A second, harder deadline lands a year after the first
The EU Data Act (Regulation 2023/2854) became generally applicable on 12 September 2025, giving users of connected devices — from smart coffee machines to tractors — a right to request the data those devices generate. A year later, a tougher obligation kicks in. Under Article 3(1), connected products placed on the EU market from 12 September 2026 onward must be designed so that product data is, "by default, easily, securely, free of charge... and, where relevant and technically feasible, directly accessible to the user," without a request process at all (Article 3 text via eu-data-act.com; European Commission, Data Act policy page). Access shifts from something a user asks for to something the product simply has, out of the box.
No sector illustrates the stakes better than automotive. A typical connected vehicle generates roughly 25 GB of data per hour from over 100 datapoints — geolocation, biometrics, on-board diagnostics, driver-assistance systems — and a fully autonomous vehicle can produce upward of 300 terabytes a year (The Autopian, citing S&P Global Mobility; Tuxera). No other consumer product comes close. Analysts covering the September deadline call automotive "the clearest case" for disputes, because insurers, independent repairers, and fleet operators have wanted this access for years and manufacturers have controlled it just as long (GamingTechLaw).
The case for the mandate, stated fairly
The Commission's own framing of the Data Act is a coffee machine, not a car: a café owner who buys a connected espresso machine should be able to see the water-temperature and usage data the machine generates, not just the manufacturer who built it (European Commission). Applied to vehicles, the logic is the same but the stakes are commercial rather than culinary. Telematics data has, in practice, been a manufacturer monopoly: OEMs could route it to their own preferred repair networks, extended-warranty programs, and insurance partners while independent garages and comparison-shopping insurers got nothing equivalent. That is a genuine competition problem, and it rhymes with the logic that has underpinned the EU's Motor Vehicle Block Exemption Regulation for repair-market competition for two decades. Requiring access "on request" — the 2025 rule — still let manufacturers control the friction: slow-walking requests, restricting formats, charging opaque fees. Access-by-design closes that loophole by making the data pipe a factory setting rather than a customer-service ticket. That is a defensible fix for a real market failure, not regulatory overreach for its own sake.
Where the proportionality argument bites
The Commission's own automotive guidance, published 12 September 2025 alongside the general application date, already narrows the obligation sensibly: it covers raw sensor signals, vehicle speed, and battery data, but explicitly excludes "inferred or derived information that represents entirely new information" — meaning proprietary driver-behavior scores, predictive-maintenance models, and other analytics manufacturers build on top of raw data stay out of scope (Mayer Brown). That carve-out is the right instinct: it protects the layer where manufacturers actually add value and compete, while opening the layer that is closer to a natural utility.
But the "by design" standard is a blunter instrument than the "on request" one it replaces. It doesn't just require an access channel to exist somewhere in the product; it requires every relevant data category to be architected for default, free, machine-readable egress from the point of manufacture — for every trim, every market variant, every model year from September 2026 forward, regardless of whether third-party demand for that specific data category exists yet. Vehicle development cycles run three to five years, so cars now entering final engineering were designed before this specific deadline was locked in. That compliance cost is roughly fixed per model line rather than per unit sold, which means it lands hardest on smaller and challenger automakers with thinner engineering budgets — a genuine irony for a rule partly justified on competition grounds. It also cuts against the Data Act's own security language: an access point that is on by default, on every unit, is also an attack surface that is on by default, on every unit, at exactly the moment vehicle data volumes are climbing toward the hundreds-of-terabytes range that increasingly automated driving systems generate.
The proportionate fix
None of this argues for scrapping access-by-design. It argues for tiering it: a genuinely default, no-request obligation for the narrow set of data categories — location, diagnostics, usage — where third-party demand is proven and repair-market competition is the actual policy target, paired with a longer glide path for the long tail of data categories nobody has yet asked for. Enforcement is still immature — no national competent authority has brought a major automotive case yet (Wilson Sonsini Data Advisor) — which gives the Commission room to calibrate before the first dispute, rather than after.