EU Data Act Smart Contracts for Data Sharing

Article 36 applies to smart contracts used for executing data-sharing agreements. The duty is placed on the vendor of an application using smart contracts or, if there is no vendor, the person whose trade, business, or profession involves deploying smart contracts for others to make data available.

Do not scope the page by technology label alone. The key question is whether the program executes an agreement or part of an agreement to make data available. The Commission FAQ also makes clear that Article 36 regulates the computer program used for execution, not the underlying agreement as national contract law.

Article 36 is not a general blockchain policy. It lists essential requirements that need to be translated into release gates, tests, administrative permissions, incident procedures, and evidence before the smart contract is made available.

Two separate access-control ideas matter. First, the smart contract must offer access-control mechanisms and a very high degree of robustness to avoid functional errors and manipulation. Second, it must be protected through rigorous access controls at both the governance and smart-contract layers.

Article 36 expressly requires consistency with the terms of the data-sharing agreement that the smart contract executes. Treat the agreement as the source for functional behavior, not as an attachment added after deployment.

Create an agreement-to-code trace before release. Each executable clause should point to a function, event, parameter, permission, oracle, off-chain process, or monitoring rule. Any clause that cannot be represented or tested should be carved out of automated execution or escalated before deployment.

Article 36 requires more than an emergency pause button. The contract needs a mechanism to terminate continued transaction execution and internal functions that can reset, stop, or interrupt operation. Those functions should be tested under ordinary termination, incident response, administrator error, oracle failure, and key-compromise scenarios.

Archiving and continuity must be designed before termination. If a smart contract is terminated or deactivated, Article 36 expects the ability to archive transactional data, smart-contract logic, and code so the record of past data operations remains auditable.

Article 36 requires the vendor or professional deployer to perform a conformity assessment against the essential requirements and issue an EU declaration of conformity when those requirements are fulfilled. Drawing up the declaration carries responsibility for compliance with those requirements.

The practical evidence file should be technical enough for engineering review and structured enough for legal or assurance review. It should prove what was assessed, which version was deployed, which controls were tested, and how the deployed behavior remains tied to the data-sharing agreement.

Article 36 creates a standards route, but the source set for this page does not show an Article 36 harmonised standard reference already published in the Official Journal or an Article 36 common specification already adopted. Therefore, do not present a draft, standardisation request, or standards-body update as a completed conformity route for Article 36.

The Data Act says a smart contract that meets harmonised standards published in the Official Journal is presumed in conformity only to the extent those standards cover the Article 36 requirements. It also allows common specifications as a fall-back where the standardisation route has failed, been delayed, or is insufficient and no relevant harmonised-standard reference is available or expected within a reasonable period.

Do not claim that automation itself satisfies Article 36. The defensible claim is narrower: the vendor or deployer assessed a specific smart contract version against the Article 36 essential requirements and issued a declaration only if those requirements were fulfilled.

Do not add unsupported penalties, thresholds, or certification labels. The Commission materials in this grounding set say penalties are set by Member States and should be effective, proportionate, and dissuasive; they do not provide an Article 36-specific fine table for this page.