EU Data Act: Connected-Product Data and Cloud Switching in 2026

Status note — checked 12 August 2026. The Data Act has applied since 12 September 2025. A Commission Digital Omnibus proposes changes to the broader EU data rulebook, including targeted Data Act changes, but the European Parliament’s Legislative Observatory lists procedure 2025/0360(COD) as Awaiting committee decision. A proposal is not the operative rule described here.

The Act reaches two relationships that owners often keep in separate files: the data generated by connected products and the ability to leave or combine cloud and other data-processing services.

Fact: present duties and near-term milestones overlap

The Data Act, Regulation (EU) 2023/2854, applies from 12 September 2025. The Commission’s Data Act explainer describes its principal areas, including user access to data generated by connected products, protections against certain unfair business-to-business terms, and switching between data-processing services.

Connected products

Chapter II gives users of connected products routes to access, use and port data generated by their use, subject to the Act’s scope, protections and exceptions. Article 3(1)’s design obligation—making product data and related-service data, together with metadata needed to interpret and use it, readily available to the user by default where relevant and technically feasible—applies to connected products and related services placed on the market after 12 September 2026.

That date is not the start of the entire Act. Pre-contract information duties, data-access mechanisms and the respective roles of data holder, user and third party require separate review.

Cloud and data-processing services

Chapter VI requires providers of covered data-processing services to remove specified obstacles to switching and to include minimum switching terms in contracts. The Commission explains that providers of Platform as a Service and Software as a Service must make open interfaces available and, at minimum, support export in a commonly used, machine-readable format; Infrastructure as a Service providers must take measures aimed at functional equivalence for the same service type.

Article 29 stages the removal of switching charges:

• until 12 January 2027, a provider may impose reduced switching charges that do not exceed its directly linked costs; and
• from 12 January 2027, providers must not impose switching charges for the switching process.

That rule does not automatically erase standard service charges, proportionate fixed-term early-termination penalties, or paid work supplied by an independent migration adviser. Contract language and the Act’s definitions still control.

Other contract dates

Article 50 says Chapter IV’s unfair contractual-term rules apply to contracts concluded after 12 September 2025. From 12 September 2027, they also reach earlier contracts that are indefinite or are due to expire at least ten years from 11 January 2024. These rules are not a general power to rewrite every negotiated B2B term; scope and whether a term was unilaterally imposed matter.

The Commission’s Digital Omnibus Regulation proposal is tracked by the European Parliament under procedure 2025/0360(COD). As of this page’s review date its status is Awaiting committee decision: it remains proposed, not enacted. Businesses should monitor it without treating proposed exemptions or simplifications as current law.

Signal: the data or exit exists only at the vendor’s discretion

PARAVEILUX judgment. The commercial blind spot is not simply a missing export button. It is the absence of an agreed, tested chain from entitlement to usable data or from notice to an operating replacement.

Investigate when:

• product telemetry is described as “our data” without separating personal data, user-generated data, inferred or derived information, trade secrets and intellectual-property-protected material;
• a product team cannot identify the data holder or explain what a customer receives directly and what must be requested;
• the cloud contract promises export but does not name formats, metadata, configuration, dependencies, assistance, security controls or the maximum transition period;
• an integration, proprietary feature or marketplace licence prevents functional use after export;
• egress is advertised as free while professional services, API calls, storage or accelerated transfer create the real exit price; or
• the supplier can change sub-processors, locations, interfaces or export tools without notice.

Counter-signals

• Scope analysis identifies the product, related service, user, data holder and relevant data categories with reasons.
• Export and switching steps have been tested on representative data, including metadata and configuration.
• The contract lists switching procedures, notice, assistance, continuity, security and deletion/return evidence.
• Trade-secret and personal-data controls are specific and do not become a blanket refusal to provide any data.

Action: test one real access and one real exit

Do not rely on a policy summary alone. Select a representative connected product and a material hosted service, then walk through the actual evidence.

Implementation checkpoints

1. Map the roles. Record manufacturer, seller, related-service provider, data holder, user, cloud/data-processing provider and any destination provider.
2. Inventory data by layer. Separate raw/product data, related-service data, metadata, user-supplied data, personal data, trade secrets, derived information, configuration and logs.
3. Before 12 September 2026. For products or related services to be placed on the market after that date, test how Article 3(1) data and metadata become available by default where the provision applies.
4. Before 12 January 2027. Reprice switching and data-egress terms, but keep early-termination and third-party migration costs distinct.
5. Run an exit rehearsal. Export, validate, import to a destination, verify business functionality and record what was lost.
6. Monitor the proposal. Assign an owner to follow 2025/0360(COD); change the register only when an amendment is enacted and applicable.

Limitations: “data” and “cloud” are not single categories

The Data Act interacts with data protection, trade-secret, competition, consumer and sector rules. It excludes or limits some data and services, and it contains safeguards for trade secrets and security. Whether a device is a connected product, a service is a related service or data-processing service, and a party is a user or data holder is fact-specific. The Commission explainer is not a substitute for the regulation.

This page does not assess a particular product, migration charge or contract term and does not promise that an export will be interoperable. It is general information, not legal or professional advice.