European Data Act: Access by Design Obligations for IoT

1. The facts

   The case concerns the implementation of Regulation (EU) 2023/2854, which entered into force in 2024, specifically focusing on the September 12, 2026 deadline. According to reports from publications like Agenda Digitale and Focus Namirial IT, manufacturers of connected devices are currently in a phase of mandatory compliance. The heart of the dispute is not a single trial, but a systemic conflict: the obligation to design hardware and software so that data is accessible «by default».

   Currently, the process is at the stage of regulatory dialogues and initial opinions from supervisory authorities, including the Data Protection Authority. Many companies have raised objections regarding the alleged technical impossibility of separating raw data, belonging to the user, from inferred data, which often incorporates protected algorithms. A season of preventive litigation is emerging to define the limits of EU-imposed transparency versus the right to industrial confidentiality.

2. 

   The rules in play

   1. Article 3 of the Data Act imposes the Access by Design obligation, establishing that products must be designed to make generated data directly accessible to the user.
   2. Articles 4 and 5 regulate data sharing, requiring the holder to provide information to the user or authorized third parties without undue delay.
   3. Article 4(3) introduces the so-called Trade Secret Handbrake, allowing restricted sharing to protect trade secrets, but only subject to strict confidentiality measures.
   4. Article 40 establishes severe financial penalties, modeled on the GDPR, which can reach 20 million euros or 4% of total annual global turnover.

3. What the jurisprudence says

   Although specific jurisprudence on the Data Act is still developing, European Union case law has already established fundamental guidelines. The Court of Justice of the European Union (CJEU) has clarified that trade secrets do not constitute an absolute right and cannot be invoked to systematically deny access to data or algorithmic logic, especially when access is intended to ensure competition or user rights.

   The established orientation indicates that balancing transparency and intellectual property must be resolved through the principle of proportionality. In other words, the manufacturer must demonstrate a risk of serious economic harm to deny data access, as a generic designation of secrecy is insufficient. The protection of know-how thus shifts from data secrecy to protecting the processing method, preserving innovation without paralyzing the IoT ecosystem.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Contractual review: it is essential to remove clauses claiming exclusive ownership of user-generated data, as they are susceptible to being deemed unfair.
   2. Tech-legal audit: lawyers must collaborate with technical teams to distinguish raw data from inferred data before disputes arise.
   3. Trade secret strategy: protocols for protected disclosure must be drafted to comply with Data Act obligations without exposing source code or proprietary formulas.
   4. Regulatory monitoring: following the evolving guidelines of national Authorities is necessary to establish the threshold of serious economic damage required for a lawful denial.

References: Regolamento (UE) 2023/2854 (Data Act)Direttiva (UE) 2016/943 (Segreti Commerciali)Regolamento (UE) 2016/679 (GDPR)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 10 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction