational risk.
Frequently Asked Questions
When does the EU Data Act come into effect?
The EU Data Act became enforceable on September 12, 2025. Companies selling connected products in theEU must be compliant by this date. Design requirements for new products apply from September 12, 2026.
What data must manufacturers share under the Data Act?
Manufacturers must provide access to data generated by the use of connected products, including telemetry, logs, performance metrics, sensor readings, and error events. This applies to both personal and non-personal data that is "readily available"without disproportionate effort.
What are the penalties for non-compliance?
Penalties can reach up to €20million or 4% of global annual turnover, whichever is higher. This mirrors theGDPR penalty structure. Additionally, the Data Act allows for collective civil lawsuits similar to US class actions.
Does the Data Act apply to B2B products?
Yes. The regulation applies to all connected products sold in the EU, regardless of whether customers are consumers or businesses. Industrial machinery, manufacturing equipment, and B2BIoT devices are all in scope.
Does the Data Act require a specific technical architecture?
No. The Data Act specifies what out comes must be achieved... A dedicated data access layer is one architectural approach that can help meet these requirements, but it is not mandated by the regulation itself.
How is the Data Act different from GDPR?
GDPR focuses on personal data protection and minimization. The Data Act focuses on access rights to product-generated data, including non-personal industrial data. Both regulations can apply simultaneously-where personal data is involved, GDPR requirements also apply.
What is a Digital Product Passport and how does it relate to the Data Act?
Digital Product Passports(DPPs) are digital records containing product lifecycle data, materials, and sustainability information. Starting February 2027 for batteries and expanding to other product categories, DPPs represent a parallel data-sharing obligation that will benefit from the same architectural approach as Data Act compliance.