From 12 September 2026, the EU Data Act's "access by design" principle applies to any new connected product and its companion software. If you build the app, dashboard or cloud service that pairs with a physical device — a wearable, a piece of equipment, a smart-home product, anything with a sensor and a network connection — this deadline is yours even though you may never have thought of yourself as covered by hardware regulation.
What actually changes on this date
Since September 2025, the Data Act has required that users be able to request access to the data their connected product generates. From 12 September 2026, that shifts to a stronger default: connected products and their related services placed on the market after this date must be designed so that relevant data is, by default, easily, securely and directly accessible to the user — free of charge, without a support ticket or a data-request form standing in the way.
"Related service" is the term that pulls software into scope. It is not just the physical device — it is any digital service that enables, enhances or is connected to that product's core function. A companion app for a fitness tracker, an analytics dashboard for connected industrial equipment, a cloud service that a smart lock depends on to function: all of these are related services under the Act, and the obligation applies to providers of related services irrespective of where they are established, not only EU-based companies.
The nuance that should calm you down a little
The obligation to provide direct access is explicitly not absolute — it applies "where relevant and technically feasible." If your product already gives users a way to view and export their own data through an account or portal, even if it takes a couple of clicks rather than being fully automatic, the practical gap between where you are and where this deadline wants you to be may be smaller than the regulation's name suggests. This is a genuine escalation for products that currently make users file a request and wait, not necessarily a rebuild for products that already offer reasonably direct self-service access.
It also only bites on products and services placed on the market after 12 September 2026. An existing product you shipped last year is not retroactively required to be redesigned to this stricter standard — though it remains subject to the request-based access obligation that has applied since September 2025.
What is actually at stake
Enforcement sits at GDPR scale: member states are arming regulators with fines of up to 4% of global annual turnover. That is not a number attached to a paperwork formality — it is the same ceiling used for the EU's most seriously enforced digital regulation, applied here to data access design.
What to check this week
Decide if you are in scope at all. If your product has no physical, connected-device counterpart — you are a pure SaaS tool with no hardware relationship — the Data Act's connected-product provisions are very likely not about you. This deadline is specifically for the companion-software layer of hardware products.
If you are launching a new connected product or a new companion service after 12 September, build the data-export or data-view feature into the launch scope now rather than as a follow-up release. Retrofitting "give users direct access to their own data" after a design is locked is always more expensive than including it from the start.
If you already ship one, audit how a user actually gets their data today. If the honest answer involves emailing support or waiting on a manual export, that is the gap this deadline is aimed at, and it is worth closing regardless of the exact enforcement timeline your specific product falls under.
The bottom line
Connected hardware gets the headline, but the obligation reaches the software layer sitting on top of it — any related service, run by any company, anywhere. If you build the app side of a connected product, check whether your users can get their own data directly today, and if the answer is "only if they ask," treat 12 September as the deadline it actually is rather than hardware-sector news that does not apply to you.
This is general information, not legal advice. Scope and enforcement details vary by product category — confirm your specific obligations with EU regulatory counsel.