The Data Act from 12 September 2026: how to claim your own machine data when you next invest

What changes on Saturday 12 September

The Data Act, Regulation (EU) 2023/2854, became applicable on 12 September 2025. One provision was deliberately held back at that point: Article 3(1). Article 50 of the Regulation provides that the obligation in that article applies to connected products and their related services placed on the market after 12 September 2026.

That article lays down a design requirement. A connected product must be designed and manufactured, and a related service designed and provided, in such a way that the product data and related service data are accessible to the user by default. This includes the metadata needed to interpret and use that data, and access must be easy, secure and free of charge, in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, the data must be directly accessible.

Note the words 'by default'. This is not about data you can obtain if you ask for it and take out the associated subscription, but about data the device releases of its own accord because it has been designed to do so. That is a different starting point from the one most buyers of machinery, climate control systems and telematics have become used to.

Two dates that are easily confused

Two dates get mixed up in the coverage, and the difference determines what you can already demand today and what you can demand only later. On 12 September 2025 the Regulation as a whole became applicable. Among other things, Articles 4 and 5 took effect then: the user's right to request the readily available data from the data holder, and the right to have that same data made available to a third party of their choice. Those rights do not depend on the age of your machine.

On 12 September 2026, Article 3(1) is added to these, and that provision works differently. It does depend on a date, namely the moment at which the product was placed on the market. A machine that your supplier placed on the market before that Saturday does not have to meet the design requirement. A machine placed on the market after that does.

The practical consequence is not that you had no rights until now, but that the route differs. For existing equipment, you request the data from the data holder, and the question is how much effort that takes. For new equipment, the device itself should be able to do it, and if it cannot, that is a defect, not something you have to request. As early as that first date, the Belgian technology federation Agoria described what it comes down to in essence: users of connected products, from a smart tractor to an industrial robot arm, gain access to the data generated during use.

Why this is a purchasing question for you, not a compliance question

The obligation rests on the manufacturer and on the provider of the related service, not on you as the user. In most pieces published about this date, that is also the angle: what makers of smart devices have to put in place. Law firm Houthoff described that side soon after the Regulation entered into force; the gist is that devices must be designed so that the data generated in use is accessible by default and free of charge.

For a haulier, a food producer or a grower, the reverse question is more interesting. If your supplier has to do something, what can you ask for? The answer: considerably more than a quotation usually contains. And the moment to ask is before the signature, not after it.

There is one more provision in the Regulation that rarely comes up in purchasing discussions and that matters for your position. Article 4(13) prohibits the data holder from using your non-personal data to derive insights about your economic situation, your assets or your production methods in a way that could undermine your commercial position on the markets in which you are active. Any other use of that data must, moreover, be based on a contract with you. Whoever supplies your machines may therefore not build up a picture from your operating hours that works against you.

In the Netherlands, supervision has been in place since 21 November 2025. On that date the Uitvoeringswet dataverordening (the Dutch act implementing the Data Act) entered into force and the Autoriteit Consument en Markt (Netherlands Authority for Consumers and Markets, ACM) became the competent supervisory authority; the ACM announced at the time that in 2026 it would provide guidance on, and investigate, compliance with the information obligation. According to Ondernemersplein (the Dutch government's information portal for businesses), a supplier that refuses to share data must report this to the ACM, to you and to the third party concerned. That is not a threat to use when discussing a quotation, but it is the difference between a wish and a right.

What counts as a connected product, and what as a related service

The scope is wider than the term 'smart device' suggests. Article 2 defines a connected product as an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, a physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of anyone other than the user.

A related service is the digital service that goes with it: software without which the product cannot perform one or more of its functions, or software that the manufacturer or a third party later connects to it to add to, update or adapt its functions. The accompanying portal, app and cloud service are generally covered, and that is exactly the layer where your data often gets stuck today.

In the sectors we work in, this includes:

• Telematics units and on-board computers in tractor units, trailers and vans, with the trip, consumption and refrigeration data they record.
• Production and packaging machines on the line, with their vibration, temperature, current and fault data.
• Refrigeration and freezing installations, and the temperature logs that go with them.
• Weighbridges, sorting installations, palletising robots and warehouse systems.
• Climate computers, sensors and irrigation systems in the greenhouse, and tractors and harvesters in the field.
• The portals and cloud environments for all that equipment, because as related services they fall under the same rules.

The question that pays off most this week

The design requirement hinges on one fact: was the product placed on the market after 12 September 2026? That is not the same as the date on which you sign, nor the date on which the machine is delivered to you. A unit from a series that came onto the market this summer is not covered, even if it does not reach your shop floor until November.

That makes the coming weeks unusual. If you are comparing quotations now, you are dealing with a market in which both categories are mixed, and nothing in the quotation makes that difference visible. The question to ask before you sign is therefore simple: will the unit you are offering us be placed on the market after 12 September 2026, and does it comply with Article 3(1) of the Data Act? The answer to that is not an opinion but a fact, and you can ask the question without the conversation turning legal.

If the answer is no, that is no reason not to buy. It is, however, the reason to put access to the data in the contract yourself, because for that machine the law will not do it for you.

For a connected product that does fall under the design requirement, Article 3(2) also gives you a right to information before you buy, rent or lease. Your supplier must then, of its own accord, make clear what types of data the product generates and in what volume, whether it does so continuously and in real time, whether the data is stored and, if so, where and for how long, and how you can access it, retrieve it and, where necessary, erase it. That is exactly the information you need to judge whether an AI application on this machine is possible at all. Ask for that information in writing, because a verbal commitment is gone at the next change of account manager.

The missing link behind predictive maintenance

Our piece on predictive maintenance sets out what such a project needs: a period of reliable, representative measurement data for each machine, ideally including historical failures, and an unambiguous link between sensor data and the maintenance log. Put that list next to everyday practice and you immediately see where it goes wrong. The data often does exist, but it sits in the machine builder's portal, in an aggregation the builder has chosen, behind a subscription the builder prices, and in an export format that varies from supplier to supplier.

The consequence is familiar. The model you want built can only be built by the party that already has the data, or it has to be trained on whatever you happen to be allowed to export. In the first case you are not buying a model but a dependency. In the second case you are building on a dataset whose aggregation choices you do not know, while it is precisely those choices that determine whether an incipient failure is still visible.

Article 3(1) removes that bottleneck for new equipment, and Article 5 already does so for what you have in place. The latter article gives you the right to have the readily available data made available to a third party of your choice, without undue delay, of the same quality as is available to the data holder, free of charge to you and in a machine-readable format, together with the metadata. That is the provision that makes it possible to have a maintenance model built by someone other than whoever supplied the machine. One restriction is stated explicitly: a company designated as a gatekeeper under the Digital Markets Act cannot be that third party.

This changes something fundamental for the baseline measurement that our predictive maintenance piece calls for. The question is no longer only whether the sensors measure the right quantities, but whether you can get hold of the measurement series in a usable format, with the metadata needed to interpret it.

And behind vision inspection on the line

The same applies to computer vision on the packaging line, at a point that is more sensitive still. That article describes how to validate a reject system: with an independent validation set from your own production, with a challenge test at line speed, and with periodic re-inspection of the accepted stream. All three require access to what the system has seen and judged, not just to the percentage it reports.

In practice, that is often exactly what is not supplied as standard. You get a dashboard with reject rates, while the underlying images, judgements and threshold settings stay in the supplier's environment. That makes the validation that HACCP and FSSC 22000 require of you impossible to carry out, because you cannot reconstruct a judgement afterwards.

A vision installation is usually a connected product with a related service around it. For systems placed on the market after 12 September 2026, access to that data should therefore be part of the design. Include that in the specification, together with the requirement that both the images of the rejects and a sample from the accepted stream remain available to you. Bear in mind that footage showing employees' hands or faces contains personal data. The Data Act does not set the GDPR aside: where personal data of someone other than yourself is involved, a legal basis under the GDPR is needed before that data may be made available.

The same reasoning applies outside the factory. In the greenhouse, the climate computer has been recording temperature, humidity, CO2 and light sum for years, and that is exactly the data on which yield forecasting and climate control run. In wholesale and logistics, the thread runs through the on-board computers and warehouse systems that form the basis for the applications that pay off first there.

What the Regulation does not give you

An honest reading should include the limits, because a mistaken expectation costs more in a negotiation than it yields. Five limitations matter:

• Only readily available data. The Regulation defines this as data that the data holder lawfully obtains or can obtain without disproportionate effort going beyond a simple operation. Raw measurement data and logs generally fall under this; a derived score, an enriched analysis or a prediction that your supplier has calculated itself is a different matter.
• Trade secrets remain protected. Article 4(6) to (8) requires both parties to take measures that preserve confidentiality before the data is disclosed, and allows the data holder to suspend or refuse disclosure if no agreement is reached on this or if it demonstrates serious economic damage with objective evidence.
• Direct access applies where relevant and technically feasible. That is a real limitation, but one your supplier must be able to substantiate rather than present as self-evident.
• No retroactive effect on design. For products not placed on the market after 12 September 2026, you are limited to the rights under Articles 4 and 5. The design requirement does not apply there, however reasonable the request.
• The data is for your own use. Article 4(10) prohibits you from using the data to develop a connected product that competes with the product from which it originates, from sharing it with a third party with that intent, or from using it to derive insights about the economic situation, assets or production methods of the manufacturer.

The human decides and signs, and here earlier than usual

At AIBA, our starting point is that the human decides and signs. On this subject, that moment comes one step earlier than you are used to: the decision that counts is the signature on the purchase contract, not the assessment of a model output later on. If you only raise data access when the AI project starts, you are negotiating from a position in which the machine is already in place and the supplier knows you can no longer walk away.

This also means that the question does not belong solely with engineering or IT. Whoever takes the investment decision must understand what they are giving away if they sign without securing data access. What is more, Article 4 of the EU AI Act (Regulation (EU) 2024/1689) has applied since 2 February 2025. Since the amendment by Regulation (EU) 2026/1744, in force from 27 July 2026, it has asked organisations to take measures that support the AI literacy of employees who work with AI systems. They do not have to guarantee a specific level. In practice, the buyer who purchases machines with a data platform around them belongs to that group.

Securing access at the time of purchase also makes the later work on the classification and documentation of AI in operational processes simpler. Part of what is asked there concerns the origin and quality of the input data, and that is exactly what you put on record with these agreements.

Where to start in practice

You do not need to build a dossier or bring in a lawyer for this. Three things can be done this week already. First, list the investments in machinery, installations, sensors or telematics that you expect in the next twelve months, and note which of them could become part of an AI application. Then add one paragraph on data access to your standard purchasing terms, using the wording of Article 3(1): by default, free of charge, machine-readable, with the metadata included and preferably direct. And for every open quotation, ask whether the unit offered will be placed on the market after 12 September 2026.

For equipment already in place, the first step is a different one. Choose one machine you have in mind for predictive maintenance or another application, and submit a request under Article 4 for the readily available data. What you get back, in what format and after how long, says more about the feasibility of that project than any quotation. Our free Practice Scan helps you choose that first machine and pin down which data you really need for it.