Buying a machine does not automatically mean buying the data it produces. Operating hours, temperature curves, fault codes and cycle times are generated on your own shop floor, yet they often sit on the manufacturer's server, reachable only through its portal and its price list. The European data regulation rearranges exactly that relationship. It has applied since 12 September 2025 (Regulation 2023/2854); 12 September 2026 is the day it reaches the hardware. From then on, newly placed connected products must be built so that the operator can reach the data without having to ask (Regulation 2023/2854). This article sorts the key dates, names the exemptions for small manufacturers and describes what to prepare so that a right turns into a usable data stream.
Key takeaways
- The deadline concerns new equipment. The duty to build connected products for access from the outset applies to products placed on the market after 12 September 2026 (Regulation 2023/2854).
- Access is the default, not the exception: product data, related service data and the associated metadata must be available by default, easily, securely and free of charge in a structured, commonly used and machine-readable format (Regulation 2023/2854).
- Micro and small enterprises acting as manufacturers remain exempt as long as no larger group stands behind them (Regulation 2023/2854). The thresholds: fewer than 10 persons and 2 million EUR, or fewer than 50 persons and 10 million EUR (Recommendation 2003/361/EC).
- The second date concerns the cloud, not the machine. From 12 January 2027, providers of data processing services may no longer charge switching fees (Regulation 2023/2854) - relevant for the 52.74 percent of EU enterprises that use paid cloud services (Eurostat).
- The competent authority in Germany is the Federal Network Agency (DADG). For manufacturers and data holders fines reach up to 500 000 euros; the five million euro tier applies only to designated gatekeepers (DADG). Where personal data is involved, the GDPR applies on top.
What actually starts on 12 September 2026
The data regulation is no longer an announcement. It has applied since 12 September 2025 (Regulation 2023/2854), and the data sharing obligations have been enforceable since then. What arrives in September 2026 is narrower and at the same time more consequential: from that day the design obligation in Article 3(1) applies to connected products and related services placed on the market after 12 September 2026 (Regulation 2023/2854). For a company procuring plant in 2027, that is the decisive question in the specification.
Existing machines are unaffected as far as their construction is concerned. A 2019 line cannot be forced to grow an interface. The right to the data the holder actually keeps exists independently; in practice it founders on which values are recorded at all. To learn what the installed base delivers, start with an inventory of the existing data points - that is a week of work, not an investment decision.
A third date concerns contracts. Chapter IV of the regulation, which addresses unfair terms between businesses, applies to contracts concluded on or before 12 September 2025 only from 12 September 2027 - and even then only if the contract is of indefinite duration or its term ends no earlier than 11 January 2034 (Regulation 2023/2854). A fixed-term maintenance or service contract expiring before that date does not fall under Chapter IV at all. For the remaining legacy maintenance, remote service and analysis contracts the grace period ends in autumn 2027. By then it should be known which clauses will no longer hold. The Commission in turn must evaluate the regulation by 12 September 2028 and report to the European Parliament (Regulation 2023/2854); further tightening is to be expected.
Three dates that do not mean the same thing
Which data is meant and who receives it
Article 3(1) describes not a right to information on request but a property of the product. Connected products must be designed and manufactured so that product data and related service data, including the relevant metadata necessary to interpret and use those data, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible (Regulation 2023/2854). Every word there has consequences. Machine-readable rules out the monthly PDF report. By default rules out unlocking against a surcharge.
Metadata is the part most often missing. Anyone moving machine data into an existing system needs the same care as in a data migration from a legacy system: meaning, unit and reference belong to the value, otherwise you build an archive instead of a data set.
| Role | What the regulation provides | Reference |
|---|---|---|
| User, meaning the operator of the machine | access by default, easily, securely, free of charge and machine-readable | Article 3(1) (Regulation 2023/2854) |
| Data holder, usually the manufacturer | provides the data and may not obstruct access technically or contractually | Chapter II (Regulation 2023/2854) |
| Third party instructed by the user, such as a service firm | receives the data at the user's request | Chapter II (Regulation 2023/2854) |
| Micro or small enterprise as manufacturer | exempt from the Chapter II obligations as long as no larger group stands behind it | Article 7(1) (Regulation 2023/2854) |
| Medium-sized enterprise in the first twelve months | one year of deferral, likewise every product in its first year after being placed on the market | Article 7(1) (Regulation 2023/2854) |
| Provider of data processing services | no switching charges from 12 January 2027 | Article 29(1) (Regulation 2023/2854) |
The third row is the most important one in practice. A company need not master the analysis itself; it can name a third party to receive the data on its behalf. Who gets the data is decided by the operator, not by the manufacturer.
Who stays exempt: the thresholds of the SME recommendation
The obligations of Chapter II do not apply to data from connected products manufactured or designed by a micro or small enterprise, provided that enterprise has no partner or linked undertaking above that threshold and has not been engaged as a subcontractor (Regulation 2023/2854). The exemption is narrower than it sounds: the partner rule starts at 25 percent of the capital or the voting rights (Recommendation 2003/361/EC, Annex Article 3(2)), and a design firm developing on behalf of a larger manufacturer is expressly not covered.
- Micro enterprise: fewer than 10 persons and at most 2 million EUR annual turnover or balance sheet total (Recommendation 2003/361/EC)
- Small enterprise: fewer than 50 persons and at most 10 million EUR annual turnover or balance sheet total (Recommendation 2003/361/EC)
- Upper limit of the SME definition: fewer than 250 persons and at most 50 million EUR turnover or 43 million EUR balance sheet total (Recommendation 2003/361/EC)
- Medium-sized enterprises: one year of deferral from classification, plus one year per product from being placed on the market (Regulation 2023/2854)
- Group rule: the exemption falls away as soon as a partner or linked undertaking exceeds the threshold (Regulation 2023/2854)
For purchasing this has an uncomfortable consequence. Buying a special-purpose machine from a design firm with eight employees, a company will as a rule not be able to invoke the access obligation. If it buys the same machine from a manufacturer with 300 employees, it can. Two sentences in the specification fixing format, scope and access route for operating data cost nothing and save a later negotiation from the weaker position.
Conversely, small manufacturers should not plan around the exemption as a permanent state. Those who grow lose it; subcontracted designers do not have it at all.
The second deadline concerns the cloud, not the machine
Chapter VI of the regulation governs something other than machine access, namely switching between data processing services. From 12 January 2027, providers may no longer impose switching charges for the completion of the switching process (Regulation 2023/2854). During the transitional phase from 11 January 2024 to 12 January 2027, reduced charges are permitted (Regulation 2023/2854). This is not a fringe topic: 52.74 percent of EU enterprises with more than ten employees used paid cloud services in 2025 (Eurostat).
Beyond that, the contract must contain the periods that make a switch possible in the first place. The notice period for initiating the switch may not exceed two months (Regulation 2023/2854). After that a mandatory transitional period of at most 30 calendar days remains for transferring all exportable data and digital assets (Regulation 2023/2854). The customer then has a minimum period of 30 calendar days to retrieve their data (Regulation 2023/2854). Three periods that add up to around four months - and that many existing contracts do not contain in this form.
If the switch is technically not feasible within that time, the provider must notify this within 14 working days of the request, give reasons and state a replacement period that may not exceed seven months (Regulation 2023/2854). A further period applies to connectivity: after common interoperability specifications are published, at least twelve months remain to become compatible (Regulation 2023/2854).
Service: machine data analysis (externally operated)
Contract status: renewed 03/2026, term 24 months
T-0 switch initiated (in writing, with confirmation of receipt)
T+2M end of notice period -> max. 2 months
T+2M+30d handover of all exportable data -> max. 30 calendar days
T+3M+30d end of retrieval period -> min. 30 calendar days
Special case technically not feasible:
provider notifies within 14 working days
replacement period at most 7 months
Filing: contract file, export log, deletion recordThe link to the machine topic is closer than the chapter boundary suggests. Machine data usually ends up in a service operated by a third party. The question of whether an own server or a data centre makes more sense therefore arises under new conditions.
What an access right is worth in practice
The Commission justified its proposal with a figure that has since made a career of its own: on its assessment, 80 percent of industrial data goes unused (European Commission). For the expected effect it names 270 billion EUR of additional economic output by 2028 (European Commission). Both are expectations from 2022 and not measurements; they serve as a direction, not as a business case.
The survey data on adoption is more solid. 29 percent of EU enterprises with ten or more employees used connected devices (Eurostat); among large enterprises it was 48 percent against 26 percent among small ones (Eurostat). The survey draws on 148 000 enterprises surveyed out of roughly 1.5 million in the EU (Eurostat). Only 24 percent of enterprises using connected devices used sensors to monitor the condition of their machinery (Eurostat) - precisely the type of data the data regulation is about.
The second gap is not about access but about analysis. 33.02 percent of EU enterprises analysed data with their own staff (Eurostat), and 46.45 percent operated an ERP system (Eurostat) into which machine data could flow at all. A right to data nobody reads changes nothing on the shop floor. Every access project therefore needs an answer to the question of which metric will look different at the end - before the first cable, not after the first invoice.
Condition-based maintenance
Running times, temperatures and fault clusters produce a service date driven by load rather than by the calendar. That assumes the raw values are held in house, not only shown as a traffic light in a portal.
Spare parts and wear
The cycle count per assembly lets you order wear parts by consumption instead of by rule of thumb.
Energy per job
Consumption values attach to a job as soon as machine and job data carry the same time stamp. A line on the annual invoice thereby becomes a figure in the costing.
Quality records
Process values from the plant document the conditions under which a batch was produced.
Utilisation without guesswork
Downtime, setup times and cycle times come from the controller instead of from a tally sheet.
Putting maintenance out to tender
A third party instructed by the operator receives the data. That makes it possible to tender maintenance instead of extending it without a comparable quote.
None of these points requires a large programme. They do require the data to arrive regularly and in the same form - and someone to notice when it stops. Data projects fail on that more often than on the analysis, as shop floor feedback shows on a smaller scale.
From a right to a usable data stream
The access the regulation demands is technical access. It ends at an interface and not in a finished report. That means there has to be a place that receives the stream, checks it and passes it on. Whether a direct connection suffices or an intermediate layer is needed depends mainly on the number of sources; the trade-off is the same as in any decision between an interface and manual work.
Before the first line of code comes a catalogue. Which signals does the plant deliver, in which unit, at which interval and with which reference to job, item and site? Without that mapping you get a file, not a data set. In data integration projects we build the catalogue before the connection, because every later change to meaning or unit is paid for twice - once in the technology and once in every analysis built on top of it.
{
"plant": "PR-04",
"manufacturer_is_data_holder": true,
"placed_on_market": "2027-02-11",
"signals": [
{ "name": "spindle_temperature", "unit": "degC", "interval_s": 5,
"meaning": "front bearing temperature", "reference": "machine" },
{ "name": "cycle_end", "unit": "counter", "interval_s": 0,
"meaning": "completed cycle", "reference": "job" },
{ "name": "energy_active", "unit": "kWh", "interval_s": 60,
"meaning": "meter reading", "reference": "job" }
],
"timezone": "Europe/Berlin",
"personal_data": "none (operator ID not taken over)"
}For the stream to hold, every source needs monitoring. A sensor that has reported the same value for eleven days is a failure, not a measurement. What that looks like is set out in monitoring interfaces properly; with machine data there is the added difficulty that a frozen value looks plausible and is therefore rarely noticed. Anyone running the connection themselves will find the building blocks under integrations.
Supervision and fines in Germany
Since the implementing act of 26 May 2026, the Federal Network Agency is the competent authority for applying and enforcing the data regulation (DADG). For companies on the user side that matters: a dispute over refused data access no longer has to be fought through civil courts alone.
Fines are graduated, and the top tier reaches a very small circle. Five million euros applies only to undertakings designated as gatekeepers under Article 3 of Regulation (EU) 2022/1925 that ask a user to hand over data or use commercial incentives to that end (DADG). For manufacturers and data holders the range ends at 500 000 euros; further offences sit at 100 000 and 50 000 euros (DADG). The fine of up to 2 percent of total turnover hangs on that same gatekeeper offence and additionally requires more than 250 million EUR in total turnover (DADG). And the operator who demands access carries risk as well: using the data obtained to develop a competing product, or passing it on for that purpose, is covered by up to 500 000 euros (DADG).
When machine data carries personal information
An approach in five steps
The topic looks bigger than it is because it starts with a regulation text. It breaks down into five manageable steps, the first three of which need no budget. Follow the order: starting with the technology means building twice.
Step 1: take stock
Which plant is connected, who is the data holder, and which data leaves the building today? A list with plant, manufacturer, contract status and existing access is enough as a basis and takes a morning.
Step 2: review contracts
Maintenance, remote service and support contracts are read for data access clauses. For contracts dated 12 September 2025 or earlier, the Chapter IV requirements apply only from 12 September 2027, and only where the contract is of indefinite duration or ends no earlier than 11 January 2034 (Regulation 2023/2854) - exactly the window in which an amendment can be negotiated without pressure. If a fixed-term contract expires before that, data access there stays a contractual matter.
Step 3: define the need
Not everything a plant delivers is needed. The metric produces the list of signals, the signals produce the necessary interval, and only then comes the data volume.
Step 4: adjust procurement
Format, scope, interval and access route belong in the specification and in acceptance. With manufacturers below the small enterprise threshold this remains a negotiation and does not become an obligation (Regulation 2023/2854); even then the point is cheaper before the award than after it.
Step 5: build the intake and monitor it
One plant is connected first, with catalogue, storage and monitoring; the pattern is then replicated.
Which plant is connected, who is the data holder, and which data leaves the building today? A list with plant, manufacturer, contract status and existing access is enough as a basis and takes a morning.
Maintenance, remote service and support contracts are read for data access clauses. For contracts dated 12 September 2025 or earlier, the Chapter IV requirements apply only from 12 September 2027, and only where the contract is of indefinite duration or ends no earlier than 11 January 2034 (Regulation 2023/2854) - exactly the window in which an amendment can be negotiated without pressure. If a fixed-term contract expires before that, data access there stays a contractual matter.
Not everything a plant delivers is needed. The metric produces the list of signals, the signals produce the necessary interval, and only then comes the data volume.
Format, scope, interval and access route belong in the specification and in acceptance. With manufacturers below the small enterprise threshold this remains a negotiation and does not become an obligation (Regulation 2023/2854); even then the point is cheaper before the award than after it.
One plant is connected first, with catalogue, storage and monitoring; the pattern is then replicated.
Anyone who has completed steps one to three can answer the budget question without guessing. And they hold a document that keeps even if the connection arrives the year after next. For companies who want to walk the path with support, that is the usual entry into a data integration project; the effort for the first three steps is a few person-days.
Access is not the goal
What comes next
- Plant list with manufacturer, year of construction, connectivity and current data access
- Maintenance and service contracts reviewed, with the date of conclusion for each contract
- For procurement from 2026: format, scope, interval and access route in the specification
- Signal catalogue per plant, with unit, interval, meaning and reference to job and site
- Storage location and retention settled, including the question of personal data
- Monitoring per source that reports frozen values and missing deliveries
- A named person who requests data access from the manufacturer and follows it up
- The result of the stocktaking in writing, so that it survives the next procurement
The order matters more than the pace. For ongoing operations the usual caution applies: changes to a productive plant belong in a window that does not stop production - the approach is described in applying updates without downtime. And when requests and commitments from the manufacturer land in a shared mailbox, the route from a shared mailbox to a traceable case helps so that the commitment is still findable in autumn 2027. Whatever is recorded in the end belongs in the process documentation.
The sentence that saves a data project is not in the statute but in the specification. Two lines settle in which format and by which route the operating data leaves the building.
Sources and studies
Related Articles
Packaging reporting driven by the item master
Which field is missing on the item, how packaging weights per variant and shipping carton are maintained, and how delivery note quantities become a defensible reported tonnage per material type.
Verification of payee in payment runs: handling mismatches
Since October 2025, banks check name and IBAN before every credit transfer. How supplier master data, payment blocks and call-backs handle the bank's responses.
Interim Payments and Variations on Building Sites
How a stage of completion becomes an interim invoice, why a variation is a case with a deadline of its own, and how that produces a final account that can be checked without rework.