The EU Data Act and Smart Buildings - What Building Tech Providers Need to Know

Smart buildings run on data. HVAC systems report temperatures and runtimes, elevators log trips and faults, access control systems record entries, and energy management platforms pull it all together. Under the EU Data Act, much of that data stops being the exclusive asset of the equipment manufacturer. Building owners, facility managers and tenants gain rights to it, and the companies that make and operate building technology take on obligations that have been applicable since 12 September 2025.

Why building equipment counts as connected products

The Data Act covers connected products: items that obtain, generate or collect data about their use or environment and can communicate that data. A networked air handling unit, a smart meter, a connected elevator, a building management system sensor or a rooftop solar inverter will typically fall within this definition. The software platforms that come with them, such as a cloud dashboard for monitoring chillers, are likely to count as related services.

The practical consequence is that the user of the equipment, which in a building context is often the owner or the facility management company that leased it, can request the data the equipment generates, free of charge, in a structured and machine-readable format.

Who the user is in a multi-tenant building

Buildings complicate the usual picture because several parties touch the same equipment. The Data Act ties user status to owning, renting or leasing the connected product or receiving the related service. In a typical commercial building, the landlord who bought the HVAC plant is a user, and a facility management firm operating it under contract may also qualify depending on the arrangement. Individual tenants are less likely to be users of central plant they neither own nor lease, though they may be users of in-unit devices such as smart thermostats. Contracts should spell out who holds which rights, because disputes over access are expected to land on whatever the paperwork says.

Access by design is now live for new products

Since 12 September 2026, the access-by-design obligation applies: connected products placed on the market from that date onward are expected to be designed so users can access their data easily, securely and, where relevant, directly on the device. For building equipment with service lives measured in decades, this creates a split estate. A chiller sold in 2024 is subject to the general access rights, while the same model sold in 2027 needs data access designed in. Manufacturers planning product refreshes should treat data access as a design requirement, not an afterthought.

Maintenance data and the aftermarket

Elevator and HVAC maintenance is a large aftermarket, and the Data Act deliberately opens it up. A building owner can direct the data holder to share equipment data with an independent maintenance contractor of their choice. Manufacturers can protect legitimate trade secrets through confidentiality measures, but refusing data outright in order to keep service contracts in-house is the kind of conduct the regulation targets. Enforcement is national: in Germany, the DADG has been in force since 30 May 2026, with the Bundesnetzagentur able to impose tiered fines of up to EUR 500,000, and fines of up to 4 percent of turnover reserved for cases involving personal data under Article 40(4).

Cloud switching for building platforms

Building analytics and energy management platforms are usually cloud services, which brings the switching rules into play. Providers are expected to remove contractual and technical obstacles to switching, and from 12 January 2027 switching charges must be withdrawn. Long-running service agreements deserve a review as well, since the Data Act's rules reach existing contracts from 12 September 2027. The Digital Omnibus package proposes some relief here, including for legacy contracts, but those proposals are not law yet, so planning should assume the current deadlines hold.

Personal data in the building

Access logs, occupancy sensors and camera-adjacent systems often involve personal data, and there the GDPR applies on top of the Data Act. Anonymised or aggregated energy data is the easier case; anything tied to identifiable occupants needs a data protection analysis before it is shared.

Where to start

A sensible first pass is an inventory of every connected product and related service in your portfolio, a map of who the user is for each, and a check of whether your contracts and interfaces could handle an access request tomorrow. Our free readiness assessment at dataactready.org gives you that gap analysis in minutes, tailored to the role you play in the building data chain.