Data Act: What EU Rules Mean for Machine and Customer Data

Why machine data is becoming a contract issue

A contract manufacturer operates five milling machines from a large manufacturer. The machines report running times, temperatures, and error codes to the manufacturer, which uses them to make maintenance offers. The contract manufacturer itself sees only part of this data. If it wants to hire an independent repair shop or analyze the data with its own program, it lacks access. Such situations are common in many industries, from tractors to heating systems to the office coffee machine.

The EU responded with the Data Regulation, usually called the Data Act. So the question is: What do EU data economy rules mean for the machine and customer data of a small or midsize business, both as a user and as a supplier? To answer it, we clarify terms and deadlines, introduce a mental model on who should be entitled to machine data, weigh two views, and arrive at concrete steps.

Terms and deadlines: what the Data Act regulates

• Connected product: An item that generates data about its use or environment and can communicate it via a connection, such as a machine with sensors, a vehicle, or a measuring device.
• Related service: A digital service, such as an app or software, without which the product could not perform one of its functions.
• User and data holder: The user is whoever owns, rents, or leases and uses the product, often the customer. The data holder is whoever actually controls the data, usually the manufacturer or provider of the service.
• Trade secret: Data whose disclosure would reveal the data holder’s secrets may only be released with protective measures. A blanket reference to trade secrets, however, is not enough to refuse access.

In Germany, the act implementing the Data Act has been in force since May 30, 2026. The competent authority is the Federal Network Agency; data protection supervisors remain responsible for data protection. Fines reach up to five million euros depending on the violation. Micro and small enterprises are exempt as manufacturers from certain data-sharing obligations; as users, they have full rights. How the rules on personal data in sales relate to this is described in Data protection in sales.

The mental model: who is entitled to machine data?

Cuihong Li and Brian Tomlin (2022) examined how the allocation of sensor data affects the introduction of condition monitoring, the continuous measurement of a machine’s condition so that maintenance can be planned as needed rather than by calendar. Their model looks at a manufacturer that takes over maintenance and repair for a machine at the customer’s site and a customer that operates the machine. Both affect wear: the manufacturer through the timing of maintenance, the customer through care in operation. Neither can fully observe the other’s behavior. The authors speak of double moral hazard in the sense of principal-agent theory.

The finding is instructive for the Data Act debate. Condition monitoring always benefits the manufacturer and the supply chain as a whole, but not the customer in every case, especially when the machine is very reliable anyway. If the data belong to the manufacturer, it introduces monitoring. If they belong to the customer, the customer can block it. The authors show that an appropriate fee paid by the manufacturer for data access can resolve this deadlock.

An everyday analogy: whoever rents an apartment decides who may enter, even if the landlord installed the smoke detector there. If the landlord wants to read the measurements regularly, they need the tenant’s consent and must give them a reason to grant it. The Data Act shifts the situation for machine data in this direction: the user gains access, and the manufacturer has to justify and offer rather than simply take.

Anyone who wants to use data generated at someone else’s site will have to give them a reason to share it.

What this means for customers and users of connected products

For a small business that uses machines, vehicles, or devices, the rights under the Data Act are a tool in negotiations. It can request the data generated through use, free of charge for itself, and have it passed on to third parties, such as a maintenance service, a software provider, or a consultant. The manufacturer may only use this data itself to the agreed extent.

• List which connected products run in the business and which data they generate.
• Ask the manufacturer which data are available and how you can access them.
• Check whether you could use the data for your own analyses, maintenance, or energy saving.
• In new purchase contracts, make sure data access and format are described.
• For cloud services, check how switching works and whether switching charges still apply.

The benefit is greatest where data used to be a manufacturer’s lever, for example in maintenance contracts. Anyone who knows which data they can request negotiates service contracts on an equal footing. For cloud services, switching charges also disappear from January 12, 2027. How businesses weigh cloud against their own server is described in Cloud or your own server.

What this means for manufacturers and service providers

For businesses that manufacture connected products themselves or offer related services, the Data Act is an obligation. New products must provide for access in their design, users must be informed before signing which data are generated, and contracts with users must specify what the manufacturer may use the data for itself. An appropriate fee may be charged for sharing with third parties, with caps when the recipient is a small or midsize company.

For many manufacturers, this changes the business model. Those who used to earn from maintenance because only they could see the data will have to convince through performance. The finding of Li and Tomlin points the way: those who want to use data let the customer share in the benefit, for example through cheaper maintenance, availability-based contracts, or an open offer for access. How one-off sales become ongoing relationships is described in Selling service contracts. An early example of such a model is the pay-per-part offer described in the Trumpf case study.

Two views: opportunity for small and midsize firms or new burden?

The first view sees an opportunity. As users, small businesses gain access to data that used to sit with large manufacturers and can use independent repair shops, their own analyses, and new providers. Small software firms and service providers can build offers on this data. Competition for maintenance and service becomes more open.

The second view sees a new burden. For small manufacturers, design obligations, information obligations, contract adjustments, and the protection of trade secrets are expensive. Many terms are unclear, courts have not yet interpreted them, and the Bundestag hearing pointed to open legal questions. Then there is the interplay with data protection: Napieralski (2024) shows that users and third parties receiving data under the Data Act may, under certain circumstances, become jointly responsible for personal data.

I consider the first view the weightier one, because most small businesses are users of connected products more often than manufacturers. For the manufacturers among them, the burden is real, but the exemptions for micro and small enterprises ease it. More important than the question of burden is another one: the rules make visible that data have a value that can be negotiated. Those who understand this use the Data Act not as an obligation but as an occasion to clarify contracts. At EU level, amendments to the Data Act have also been proposed with the so-called Digital Omnibus, which had not been adopted at the time of writing.

First steps for this week

1. Clarify your role

   For a given product, are you a user, a manufacturer, or both? Obligations and rights depend on this.

2. Take inventory

   List the connected products and services you use or offer, with the data they generate.

3. Review contracts

   Check purchase, maintenance, and cloud contracts for rules on data access, data use, and switching. How to review IT contracts in general is described in Finding the right IT service provider.

4. Define the benefit

   Consider which data would help you with maintenance, planning, or energy consumption, and request them from the manufacturer.

5. Plan for advice

   If you manufacture connected products yourself, plan for a review by a law firm and for the technical effort for new products.

Conclusion: what EU rules mean for machine and customer data

To the guiding question: since September 2025, EU data economy rules have given a small or midsize business, as a user of connected products, a right to the data generated through use and to having it passed on to third parties. As a manufacturer or service provider, it must enable access, for new products since September 2026 already in their design, and adapt its contracts, with relief for micro and small enterprises. The mental model of Li and Tomlin shows why this is more than bureaucracy: whoever controls data helps decide whether their benefit arises at all, and whoever wants to use them must let the other share in it. The limits of this article: many terms are still unclear, the authors’ model is a theory, and amendments at EU level are pending.

Data generated in your workshop were never worthless. The Data Act ensures that you have a say in their value.