Artifact GuideEU

EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test

Decide what applies (and what doesn't), per product and per contract.

Outputs: chapter mapping, roles (user/data holder/data recipient/cloud provider), and the evidence you'll need to implement without rescoping later.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

Treat EU Data Act applicability as a repeatable scoping exercise. You're rarely "in scope" for everything: the same organization can be a data holder for connected products, a data recipient in B2B sharing, and a customer of cloud services (with switching rights). The Data Act applies from 12 September 2025, with additional triggers such as the connected-product design duty for products placed on the market after 12 September 2026 (Article 50).

Section 1

Fast result - which chapters are you likely dealing with?

Use this as your first-pass chapter map. Then confirm with the steps below and write a one-page scope memo per product line and per contract type.

Chapter II (Articles 3-6): connected products/related services -> transparency + user access + third-party sharing workflows
Chapter III (B2B access rules) (Articles 5-12): mandatory sharing with data recipients in B2B scenarios -> operational sharing + safeguards + compensation logic
Chapter IV (Article 13): enterprise-to-enterprise terms unilaterally imposed and unfair -> terms may be non binding (risk concentrates in click through B2B terms)
Chapter V (Articles 14-22): B2G requests based on an 'exceptional need' -> request validation, minimisation, secure disclosure, compensation handling
Chapter VI (Articles 23-31): cloud/data processing services -> switching and exit rights (customers) and switching/portability obligations (providers)

Section 2

Step 0 - gather minimum inputs (don't guess)

Most scoping errors come from missing inputs. Collect product definitions, contracts, and data architecture facts before you decide scope.

Applicability is scenario-based: the same company can be in scope for some activities and out of scope for others.

Portfolio: connected products + related services; EU market placement model; versions and deployment modes
Data map: product data vs related service data; "readily available" extraction path; personal vs non-personal fields
Contracts: B2B data sharing agreements; platform/API terms; cloud contracts; long-duration legacy agreements
Roles: who is the user; who controls access (data holder); who receives data (data recipient/third party)

Section 3

Step 1 - connected products + related services: is Chapter II triggered?

Start with concrete product definitions and a data map. Chapter II becomes implementable only when you can name the dataset generated by use, define what is "readily available", and specify the delivery mechanism (direct vs indirect access).

If you operate in automotive, the Commission's vehicle data guidance is a helpful grounded example of how Chapter II obligations translate into dataset definitions and access rules.

Inventory: connected products and related services placed on the EU market
Dataset definition: product data and related service data; metadata needed to interpret/use the data
Delivery decision: direct access vs indirect request portal; identity verification and security model
GDPR coordination where personal data is involved (lawful basis, roles, privacy notices)

Section 4

Step 2 - identify roles: user, data holder, data recipient, third party

A single ecosystem can have multiple data holders. Identify who controls access to the dataset the user is entitled to, per scenario, because that entity must implement the workflow.

Then document who the user is (consumer or business), who may receive data (data recipients or third parties chosen by the user), and how you authenticate them.

User: owns/rents/leases the connected product or receives the related service
Data holder: controls access to the readily available data (often the platform/API operator)
Data recipient/third party: receives data via user instruction; needs technical + legal onboarding
Evidence: role mapping memo + "who can request what" access control matrix

Section 5

Step 3 - B2B sharing and contracts: Chapter III and Chapter IV triggers

If your business uses contracts to control data access, check two things: (1) are you obliged to share data B2B under Chapter III, and (2) do you have unilaterally imposed terms that can be unfair under Chapter IV (and therefore non binding).

Operationally, this is the contract layer: remedies, liability, trade secret safeguards, pricing/compensation, and dispute handling.

Chapter III: data sharing agreements and mandatory sharing obligations in B2B relations
Chapter IV (Article 13): unilaterally imposed enterprise terms that grossly deviate from good commercial practice, contrary to good faith and fair dealing
High-risk clauses: exclusive interpretation rights, unilateral price changes, limitations on remedies, restrictions on copying/using one's own generated data
Deliverable: contract clause matrix (clause -> Data Act risk -> remediation text)

Section 6

Step 4 - cloud/data processing services: Chapter VI switching obligations

Chapter VI applies to providers of data processing services and creates enforceable customer switching rights and provider obligations. Even if you're not a provider, use Chapter VI as a vendor governance instrument in procurement and renewals.

A fast signal: if you offer cloud-like services (IaaS/PaaS/SaaS) from a service catalog, you must review switching notice periods, transitional periods, exportable data definitions, and switching charges.

Contract gates: maximum notice period <= 2 months; transitional period 30 days (with limited exceptions); retrieval period >= 30 days
Fees: reduced switching charges permitted 11 Jan 2024-12 Jan 2027; no switching charges from 12 Jan 2027
Transparency: online register of exportable data structures/formats and website disclosures on jurisdiction and measures against conflicting international access

Section 7

Step 5 - B2G 'exceptional need' requests: could a public body ask you for data?

Chapter V is not a general data access right. It is limited to an 'exceptional need' that is limited in time and scope, and the request must meet specific content requirements (what data, why, safeguards, sharing, deadlines).

If you hold high-value datasets (mobility, energy, telecom, financial risk signals, supply chain), build a triage playbook now: it's faster than improvising under time pressure.

Exceptional need lanes: public emergency vs non-emergency statutory task (non-personal data only)
SME carve-out: non-emergency lane does not apply to microenterprises and small enterprises
Operational outputs: secure extraction, minimisation, transfer channel, deletion/erasure plan, compensation calculation

Section 8

Deliverable - the 1-page scope memo (the thing that prevents rework)

When teams skip the scope memo, they ship the wrong workflow: they build portals for data they don't control, they miss unfair terms risk, or they underestimate cloud switching obligations.

Write one memo per product line and per contract type and keep it versioned like product documentation.

Chapters that apply and why (include the specific product/service/contract trigger)
Roles per scenario (user, data holder, data recipient, cloud provider/customer)
Dataset definition + extraction method (including metadata, format, and security controls)
Contract remediation list (what clauses must change, owners, and date gates)
Evidence pack (logs, portal specs, security controls, compensation model, dispute playbook)

Recommended next step

Turn EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test into an operational assessment

Assessment Autopilot can take EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test from deciding whether these obligations apply in practice to a reusable workflow inside Sorena. Teams working on EU Data Act: Fair Access to Connected Product Data and Cloud Switching can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test

Start from EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU Data Act: Fair Access to Connected Product Data and Cloud Switching

Review your current process, evidence gaps, and next steps for EU Data Act: Fair Access to Connected Product Data and Cloud Switching Applicability Test.

Explore next step

Primary sources