The Data Act and the new European data governance

In 2026 the European Data Act comes into full effect, concretely redefining how companies and organisations access, share and get value from the data generated by connected products and digital services.

In short, it marks a change of approach in the management of industrial data, with a direct impact on governance, contracts, cybersecurity and data-driven business models.

For companies in regulated or document-intensive industries, understanding the Data Act is a competitive lever. So let’s look at what it involves in detail.

What the Data Act is and what it aims to do

The Data Act is a European regulation that governs access to and use of the data generated by connected products (IoT, industrial machinery, vehicles, smart devices) and related services. It is part of the broader European data strategy promoted by the European Commission, with the aim of:

• Encouraging fair data sharing

• Reducing imbalances between manufacturers and users

• Stimulating innovation and competition

• Strengthening European digital sovereignty.

The key principle is simple but revolutionary: whoever uses a connected product must be able to access the data that product generates. But what does that mean exactly? It means that:

• The manufacturer cannot keep the data generated by the device exclusively to itself

• The user can ask for that data to be shared with third parties

• Contract terms cannot be unbalanced or unfair.

What about the GDPR? The Data Act does not replace the General Data Protection Regulation: it complements it.

The most important difference concerns the nature of the data. The GDPR applies to personal data. The Data Act focuses mainly on non-personal and industrial data, while respecting privacy rules where the two overlap.

Another difference is the aim: the GDPR limits and regulates processing, while the Data Act promotes access and reduces the imbalance between those who generate data and those who control it.

Under the Data Act, the manufacturer of a device cannot keep the data generated by the use of the product exclusively to itself. The user must be able to access that data and, in some cases, share it with third parties.

In the same way, it fits into the regulatory framework that includes the AI Act, strengthening governance across the data life cycle: collection, access, sharing and use in artificial intelligence systems.

Strategic impact on data-driven companies

The Data Act forces organisations to ask themselves some key questions: where does our data reside? Who can access it? How do we guarantee transparency and control? Are we ready to share it securely with partners or customers?

Companies whose data is fragmented across the cloud, local servers, document repositories and legacy systems risk being caught unprepared, precisely because they lack structured governance.

To turn a regulatory obligation into a competitive advantage, you need to:

• Centralise company knowledge

• Make data searchable and verifiable

• Keep control over access and sources

• Guarantee auditability and security.

In this scenario, the ability to query your own archives in a precise, traceable and compliant way becomes a strategic factor.

When the Data Act becomes mandatory

The Data Act is a European regulation and, as such, applies directly in all Member States of the European Union, without needing to be transposed into national law.

The regulation entered into force on 11 January 2024, but its provisions did not become immediately operational for companies. The key date was 12 September 2025, from which most of the obligations set out in the Data Act became fully applicable across the EU. From then on, manufacturers of connected devices, digital service providers and companies that handle data generated by smart products have had to comply with the new rules on access to, sharing and use of data.

Some technical provisions will apply progressively. For example, from 12 September 2026 new connected products will have to be designed so that the data they generate can be accessed, while certain measures on interoperability and switching between cloud services will be introduced gradually until 2027, to give operators time to adapt their infrastructure and contracts.

Is the Data Act an obligation or an opportunity?

It is a fair question. Every new piece of European legislation tends to be seen as another layer of complexity, and the Data Act is no exception. After years of adapting to the General Data Protection Regulation, and with the AI Act now in force, many companies wonder whether this is just one more regulatory obligation or something more.

The answer is that the Data Act is certainly a legal obligation. But it can become a strategic opportunity, under certain conditions.

From a legal point of view, there is no doubt: it is a directly applicable European regulation. It introduces specific responsibilities for manufacturers of connected devices, digital service providers and cloud providers. It requires greater transparency, rebalances contractual relationships and calls for clear mechanisms for accessing and sharing the data generated by smart products.

For many companies this means reviewing contracts, internal processes and IT infrastructure. In the short term it may involve investment and organisational changes. Seen this way, the Data Act is an obligation in every sense.

Stopping at this reading, however, would be too narrow. The regulation addresses a central point of the digital economy: access to data. It reduces the information imbalance between those who make technology and those who use it. It limits technological lock-in. It strengthens companies’ ability to access the data generated by their own operations. In practice, it rebalances the power that comes from information.

For a company that knows how to make use of industrial data, this can mean greater autonomy, new service opportunities, better analytical capabilities and faster innovation.

The real deciding factor is how mature a company is in managing data. An organisation with fragmented archives, poor traceability and little visibility over information flows will see the Data Act as a constraint. An organisation with structured governance, access control and flexible infrastructure will instead be able to use it as a strategic lever.

So the Data Act is not only about compliance: it is also about companies’ ability to adapt to an economy in which value increasingly comes from the quality of data management.

If your company is facing these changes or wants to explore data governance in the age of the new European regulations, keep following the Neurally INK blog for analysis, insights and updates.