12 September 2027: When the Data Act Comes for Your Old Contracts

Most compliance deadlines punish you for what you do next. The Data Act's 12 September 2027 date is different: it reaches backwards, into contracts you signed before the regulation was even final.

The grandfathering everyone assumed, and its expiry date

When the Data Act became applicable on 12 September 2025, its unfair-contract-terms regime under Article 13 applied to new contracts from that date. Existing agreements were left alone, which is why many legal teams filed the Data Act under "next renewal's problem". But the regulation set a second date: from 12 September 2027, the unfair-terms rules are set to extend to certain contracts concluded earlier, generally understood to mean contracts of indefinite duration or those running for at least ten years. The comfortable assumption that old paper stays safe has an expiry date printed on it.

Which old contracts are expected to be caught

The 2027 extension is aimed at long-lived agreements: evergreen MSAs that auto-renew indefinitely, perpetual licences with data clauses, decade-plus supply and maintenance agreements common in industrial and automotive settings. A fixed 24-month contract signed in 2024 will likely simply expire and be replaced on new terms; a 2019 framework agreement that renews forever is exactly the kind of paper the extension is expected to reach. If your revenue depends on a handful of long-term contracts with data clauses drafted before anyone had read the Data Act, those are the documents to pull first.

What happens to a caught clause

Article 13 does not fine anyone. Where a data-related term was unilaterally imposed on a smaller enterprise and is unfair under the regulation's blacklist or grey list, the term is not binding, a court or arbitrator can treat it as if it were never written, while the rest of the contract stands. Typical casualties in pre-2024 drafting: clauses giving the vendor exclusive rights to all generated data, one-sided liability exclusions, terms letting one party unilaterally reinterpret or rewrite data provisions, and restrictions preventing a customer from using data they generated themselves.

Why waiting for 2027 is the expensive option

Three reasons the audit belongs in 2026 rather than the week before the deadline. First, renegotiation takes time: long-term counterparties, procurement cycles and legal review do not compress into a quarter. Second, the alternative to renegotiation is uncertainty: an unenforceable clause is discovered at the worst possible moment, in a dispute, when your liability cap or data-use right silently fails. Third, the same review usually surfaces the rest of your Data Act exposure, switching terms, export duties, transparency gaps, while there is still runway to fix them calmly.

A practical legacy-contract audit

1. Inventory contracts that are indefinite or have ten years or more to run, and flag every clause touching data access, use, liability or remedies.
2. Screen those clauses against the Article 13 blacklist and grey list, the patterns are specific enough that a first pass does not need outside counsel.
3. Sort the failures: clauses to renegotiate at the next natural touchpoint, clauses to redraft proactively, and clauses you can live without if they fall away.
4. Paper the fixes as amendments or addenda rather than waiting for full renewals, most counterparties prefer a targeted data addendum to reopening the whole agreement.

Where this sits in the bigger timeline

The Data Act has been applicable since 12 September 2025, the access-by-design duty for products placed on the EU market since 12 September 2026, and switching charges are expected to be withdrawn from 12 January 2027. The legacy-contract date of 12 September 2027 is the last of the four, which makes it feel distant, but it is the only one that rewrites paper you already signed. Enforcement will be national, in Germany through the Bundesnetzagentur under an implementation act in force since May 2026, though for this particular regime the likelier venue is a dispute with your own counterparty.

Not sure whether Article 13 applies to your contracts at all? Our free readiness assessment takes about three minutes and tells you which Data Act obligations, including the unfair-terms regime, are actually in scope for your company.