What Counts as a Connected Product (and a Related Service)?

Whether the Data Act's heaviest chapter applies to you turns on two definitions in Article 2. Both are broader than intuition suggests, and one of them regularly surprises software teams.

Connected product

A connected product is an item that obtains, generates or collects data concerning its use or environment and can communicate that data, via an electronic communications service, a physical connection, or on-device access. Its primary function must not be storing/processing data on behalf of others (that would make it a server, covered elsewhere).

Clearly in: industrial machines and sensors, vehicles, smart appliances, medical and fitness wearables, agricultural equipment, smart-building hardware, connected toys.

Generally out: general-purpose computing devices used to run third-party software, your laptop and, for most purposes, your smartphone as such. Also out: prototypes and products not placed on the EU market.

Related service, the definition that catches developers

A related service is a digital service (including software) connected with the product at purchase, rent or lease time in such a way that its absence would prevent the product from performing one or more of its functions, or which the manufacturer or a third party later connects to the product to add to or adapt its functions.

Read that twice: or a third party. You do not have to make the device. If your app or platform is what makes somebody's hardware perform one of its functions, a thermostat's scheduling app, a fleet-analytics platform the trucks depend on, firmware-update infrastructure, you can be a related-service provider with data-sharing duties, even though you never touched a soldering iron.

Merely optional companion features sit outside the definition; functions the product cannot perform without you sit inside it. The honest test is: if our service disappeared tomorrow, does the device lose a function, or only a convenience?

Why the classification matters

Connected product + related service triggers the user data-access rights, third-party sharing on request, access-by-design duties (since 12 September 2026 for products newly placed on the market) and pre-contractual transparency. Pure SaaS with no device link instead faces the cloud-switching chapter, a different and lighter set of duties.

Edge cases worth writing down

Multi-vendor stacks (whose duty is the export?), white-label hardware, devices sold outside the EU but operated inside it, and second-hand resale all deserve a sentence each in your scoping memo. Ambiguity documented in good faith reads very differently to a regulator than ambiguity discovered during a complaint.

Our free assessment runs this classification for you, answer a few questions about what you ship and it tells you which regime you are in.