EU Data Act Smart Contracts for Data Sharing

Article 36 applies to smart contracts used for executing data-sharing agreements. The duty is placed on the vendor of an application using smart contracts or, if there is no vendor, the person whose trade, business, or profession involves deploying smart contracts for others to make data available.

Do not scope the page by technology label alone. The key question is whether the program executes an agreement or part of an agreement to make data available. The Commission FAQ also makes clear that Article 36 regulates the computer program used for execution, not the underlying agreement as national contract law.

Article 36 lists essential requirements for the covered execution program. Translate them into release gates, tests, administrative permissions, incident procedures, and evidence before making the smart contract available.

Two separate access-control ideas matter. First, the smart contract must offer access-control mechanisms and a very high degree of robustness to avoid functional errors and manipulation. Second, it must be protected through rigorous access controls at both the governance and smart-contract layers.

Article 36 expressly requires consistency with the terms of the data-sharing agreement that the smart contract executes. Treat the agreement as the source for functional behavior, not as an attachment added after deployment.

Create an agreement-to-code trace before release. Each executable clause should point to a function, event, parameter, permission, oracle, off-chain process, or monitoring rule. Any clause that cannot be represented or tested should be carved out of automated execution or escalated before deployment.

Article 36 requires a mechanism to terminate continued transaction execution and internal functions that can reset, stop, or interrupt operation. Test those functions under ordinary termination, incident response, administrator error, oracle failure, and key-compromise scenarios.

Archiving and continuity must be designed before termination. If a smart contract is terminated or deactivated, Article 36 expects the ability to archive transactional data, smart-contract logic, and code so the record of past data operations remains auditable.

Recital 104 states that interruption and termination imply mutual consent by the parties to the data-sharing agreement. Link technical intervention to the agreement's authorisation and consent process; a stop function does not itself change the parties' legal rights.

Article 36 requires the vendor of the application using smart contracts, or the professional deployer where no vendor exists, to assess conformity with the essential requirements. That actor issues the EU declaration of conformity only after fulfilling those requirements and becomes responsible for compliance by drawing up the declaration.

The practical evidence file should be technical enough for engineering review and structured enough for legal or assurance review. It should prove what was assessed, which version was deployed, which controls were tested, and how the deployed behavior remains tied to the data-sharing agreement.

Before relying on a standards-based conformity route, verify the specific Article 36 harmonised-standard reference in the Official Journal or the applicable Commission implementing act adopting common specifications. A draft, standardisation request, or standards-body update alone does not establish that route.

The Data Act says a smart contract that meets harmonised standards published in the Official Journal is presumed in conformity only to the extent those standards cover the Article 36 requirements. It also allows common specifications as a fall-back where the standardisation route has failed, been delayed, or is insufficient and no relevant harmonised-standard reference is available or expected within a reasonable period.

The Commission's Digital Omnibus proposal COM(2025) 837 would delete Article 36. On 15 October 2026, the European Parliament's Legislative Observatory listed procedure 2025/0360(COD) as awaiting committee decision. The proposed deletion remains a legislative proposal. Apply Article 36 unless and until an adopted amendment takes effect.

Do not claim that automation itself satisfies Article 36. The defensible claim is narrower: the vendor or deployer assessed a specific smart contract version against the Article 36 essential requirements and issued a declaration only if those requirements were fulfilled.

Do not add unsupported penalties, thresholds, or certification labels. The Commission materials in the cited sources say penalties are set by Member States and should be effective, proportionate, and dissuasive; they do not provide an Article 36-specific fine table for this page.