Designing connected products and related services for data access by default
Severity HighArt. 3(1), Art. 50
Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, including the metadata necessary to interpret and use them, are by default easily, securely and free of charge available to the user in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible. The obligation applies to connected products and related services placed on the EU market after 12 Sep 2026.
- Applies when
- Chinese companies selling data-collecting, connected hardware into the EU: service robots, humanoid robots, cleaning robots, smart cameras, wearables, in-vehicle systems and industrial sensing and inspection equipment. This is a product-architecture requirement that cannot be contracted around and must be scheduled into the hardware and firmware roadmap.
- Deadline: Applies to connected products and related services placed on the EU market after 12 Sep 2026.
- Applies from: 2026-09-12
- Evidence to retain
- · Product data dictionary and list of exportable data items including metadata definitions
- · Specification of the data access interface covering format, authentication, rate limits and real-time behaviour
- · Design review records evidencing access by default
- · Evidence of the date the product was placed on the EU market, for the transition-period assessment
Estimated first-time effort: 20–60 person-days (estimate, not a commitment)
Pre-contractual information about data
Severity MediumArt. 3(2), Art. 3(3)
Before concluding a contract for the purchase, rent or lease of a connected product, the seller, rentor or lessor (which may be the manufacturer) must inform the user clearly and comprehensibly of at least: the type, format and estimated volume of product data the product can generate; whether it can generate data continuously and in real time; whether data is stored on-device or on a remote server, including the intended retention period; and how the user may access, retrieve or where relevant erase the data, including the technical means, terms of use and quality of service. Before concluding a related-service contract the provider must explain the nature, estimated volume and collection frequency of the product data it expects to obtain, the nature and estimated volume of related service data, access and retrieval arrangements, storage arrangements and retention periods.
- Applies when
- Chinese companies selling connected products to EU users through EU distributors, their own e-commerce or direct sales, and the providers of the accompanying apps and cloud services. The information must appear on the sales page, in the manual and in the service terms, not only in internal documentation.
- Deadline: To be provided before the relevant contract is concluded.
- Applies from: 2025-09-12
- Evidence to retain
- · Pre-contractual data information text for each sales channel
- · Corresponding sections in the product manual and service terms
- · Consistency check between the disclosure and the product’s actual data capabilities
Estimated first-time effort: 5–12 person-days (estimate, not a commitment)
Making data available to the user and sharing it with third parties on the user’s instruction
Severity HighArt. 4, Art. 5
Where data cannot be accessed directly from the product or related service, the data holder must make readily available data and the necessary metadata accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely and free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real time, on the basis of a simple electronic request where technically feasible. The user may also require the data holder to make that data available to a third party of the user’s choosing on equivalent terms. The data holder may contractually restrict or prohibit sharing only where it could undermine statutory product security requirements with a serious adverse effect on health, safety or security of natural persons, and must notify the competent authority designated under Art. 37 when it refuses. Undertakings designated as gatekeepers under the Digital Markets Act cannot be eligible third parties.
- Applies when
- Chinese smart-hardware and robotics companies acting as data holders. The commercial implication is blunt: an EU customer can require you to hand device operating data to your competitor for maintenance or analytics, and you cannot refuse on commercial grounds — only on the statutory safety ground, with notification to the competent authority.
- Applies from: 2025-09-12
- Evidence to retain
- · SOP for receiving and fulfilling user data requests
- · Service quality metrics and fulfilment records for the data-provision interface
- · Verification and execution records for third-party sharing authorisations
- · Determination documents where sharing is refused on safety grounds, plus the notification to the competent authority
Estimated first-time effort: 15–40 person-days (estimate, not a commitment)
Reviewing business-to-business data contracts for unfair terms
Severity MediumArt. 13
A contractual term concerning access to and use of data, or liability and remedies for the breach or termination of data-related obligations, that has been unilaterally imposed by one enterprise on another is not binding on the latter if it is unfair. A term is unfair where its use grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. Art. 13(4) lists terms that are unfair in any event, including those excluding or limiting the imposing party’s liability for intentional acts or gross negligence, and those excluding the remedies available to the other party for non-performance or the imposing party’s liability for it. Terms reflecting mandatory Union law provisions, or Union law that would apply absent the term, are not unfair.
- Applies when
- Chinese companies supplying APIs, SDKs, data services or model services to EU business customers or suppliers. Typical risk clauses: blanket exclusions of liability for data loss, prohibitions on customers exporting their own data, and unilateral rights to change data interfaces or terminate data supply at will without a transition period.
- Deadline: Applies to contracts concluded after 12 Sep 2025; certain legacy long-term contracts are caught from 12 Sep 2027.
- Applies from: 2025-09-12
- Evidence to retain
- · Unfair-terms self-assessment of EU-facing standard contracts and clause libraries
- · Item-by-item comparison against the Art. 13(4) list
- · Revised clause versions and their effective dates
Estimated first-time effort: 5–15 person-days (estimate, not a commitment)
Supporting switching of data processing services and withdrawing switching charges
Severity HighArt. 23, Art. 25, Art. 29, Art. 30
Providers of data processing services must take the measures in Arts. 25, 26, 27, 29 and 30 to enable customers to switch to another provider of the same service type, to on-premises ICT infrastructure, or where relevant to use several providers at once, and must remove commercial, technical, contractual and organisational obstacles to terminating the contract, concluding a new contract with another provider, and porting exportable data and digital assets, including after using a free tier. From 12 Jan 2027 no switching charges may be imposed; between 11 Jan 2024 and 12 Jan 2027 only reduced charges not exceeding the costs directly linked to the switching process are allowed. Before contracting, providers must clearly inform prospective customers of standard service fees, early-termination penalties and any reduced switching charges applicable during the transition, and must publish that information in a dedicated section of their website or another easily accessible way.
- Applies when
- Chinese companies providing cloud, edge, model-hosting, vector-database or AI training platform services to EU customers. The implication is that egress fees, proprietary formats and missing export interfaces cannot be used to lock customers in; export capability must be built as a product feature rather than granted case by case after the sale.
- Deadline: Switching support applies from 12 Sep 2025; the full withdrawal of switching charges applies from 12 Jan 2027.
- Applies from: 2025-09-12
- Evidence to retain
- · Description of switching support (export interfaces, data formats, scope of digital assets, migration assistance)
- · Switching-charge policy and implementation records for the withdrawal from 12 Jan 2027
- · Pre-contractual fee disclosure page and the corresponding contract clauses
- · Records of customer switching requests received and completed
Estimated first-time effort: 20–60 person-days (estimate, not a commitment)
Preventing unlawful third-country governmental access to non-personal data held in the Union
Severity CriticalArt. 32
Providers of data processing services must take all adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where such access or transfer would conflict with Union law or the national law of the relevant Member State. A third-country court, tribunal or administrative decision requiring transfer or access is recognised or enforceable only if based on an international agreement in force between the requesting third country and the Union or a Member State, such as a mutual legal assistance treaty. Absent such an agreement, transfer or access may occur only where the three cumulative conditions in Art. 32(3) are met: the third-country system requires the reasons and proportionality of the decision to be set out and requires it to be specific in character; the addressee’s reasoned objection is subject to review by a competent third-country court; and that court is empowered to take due account of the relevant legal interests of the data provider protected by Union or Member State law.
- Applies when
- Chinese cloud and AI platform companies holding customer data inside the EU. This is one of the sharpest questions in EU customer due diligence: buyers will ask for a written account of how you handle, and refuse, an access demand from a Chinese authority.
- Applies from: 2025-09-12
- Evidence to retain
- · Government access request policy and escalation process
- · Description of technical and organisational separation measures such as data residency, key custody and access approval
- · Contractual arrangements with customers and within the group restricting extraterritorial access
- · Register of access requests received, how they were handled, and notifications to customers
Estimated first-time effort: 10–30 person-days (estimate, not a commitment)