The Data Act is an EU regulation governing access to and sharing of data generated by connected products and related services. It entered into force in January 2024 and has applied in full since 12 September 2025. It is not an AI-specific regulation — it applies to any manufacturer of connected products, provider of related services, or data processing service operating in the EU market, regardless of whether AI is involved. Where your product uses AI and generates or processes machine data, the Data Act and the EU AI Act apply simultaneously.

Yes. The Data Act applies extraterritorially where a connected product is placed on the EU market or a related service is provided to users in the Union, regardless of where the manufacturer or service provider is established. UK, US, Canadian, Swiss, and Indian companies with EU users or EU enterprise clients are in scope on the same terms as EU-established businesses. The territorial reach mirrors the EU AI Act and GDPR — it follows where your product is used, not where your company is incorporated.

The Data Act is structured in chapters, each applying to a different role — manufacturer of connected products, provider of related services, provider of data processing services, or data recipient. Which chapters bind you depends on which roles you hold and for which products, services, and relationships. Most businesses hold more than one role simultaneously and don’t realise it.

The Role and Chapter Applicability Assessment — the free entry document in the pack — works through this systematically and produces a role map telling you which of the other three documents you actually need. Complete it first before purchasing anything.

The pack contains four documents, each structured around the Data Act’s own chapter architecture. The Role and Chapter Applicability Assessment — free, no email required — establishes which roles you hold and which chapters follow. The Connected Product Data Access and Sharing Record covers Chapters II and III — access-by-design against the nine required qualities, pre-contract information duties, request-handling process, and Article 6 conditions for data recipients. The Data Processing Services Switching Record covers Chapters VI and VII — obstacle removal, mandatory contract clauses, functional equivalence, switching-charge withdrawal with egress exposure quantification, and third-country governmental access safeguards. The Contractual Terms, Compensation and Trade Secrets Record covers Chapters III and IV — FRAND terms, defensible compensation basis, trade-secret protection, and Chapter IV contract-remediation review across your agreement estate. Every document follows the structure of the European Commission’s own explanatory notices and templates. 38 pages in Word format, fully editable.

It is the entry document — complete, fully usable, and available without an email address. It works out which roles you hold under the Data Act, for which products, services, and relationships, and which chapters of the regulation follow. For many businesses, completing it reveals that only one or two chapters apply — which means only one or two of the paid documents are relevant. The free assessment exists precisely so you do not pay for documentation you do not need. Download it, work through it, and let it tell you what applies before you spend anything.

The Data Act requires that connected products be designed so that data generated by their use is accessible — by default, easily, securely, and in a usable format — to the user. Article 3 specifies nine qualities the access mechanism must satisfy. This is a design requirement, not a policy one — it must be built into the product before it is placed on the market, not added as a setting after launch. The Connected Product Data Access and Sharing Record assesses your product against each of the nine qualities and documents your position.

The Data Act prohibits switching charges between data processing services — cloud providers, managed services, SaaS platforms — from 12 September 2027. From that date, providers cannot charge customers for the technical process of switching to a competing service or porting their data. The Data Processing Services Switching Record includes a field to quantify your egress exposure — the revenue currently generated by switching or data transfer charges — so you can plan for the commercial impact of withdrawal before the deadline.

The mandatory contract clauses covering functional equivalence and switching assistance must be in place before the deadline regardless of when your current contracts were signed.

FRAND — fair, reasonable, and non-discriminatory — is the standard the Data Act applies to compensation for data sharing between businesses under Chapter III. Where a data holder is required to make data available to a data recipient, any compensation must be FRAND-compliant.

The Contractual Terms, Compensation and Trade Secrets Record includes a defensible compensation basis — a structured methodology for setting and documenting a FRAND rate — and the trade-secret protection measures that must be prepared in advance of a data sharing request. Courts and regulators are beginning to assess FRAND compliance; undocumented compensation arrangements are the first thing they look at.

The Data Act requires data holders to make data available on request but preserves trade secret protection — a data holder can refuse or limit sharing where it would involve the disclosure of trade secrets, provided appropriate protective measures are agreed. The difficulty is that this position must be prepared before the request arrives, not after. The Contractual Terms, Compensation and Trade Secrets Record includes a trade-secret identification and protection framework — establishing which data qualifies, what protective measures apply, and what the refusal or limitation procedure looks like. An undocumented trade-secret claim made under time pressure after a request is received is significantly harder to sustain.

Chapters VI and VII of the Data Act require data processing services to have technical and legal measures in place to prevent access by non-EU governmental authorities where that access would conflict with EU law or the fundamental rights of EU data subjects. This is directly relevant to cloud services and AI platforms hosted outside the EU or on infrastructure subject to non-EU jurisdiction — including US CLOUD Act exposure.

The Data Processing Services Switching Record includes a procedure for handling a foreign governmental order under time pressure — establishing the legal assessment process, the notification obligations, and the documentation required to demonstrate compliance with the Data Act’s safeguard obligations.

Where your AI product is a connected product generating machine data, or is delivered as a data processing service, the Data Act applies alongside whatever other EU frameworks reach it. An AI system embedded in a connected device — industrial equipment, consumer hardware, a vehicle system — generates data subject to Data Act access obligations. An AI platform delivered as a cloud service is a data processing service subject to Chapters VI and VII switching and governmental access obligations. The Data Act rarely arrives alone for AI products. The pack’s cross-reference section identifies the EU AI Act documentation that sits alongside it.

Template pack price covers the full four-document pack including twelve months of updates. The Data Act’s phased deadlines and the precise scope of permitted switching charges remain subject to regulatory development and the EU’s wider digital rulebook review. When the position moves, the revised documents are issued within the subscription period at no additional charge.

After twelve months, updates continue for €300 per year billed separately, or you keep the version you have. The free Role and Chapter Applicability Assessment is outside the subscription — it remains free and is updated when the regulatory position requires it.

No — and the distinction matters. The pack structures the questions, records your reasoning, and produces documentation in the form an authority or counterparty expects to see. It does not decide your role for you, determine whether a contract term is unilaterally imposed, or assess whether specific data qualifies as a trade secret — those turn on your particular facts and require legal judgement.

The Chapter IV analysis flags contract terms that may be unenforceable but acting on that across your live agreement estate is legal work.

The pack records what you have done and why, in the right format. What you put in it, and whether it is legally correct for your circumstances, is your responsibility or your lawyer’s.