From 12 September, EU law makes connected products hand over their own data by design: the duty catches only the next model a brand launches, not the one already on the shelf

What actually changed on 12 September

Article 2(5) of the Data Act defines a connected product broadly: an item that obtains, generates or collects data concerning its use or environment and can communicate that product data, whose primary function is not itself storing, processing or transmitting data for someone else. That reaches far past routers and industrial sensors: a smart baby monitor, a connected kettle, a fitness tracker, a Bluetooth-enabled toy and a smart suitcase all qualify. Article 3(1) then requires that these products, and any related service sold with them, be designed so the data they generate is accessible to the user by default, without the user having to request it, in a comprehensive, structured, commonly used and machine-readable format, at no charge. Before 12 September 2026, that duty existed on paper but had no live start date for the product-design piece specifically; the rest of the Data Act, rules on business-to-business data sharing, cloud-switching and unfair contract terms, had already been in force for a year. From 12 September 2026, any connected product a brand places on the EU market for the first time has to be built, not retrofitted after the fact, to meet Article 3(1).

The numbers behind the deadline

One number marks when the design duty itself started applying. One marks how far behind the rest of the Data Act it lagged. The third is how many separate national regimes now enforce it.

The real subject: the compliance line runs through the launch date of the SKU, not the product category

Most coverage of the 12 September deadline reports it as a flat rule: connected products must now give users access to their own data. What that framing skips is that Article 3(1) is not keyed to the product category or the brand; it is keyed to the date a specific product was first placed on the EU market. A smart kettle model that has been sold since 2023 stays outside the design duty indefinitely, however much data it collects, unless the brand places a new version on the market. A near-identical kettle from a competitor launching this month has to be built with default data access from day one. Two functionally similar devices, two different legal statuses, decided entirely by launch date. That makes 'placed on the market', a term EU product law already uses for CE marking and the General Product Safety Regulation, into a data-compliance question as much as a safety one: a brand relabelling, re-sourcing or adding a feature to an existing connected product needs to know whether that change counts as placing a new product on the market, because that is the event that starts the clock on Article 3(1), not the product's age or its data collection itself.

Why it matters for brands

Three groups should read past the headline date. First, any brand selling connected physical products in the EU, smart home appliances, wearables, connected toys, luggage or beauty devices, now needs a per-SKU record of when each product was first placed on the EU market, because that single date decides whether Article 3(1) applies at all. From here on, 'data access by design' belongs on the same new-product checklist as CE marking and GPSR conformity, not as a separate IT project handled after launch. Second, enforcement is not centralised the way GDPR's is: each of the 27 member states designates its own competent authority, and the regulation leaves the penalty regime to national law rather than setting one EU-wide figure, so a brand selling the same connected product across several member states can face different authorities applying different sanctions to the same design gap. Third, do not merge this with two other EU obligations landing the same week: the Cyber Resilience Act's 24-hour vulnerability-reporting duty, which started a day earlier on 11 September 2026 and, unlike the Data Act's design duty, explicitly covers products already sold before its deadline, and the Digital Product Passport under the Ecodesign for Sustainable Products Regulation, which is about lifecycle and sustainability data, not user data access. Three different EU regimes, three different scopes, landing within days of each other on the same connected-product catalogue.

Two ways to read the 12 September deadline

Frequently asked questions