Access by Design Under the Data Act From September 2026
Access by design became mandatory for connected products and related services placed on the EU market after 12 September 2026. Manufacturers must make product and related service data directly accessible to users by default. This guide explains the scope, the meaning of placing on the market, implementation options, trade secrets and enforcement in Germany.
Key takeaways
- Connected products placed on the market after 12 September 2026 must give users data access by default.
- Data must be easy, secure, free and machine-readable, and directly accessible where feasible.
- Micro and small manufacturers are exempt; medium-sized companies have a limited exemption.
- Trade secrets can be protected through agreed measures and, exceptionally, refusal.
- Breaches of Article 3(1) can be fined up to EUR 500,000 in Germany.
What access by design requires
Access by design is now a product requirement for connected products sold in the EU. Under Article 3(1) of the Data Act (Regulation (EU) 2023/2854), connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data — including the metadata needed to interpret and use them — are by default accessible to the user easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly. The obligation applies to connected products and related services placed on the market after 12 September 2026 (Article 50).
For German manufacturers of machinery, vehicles, household appliances, medical and agricultural equipment and other connected devices, access by design means that data access can no longer be an afterthought handled by a request process. It must be built into the product architecture, the user interface or an interface such as an app, portal or API. Products placed on the market before that date remain subject to the access-on-request obligation in Article 4, which has applied since 12 September 2025.
Which products and data are covered
A "connected product" is an item that obtains, generates or collects data about its use or environment and can communicate product data via an electronic communications service, a physical connection or on-device access, and whose primary function is not storing or processing data for others (Article 2(5)). This includes industrial machines, vehicles, smart home devices, wearables, agricultural machines and many other products with sensors. A "related service" is a digital service, including software, connected with the product at the time of purchase, rent or lease so that its absence would prevent the product from performing a function, or subsequently connected to add, update or adapt its functions (Article 2(6)).
The data covered are "product data" — data generated by use of the product that the manufacturer designed to be retrievable — and "related service data", which digitise user actions or events during the provision of a related service (Article 2(15) and (16)). Raw and pre-processed data are covered, as is the metadata necessary to interpret them. Derived or inferred information resulting from complex proprietary algorithms is generally outside the scope, according to the recitals of the Data Act.
| Situation | Obligation | Applies from |
|---|---|---|
| Connected product or related service placed on the market after 12 September 2026 | Access by design (Article 3(1)) | 12 September 2026 |
| Connected product sold, rented or leased | Pre-contractual information on data (Article 3(2)) | 12 September 2025 |
| Related service contract | Pre-contractual information on data (Article 3(3)) | 12 September 2025 |
| Data not directly accessible to the user | Access on request without undue delay, free of charge (Article 4(1)) | 12 September 2025 |
| User requests sharing with a third party | Sharing on FRAND terms (Article 5) | 12 September 2025 |
Exemptions for small manufacturers
Chapter II, including access by design, does not apply to data generated by connected products manufactured or designed, or related services provided, by micro and small enterprises, provided they have no partner or linked enterprises that are not micro or small enterprises and are not subcontracted to manufacture or design the product (Article 7(1)). Medium-sized enterprises benefit from a limited exemption for one year after qualifying as medium-sized and for products for one year after they place them on the market.
The meaning of placing on the market
The cut-off date is linked to placing on the market, not to the launch of a product model. Under the general approach of EU product legislation, placing on the market refers to each individual product unit that is first made available on the EU market. Manufacturers should therefore not assume that a product series launched before 12 September 2026 is exempt from access by design for units supplied after that date. Where redesign of existing models is not feasible in time, a careful legal analysis of the product portfolio, supply chain and stock is required.
Map your product portfolio against the 12 September 2026 date: identify which models and units are first placed on the EU market after that date, what data they generate, and how users can access those data directly or through an interface. Document design decisions and why certain data are not directly accessible.
How to implement access by design
Article 3(1) is technology-neutral. Manufacturers can choose how to make data accessible, for example via:
- an on-device interface or local data port;
- a companion app or web portal with download and export functions;
- an API that allows the user, or a third party authorised by the user, to retrieve data continuously or in real time;
- cloud-based access where the data are stored on the manufacturer's servers.
The words "where relevant and technically feasible" qualify only direct access. The user must in any case receive the data easily, securely, free of charge and in a machine-readable format. Where direct access is not feasible, the data holder must provide access on request under Article 4. The design must also take account of security: data access must not create vulnerabilities, and the Cyber Resilience Act imposes cybersecurity requirements on products with digital elements in parallel. See our insight on the Cyber Resilience Act.
A practical implementation roadmap
- Inventory: list connected products and related services, the data they generate and where the data are stored.
- Classify: separate product data and related service data from derived data, and personal from non-personal data.
- Design: decide on the access channel (device, app, portal, API) and on formats and metadata for each product line.
- Secure: integrate authentication, authorisation and logging so that only users or authorised third parties obtain the data.
- Protect: identify trade secrets and prepare confidentiality measures and template agreements.
- Inform: update pre-contractual information, product documentation and user data licences.
- Govern: assign responsibility for access requests, refusals and notifications to the Federal Network Agency.
Access by design is an engineering task as much as a legal one. Product managers, developers and legal teams should agree early on a data model that can be reused across product generations, because retrofitting interfaces after launch is expensive. Companies that sell through distributors should also ensure that pre-contractual information reaches the end user, for example through product documentation and distributor agreements.
Third-party access
The user may ask the data holder to share data with a third party, for example a repair service, an insurer or a provider of analytics services (Article 5). An access by design interface can make such sharing easier, but sharing with third parties follows its own rules.
Under Article 6, the third party may use the data only for the purposes agreed with the user, may not use them to develop a competing product and must delete them when they are no longer needed. Data holders should therefore build permission management into their interfaces, so that users can grant, limit and withdraw third-party access easily. Gatekeepers designated under the Digital Markets Act are not eligible third parties (Article 5(3)). Data holders may agree compensation with third-party recipients under Article 9, while access for the user itself must be free of charge.
Trade secrets
Access by design does not mean that all data must be disclosed without safeguards. Trade secrets must be preserved: the data holder must identify data protected as trade secrets and agree proportionate technical and organisational measures with the user (Article 4(6)). If no agreement is reached or the user undermines confidentiality, the data holder may withhold or suspend sharing, and in exceptional cases refuse access if it can show it is highly likely to suffer serious economic damage (Article 4(7) and (8)). Such decisions must be substantiated in writing and notified to the competent authority. Users may not use the data to develop a competing connected product (Article 4(10)).
Personal data
Where the user is not the data subject, personal data may be made available only where there is a legal basis under Article 6 GDPR and, where relevant, Article 9 GDPR and Article 5(3) of the ePrivacy Directive are satisfied (Article 4(12)). Product design should therefore distinguish between personal and non-personal data and support data minimisation.
Pre-contractual information and contracts with users
Since 12 September 2025, sellers, rentors and lessors of connected products must provide information before contracting on the type, format and estimated volume of product data, whether data are generated continuously and in real time, where data are stored and for how long, and how the user can access, retrieve or erase them (Article 3(2)). Providers of related services have more extensive information duties, including the identity of the data holder, intended uses of the data and the user's right to complain to the competent authority (Article 3(3)).
The data holder may use non-personal readily available data only on the basis of a contract with the user (Article 4(13)). Manufacturers therefore need user-facing data licence terms, which are subject to the Data Act and to German standard terms law. Terms that exclude or restrict users' rights to their detriment are not binding (Article 7(2)). See our insight on data sharing contracts.
Enforcement and fines in Germany
The Federal Network Agency is the competent authority for the Data Act in Germany under the Data Act Application and Enforcement Act (Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, DADG), in force since 30 May 2026. Under § 15(2) no. 1 and (4) DADG, designing or manufacturing connected products, or designing or providing related services, contrary to Article 3(1) is an administrative offence punishable by a fine of up to EUR 500,000.
Failing to make data available on request contrary to Article 4(1) is subject to the same maximum. Users can complain to the Federal Network Agency and enforce their rights in the civil courts; competitors may also consider claims under unfair competition law, although the extent to which Data Act obligations qualify as market conduct rules has not yet been settled by the courts.
The Digital Omnibus proposal of November 2025 (COM(2025) 837) would integrate the Data Act's data access provisions into a consolidated framework, but at the time of writing it had not been adopted. The access by design obligation therefore applies as described. See our page on the Data Act.
How TRW & Co helps with access by design
We advise manufacturers and providers of related services on implementing access by design: scoping connected products and data, reviewing product architecture and interfaces with engineering teams, drafting pre-contractual information and user data licences, protecting trade secrets and coordinating with GDPR and cybersecurity requirements. We also advise users and third parties seeking access to data and represent clients before the Federal Network Agency. See also our pages on product liability and compliance and data and digital, or contact us.
Frequently asked questions
Which products must comply with access by design?
Connected products and related services placed on the EU market after 12 September 2026. Connected products are items that generate data about their use or environment and can communicate them, such as machines, vehicles, appliances and wearables. Products placed on the market earlier are subject to the access-on-request obligation in Article 4.
Does access by design require an API?
No. Article 3(1) is technology-neutral. Data must be accessible by default, easily, securely, free of charge and in a machine-readable format, and directly accessible where relevant and technically feasible. Manufacturers can use on-device interfaces, apps, portals or APIs. Where direct access is not feasible, access must be provided on request.
Are small manufacturers exempt?
Micro and small enterprises are exempt from Chapter II, including access by design, if they have no partner or linked enterprises that are larger and are not subcontracted to manufacture or design the product. Medium-sized enterprises benefit from a limited exemption for one year after qualifying as medium-sized and for one year after placing a product on the market.
Can manufacturers refuse to share trade secrets?
Trade secrets must be preserved. The data holder identifies them and agrees protective measures with the user. If no agreement is reached or confidentiality is undermined, sharing can be withheld or suspended; in exceptional cases access can be refused where serious economic damage is highly likely. Such decisions must be justified in writing and notified to the authority.
What are the fines in Germany?
Under § 15 DADG, designing or manufacturing connected products contrary to Article 3(1) of the Data Act can be fined up to EUR 500,000. The Federal Network Agency is the competent authority. Users can also enforce their data access rights in the civil courts.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.