What the EU Data Act Means for Industrial Machinery Makers

Industrial machinery is one of the quietest but largest battlegrounds of the EU Data Act. A modern production line generates enormous volumes of sensor data: spindle loads, cycle times, vibration signatures, energy draw, error codes. Until now, the machine builder typically decided who saw that data, and many monetised it through proprietary monitoring platforms and service contracts. The Data Act, applicable since 12 September 2025, changes the default. The factory operating the machine, as the user, is expected to have the right to access the data its equipment generates and to share it with third parties of its choosing.

Industrial equipment counts as a connected product

The Data Act covers connected products: items that obtain, generate or collect data concerning their use or environment and can communicate that data. A CNC machining centre with a telemetry module, an industrial robot reporting to a cloud dashboard, a networked compressor or injection moulding machine are all likely to qualify. The related services that come with them, such as condition monitoring portals and predictive maintenance subscriptions, are covered too.

Business-to-business settings are squarely in scope. The Data Act is not a consumer-only regulation, and the user entitled to data access can be a company. In the industrial context, that user is usually the factory that bought or leased the machine, not the machine builder.

What machine builders now have to do

Three obligations stand out. First, data access on request: the user can ask for the readily available data its machines generate, generally free of charge and without undue delay. Second, third-party sharing: the user can direct that data to an independent maintenance provider, an analytics startup or an insurer. This is the provision that worries original equipment manufacturers most, because it opens the aftermarket. A plant can now hand its vibration and usage data to a third-party service firm instead of being locked into the builder's own service organisation. Third, transparency before contract: buyers must be told what data the machine generates, how it can be accessed, and how long it is retained.

For new machine designs, the bar has risen further. Since 12 September 2026, the access-by-design requirement has been in force: where technically feasible, products should be designed so users can access their data directly, simply and securely. Machine builders designing the next generation of controllers should be treating user data access as a design input alongside safety and EMC requirements, not as an afterthought handled by the legal team.

Trade secrets and the limits of sharing

Machine builders rightly worry that usage data can reveal proprietary know-how, from control algorithms to the performance envelope of a machine. The Data Act does not simply override trade secret protection. Data holders can require confidentiality measures before disclosure, and in exceptional cases sharing can be suspended or refused where serious harm to trade secrets is likely, subject to notification requirements. What the Act does not allow is using trade secrets as a blanket excuse to deny access. Builders are expected to identify what is actually secret, document it, and agree protective measures, rather than refusing wholesale.

Contract terms deserve equal attention. Clauses that unilaterally exclude data access or impose one-sided liability on the weaker party may be caught by the unfairness rules, and existing long-term supply and service agreements should be reviewed. Legacy contracts are expected to need alignment by 12 September 2027.

Enforcement is taking shape

Enforcement runs through national authorities, and Germany, home to much of Europe's machine tool industry, moved early. Its implementing law, the DADG, has been in force since 30 May 2026, with the Bundesnetzagentur enforcing through tiered fines of up to EUR 500,000. Where personal data is involved, for example operator-linked usage logs, GDPR-level fines of up to 4% of worldwide turnover can apply under Article 40(4), but only in those personal data scenarios.

Some relief may eventually come from Brussels. The Digital Omnibus proposals would soften parts of the Data Act, including possible exemptions for legacy contracts and lighter obligations for smaller firms, but these are proposals only and are not law yet. Planning on the current rules is the safer course.

Practical first steps for machine builders

Start with an inventory: which of your machines and related services generate data, what data is readily available, and where does it flow today? Then look at your contracts, your service business model, and your trade secret documentation. Many builders find that the Data Act is as much a commercial strategy question as a compliance one, because the aftermarket is now contestable.

If you want to know how exposed your product line is, our free Data Act readiness assessment takes a few minutes and gives you a structured view of which obligations apply to your machines, your contracts and your deadlines.