EU Data Act Deadlines: the Full 2025–2027 Timeline

The most common Data Act misunderstanding is that it is one deadline. It is a sequence of them, and several have already passed.

12 September 2025, the law became applicable

Regulation 2023/2854 entered into force in January 2024 and became applicable on 12 September 2025. From that date, the core obligations went live: users' rights to access and share the data their connected products generate, the cloud-switching rules, and the unfair-contract-terms regime for new contracts. If you have been treating the Data Act as a future problem, it has technically been current law for a year.

12 September 2026, access by design

From this date, connected products placed on the EU market (and the related services offered with them) must be designed and manufactured so that product data is, by default, easily, securely and, where relevant and technically feasible, directly accessible to the user. This is the obligation people call access by design. It applies to new products placed on the market from this date, which is why hardware makers and their software partners treated 12 September 2026 as the retrofit-or-redesign deadline.

12 January 2027, switching charges withdrawn

The cloud-switching chapter allowed providers a transition period during which reduced switching charges could still be imposed. From 12 January 2027 that window closes: charges for switching, including data egress fees in a switching context, are expected to be withdrawn. If exit fees are part of a retention strategy for EU customers, that model is on a timer.

12 September 2027, legacy contracts

The unfair-terms rules of Article 13 initially applied to new contracts. From 12 September 2027 they are set to reach certain long-term contracts concluded earlier, which means the old MSA you signed in 2022 does not stay grandfathered forever.

What enforcement looks like

Enforcement is national: each member state designates a competent authority and sets penalties, which must be effective, proportionate and dissuasive. Germany, for example, enforces through the Bundesnetzagentur under its implementation act, in force since 30 May 2026, with tiered fines of up to EUR 500,000 plus GDPR-level exposure where personal data is involved. Other member states are at different stages, but the direction of travel mirrors what happened with GDPR enforcement.

The practical takeaway

Sort your obligations by date. Anything tied to 2025 is already overdue. The access-by-design duty applies to products placed on the market now. The 2027 dates give you a real but shrinking runway on switching fees and legacy contracts. A structured gap review, even a quick one, beats guessing which bucket you are in.