A connected device sold in the EU after 12 September 2026 must export its data to the user

Eleven people build the mobile app and the cloud dashboard for a soil-moisture sensor. They did not design the sensor. A hardware company did, and pays them to turn readings into something a farmer can act on. Then the farmer asks for every reading her sensor has ever taken, in a file she can load into her own software. Under the EU Data Act, for any sensor first sold in the EU after 12 September 2026, that is what the sensor and the software it needs to work have to be built to provide: the data reaches the person using them by default, free of charge, in a structured, commonly used, machine-readable format, and, where relevant and technically feasible, directly accessible to that person 1.

Two things usually keep a team like that from reading the regulation. The Data Act looks like a hardware law, so it seems to land on the company that makes the sensor, and eleven people sounds too small to be in scope. Neither holds. Article 3(1) sets a standard for how the software is designed and provided, not only for how the device is built, and the small-company exemption that would otherwise cover the team is withdrawn from a business subcontracted to do the work.

Being in scope does not mean every duty is yours, though. Three roles carry them, and the contract with the company that commissioned the software decides which ones you hold.

What started applying on 12 September 2026?

One obligation: the design duty in Article 3(1). Nothing else in the Data Act's data-access chapter changed that day.

Article 50 sets the dates. The regulation applied from 12 September 2025, and "the obligation resulting from Article 3(1) shall apply to connected products and the services related to them placed on the market after 12 September 2026" 1. Placing on the market means the first time a connected product is made available on the Union market, so the trigger is the product's own launch, not the date of your contract. A sensor that went on sale in 2024 is outside the design duty. One placed on the market after 12 September 2026 is inside it, and so is the dashboard it needs to work.

"Directly accessible" does not mean the data has to sit on the device. Recital 22, one of the numbered explanatory notes published alongside the regulation, says a connected product may be designed to make data directly accessible from on-device storage or from a remote server, the manufacturer's own capacity or a cloud provider's 1. Storage location is irrelevant. What the word rules out is a path that works only when somebody at your end intervenes.

The rest of the chapter has been running since September 2025. Where a user cannot reach the data directly, the data holder has had to make readily available data accessible on a simple request, without undue delay, free of charge and machine-readable, and in real time where that is relevant and technically feasible (Article 4(1)). Users have been able to direct that data to a third party of their choosing since then too (Article 5).

Is the software you build a "related service" under the Data Act?

It is, if the connected product cannot do one of its jobs without it, or if it was connected to the product later to add to, update or adapt what the product does.

Article 2(6) defines a related service as "a digital service, other than an electronic communications service, including software, which is connected with the product at the time of the purchase, rent or lease in such a way that its absence would prevent the connected product from performing one or more of its functions, or which is subsequently connected to the product by the manufacturer or a third party to add to, update or adapt the functions of the connected product" 1.

Software gets caught two ways. One covers software sold with the device and load bearing: switch the cloud service off and the sensor stops reporting. The other covers software connected afterwards, "by the manufacturer or a third party". You do not have to be the manufacturer, and your software does not have to have been in the box.

What keeps an ordinary SaaS product out is the definition of the connected product itself. Article 2(5) needs an item that obtains, generates or collects data concerning its use or environment and can communicate it, "and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user" 1. Your servers are not a connected product, and neither is a web app with no device behind it, so there is nothing for a related service to be related to.

Does the small-enterprise exemption cover you?

Probably, unless somebody else is paying you to build it.

Article 7(1) switches off the obligations of Chapter II for data generated through connected products manufactured or designed, or related services provided, by a microenterprise or a small enterprise 1. A small enterprise employs fewer than 50 people and has annual turnover and/or a balance sheet total of no more than 10 million euros 2. The staff ceiling is absolute; on the finances you can satisfy either the turnover test or the balance sheet test.

The exemption then attaches two conditions, and both have to hold.

No large relative. You must not have a partner or a linked enterprise that fails to qualify as a microenterprise or a small enterprise. A partner enterprise holds 25% or more of your capital or voting rights; a linked enterprise controls you, or is controlled by you, through a majority of the voting rights or an equivalent power. Venture capital companies and institutional investors are carved out of the 25% test, so a funding round does not by itself cost you the exemption, provided the investor does not hold that majority or otherwise control the company 2. A hardware manufacturer taking a quarter of your equity is a different matter.

Not a subcontractor. The exemption holds only where the enterprise "is not subcontracted to manufacture or design a connected product or to provide a related service" 1. Build software for a product of your own and you keep the exemption. Build it under contract for somebody else's product and you do not.

One admission on that second condition, since the sharpest claim in this post rests on it. I read a subcontract on its own as losing you the exemption, because Article 7(1) requires both conditions to hold and failing either is enough. Recital 41 is worded ambiguously and has been read the other way, and nobody official has settled it 1.

Who owes the duty, you or the company that hired you?

The chapter names three roles, and a subcontracted software firm usually holds fewer of them than it fears.

Article 3(1) describes how the product and the service have to be built, without naming who has to build them that way: connected products "shall be designed and manufactured", and related services "shall be designed and provided", to that standard. Whoever designs and provides the related service builds to it, which for the team in the opening means them.

Article 3(3) works differently. It binds "the provider of such related service" to inform "the user" before the service contract is concluded, and Article 2(12) makes the user the person who owns the connected product or receives the related service. That is the farmer, whose contract in a white-label arrangement is with the hardware company, which puts the Article 3(3) statement there rather than on the eleven people 1.

So you probably do not publish that statement. You do, however, have to produce part of it. Six of its nine items are commercial facts the hardware company holds: who the data holder is, what it intends to do with the data, how a user directs data to a third party, where to complain, whose trade secrets are involved, and how the contract ends. The other three are answerable only from your side of the build:

• what product data the service obtains, in what volume and how often
• what data the service itself generates, and in what volume
• where all of it is stored, for how long, and how the user reaches it

Collection frequency and retention windows are facts about a schema and a cron job, not about a commercial relationship. The whole list is close to the Article 13 transparency set in the GDPR, which most teams have already assembled once for a privacy policy, with two differences: this one is owed whether or not any of the data is personal, and it is owed before the contract rather than at the moment of collection.

The data holder is the third role, and the contract decides it. Article 2(13) defines one as a person with the right or obligation to make data available, including, "where contractually agreed", data generated during the provision of a related service. The European Commission's Data Act FAQ, now at version 1.4, says the role turns on who controls access to the readily available data rather than on who produced the hardware or the software. Recital 41 adds that a small company can be a data holder even where it is neither the manufacturer nor a provider of related services 1.

What to do about this?

Ignoring it costs a fine set by each Member State (Article 40(1)), and the authorities that supervise the GDPR can fine a Chapter II infringement "within their scope of competence" under Article 83 of that regulation, up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher (Article 40(4)) 13. A contract term that cuts across the user's rights does not bind the user (Article 7(2)).

Four things to do.

• Check whether a user can get every reading the device has produced, machine-readable, without anyone on your team running a query. If not, that is the engineering work.
• Find when the product was first made available on the EU market. After 12 September 2026 the export has to be designed in. Before that, access on request still applies.
• Settle the exemption on paper: headcount and finances against the small-company line, whether a firm that is neither micro nor small holds a quarter of you, and whether somebody else commissioned the work.
• Read your contract with the company that hired you for who it names as data holder and who owes the pre-contract statement to the user. If it is silent, close that gap. The Commission's model contractual terms are a starting point.

The facts only you can supply, collection frequency, retention windows and what the schema stores, change every sprint, and the statement they feed goes stale when nobody re-reads it. Lawcel, the product I work on, reads the pull requests and tickets that change a product and flags the ones that leave a legal document describing software that no longer ships.

If you also sell a hosted service, the switching and egress rules in Chapter VI reach any data processing service, hardware or not, and the charges they cover fall to zero on 12 January 2027.