On 12 September 2026, the “access by design” requirement under Article 3(1) of the Data Act (EU Regulation 2023/2854) (“the Data Act”) came into force. The new requirement applies to in-scope businesses placing connected products and related services on the market from 12 September 2026 onwards.
The “access by design” requirement will be welcomed by consumers and businesses that use connected products and related services, who will now have direct access to the data they generate. Users will also be able to share their data with third parties like repair and maintenance services. Until now, manufacturers and providers of related services were only required to make relevant data available to users on request.
Article 3(1) of the Data Act requires manufacturers of connected products to design and manufacture them, and providers of related services to design and provide them, in such a manner that product data, related service data, and relevant metadata are directly accessible to users by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format. This requirement means that Data Act compliance is a central issue at the product / service design stage, and it will need to be considered from the outset by those businesses developing connected devices, machinery and other Internet of Things products.
This article considers the scope of the new “access by design” requirement, and its implications for in-scope businesses.
The “data access by design” requirement
The Data Act has introduced a new framework in respect of access to and use of data generated by connected products and related services. With the general commencement of the Data Act on 12 September 2025, users have had the right to request access to data generated through their use of connected products and related services and, subject to the applicable conditions, to have that data made available to third parties. For more information on the Data Act and the Irish enforcement framework, see our previous three-part series on the Data Act: Part 1; Part 2; Part 3.
Articles 3(2) and 3(3) of the Data Act require a seller, rentor, or lessor of a connected product (which may be a manufacturer), and a provider of a related service, to provide users with certain information concerning the data which their connected product or related service generates. This is known as the ‘transparency obligation’.
As part of the transparency obligation, users must be informed about how to access the generated data. Data can be made available directly or indirectly to users. Direct user access (pursuant to Article 3(1)) is where the product’s own technical architecture allows the user to access, stream or download data without intervention. For example, a connected product with a digital interface where the user has control over the access mechanism, controlling the interface and workflows, and where the user can directly extract data from the connected product. On the other hand, indirect access (pursuant to Article 4(1)) requires the user to request access from the data holder. An example would be a web portal where the user can submit a request to access data.
The Data Act provided for an additional one-year transitional period (i.e. until 12 September 2026) for the compliance with the “data access by design” obligation under Article 3(1), mandating direct user access to data. This means that from 12 September 2026, manufacturers and service providers will need to consider data accessibility as part of the design and manufacture / provision of new connected products and related services, and ensure users can access data directly by default (such as through a built-in interface, app or other technical tool), “where relevant and technically feasible”. This final qualification (i.e. “where relevant and technically feasible”) is particularly important as it indicates that the Data Act does not impose an absolute requirement on data holders to ensure that every connected product and related service provides users with direct access to all data. When data cannot be directly accessed from the connected product or related service, it should be made readily available without undue delay, to the data holder, and easily, securely and free of charge.
What are connected products and related services?
We have set out a description and some practical examples of connected products and related services falling within scope of the Data Act in the table below:
| Category | Description | Examples |
| Connected products | Any device which obtains, generates or collects data concerning its use or environment and can communicate that data via a cable-based or wireless connection. | Smart home appliances, consumer electrics, industrial machinery, medical devices, smartphones and TVs.
Products which primarily fulfil the function of storing, processing, or transmitting data (eg, servers and routers) are outside scope of the Data Act, unless they are owned, rented, or leased by the user. |
| Related services | A digital service which is connected with a product at the time of purchase, rent, or lease, in such a way that the absence would prevent the connected product from performing one or more of its functions, or the digital service is later connected to the product to add to, update or adapt its functions. | Health tracker on a smart watch, an app to adjust the brightness of lights, or an app to regulate the temperature of a fridge.
Services that do not have an impact on the operation of the connected product and do not involve the transmitting or data or commands are not related services (eg, connectivity, power supply and aftermarket services). |
Scope of data under the “access by design” duty
The Data Act sets out a broad definition of “data” under Article 2(1), capturing “any digital representation of acts, facts or information and any compilation of such acts, facts or information, including in the form of sound, visual or audio-visual recording”. The European Commission FAQs on the Data Act (the “FAQs”) explain that ‘raw and pre-processed data’ that are readily available to a data holder as a result of the manufacturer’s technical design are covered by the data access rights provided for in Articles 3 and 4 of the Data Act, together with the necessary metadata to make it understandable and readable. Typically, connected devices generate both personal and non-personal data so both personal and non-personal data fall within scope of the Data Act.
The Data Act sets out certain exceptions to what data is required to be “accessible by design”, including in respect of derived or inferred data and trade secrets. For more details on in-scope data, see our previous article on data access and sharing obligations.
What does this mean for product design?
The practical consequence of the new access by design requirement is that data accessibility by users should form part of the technical requirements considered during product development. Manufacturers of connected products and providers of related services should consider what relevant data their products and services generate, where that data is stored or transmitted, how the user can obtain the data and whether the relevant metadata is also available. The design should also take account of the format in which data will be provided.
Article 3(1) of the Data Act expressly requires data to be directly accessible “easily, securely, free of charge, in a comprehensive, structured, commonly used and machine readable format”. Whilst the Data Act does not prescribe a particular file format or technical interface, the technical solution will need to be assessed in the context of the product / service concerned and the requirements of accessibility, security and usability.
As noted above, direct access to data generated by connected products and related services remains qualified by whether it is “relevant and technically feasible”. The FAQs confirm that manufacturers / providers retain some discretion about whether or not to design for direct access. At the same time, that discretion now needs to be applied deliberately, with the Data Act requirements in mind. For businesses with connected products / related services entering the EU market after the 12 September 2026 deadline, access by design must be treated as part of product compliance from the development stage through to market release, involving legal, engineering, cybersecurity, privacy and commercial teams.
Next steps
The coming into force of Article 3(1) of the Data Act marks another key step forward in the implementation of the Data Act. The next major deadline which businesses should be aware of is 12 January 2027, from which point cloud service providers are required under Article 29 of the Data Act to have eliminated all switching charges (further discussed here).
Whilst the Data Act, as an EU Regulation, is directly applicable in Ireland without the need to be implemented locally, national legislation is required in order to provide for the enforcement framework. To this end, the Irish Government published the General Scheme of the Data Bill 2025 last year, and the Government’s Legislation Programme lists the Data Bill as priority publication this Autumn 2026. The Bill will designate the national competent authorities responsible for implementing and enforcing the Data Act and will provide for penalties for non-compliance. It is expected that the Competition and Consumer Protection Commission (the “CCPC”), the Commission for Communications Regulation (“ComReg”) and the Data Protection Commission (the “DPC”) will be designated as national competent authorities for the Data Act (further discussed here). We will continue to monitor any developments concerning the Data Bill and provide necessary updates.
Contact us
If you have any questions on anything contained in this article or on the Data Act in general, please feel free to reach out to a member of the Technology and Innovation Group or your usual Matheson contact.
