What changed on 12 September
Since 12 September 2026, Article 3(1) of the Data Act (Regulation (EU) 2023/2854) has applied to connected products placed on the EU market. That includes vehicles with growing levels of automation. According to Matheson's analysis, manufacturers must now design products so users can reach the data those products generate easily, securely and free of charge. Before that date, they only had to supply data on request. Users can also pass the data to a third party of their choice. The Commission's Data Act explainer says the data must be provided for free. It also excludes Digital Markets Act gatekeepers as recipients.
The obligation is qualified. Direct access is required only 'where relevant and technically feasible'. The Commission's vehicle-data guidance, which Garrigues dates to 15 September 2025, repeats that qualifier. It is interpretive and non-binding. Meanwhile, the Digital Omnibus procedure (2025/0360(COD)) lists an amendment to the Data Act. The Legislative Observatory shows it still at committee stage.
The strongest case for the rule
The case for hard rules is real. Whoever controls vehicle data controls the aftermarket. A manufacturer that holds data on battery state, charging cycles, or fault conditions can decide which workshops, insurers and app developers get to compete with it. Voluntary access has historically favoured whoever owns the telematics gateway. The Data Act tries to fix that with a rule that applies by default. It does not depend on each user knowing to ask. As vehicles take on more automated functions, the stakes rise, because more of the useful data is generated continuously by the car itself.
The guidance backs this up. According to Garrigues, it says access must not discriminate between users, subsidiaries and independent third parties. It also says data passed on must match the quality of the data the manufacturer uses internally. The explicit aim is to let independent repairers, fleet operators, insurers and aftermarket providers build services.
Why a narrow reading is the proportionate one
A pro-competition goal does not require an unbounded mandate. Three features of the current design are sensible and worth defending.
First, the qualifier matters. Garrigues reports that where direct access is not available, the data holder must still provide 'readily available' data, meaning data it can obtain without disproportionate effort. Access must not require specialised tools or advanced skills. This keeps the obligation tied to engineering reality. It avoids forcing every vehicle platform, including ones designed years ago and only now reaching the market, to be re-architected around an on-board interface that may add cost and attack surface. Security is the quiet constraint here. Letting data flow directly out of safety-relevant systems is not neutral. A cheap, direct, unauthenticated route out of a vehicle is exactly what a cybersecurity regulator would not want.
Second, the scope is deliberately limited. Per Garrigues, inferred data is excluded. Examples are maintenance recommendations, driving-style evaluations, predictive fault reports and insurer risk profiles. Insurers get raw or pre-processed data, not the manufacturer's models. That boundary protects the investment that goes into analytics, including the perception and prediction work behind autonomous driving. It does so without closing off the raw material competitors need. If the line moved to include derived outputs, the incentive to build better models would shrink for everyone, European suppliers included.
Third, enforcement is ex post. The guidance says national authorities will review compliance under Article 37, and that this review must respect the freedom to conduct a business under Article 16 of the Charter. That is the right posture for a rule this new. It lets practice develop before penalties do the interpreting.
Where the risk lies
The larger danger is instability. Manufacturers designing platforms now need to know which rule they are building to. Two moving parts make that hard.
- Sector-specific legislation. The Commission has said in-vehicle data legislation is still being discussed. If it arrives with different access mechanics, such as a shared server model, it could overlap with Article 3(1). The guidance says it sits alongside existing rules, including vehicle type-approval Regulation 2018/858 and the repair-and-maintenance Delegated Regulation 2021/1244. A fourth overlapping regime would raise compliance cost without adding user benefit.
- The Digital Omnibus. An amendment procedure that touches the Data Act is a legitimate way to remove friction. But a design obligation that has just started applying is poorly served by reopening it at the same moment. The Observatory shows no committee decision yet, so the content of any change is still open. Whatever the text becomes, the sensible test is whether it clarifies the existing obligation or quietly rewrites the 'technically feasible' bargain.
There is also a user-side question. Free, by-default access is only as valuable as the intermediaries that use it responsibly. Third parties receiving vehicle data will often be handling personal data, including location. Article 9 compensation for data sharing between businesses, which Garrigues says the Commission has yet to issue guidelines on, is an unresolved piece that affects whether small workshops can afford to participate.
What regulators should do
- Publish compensation guidance. Small independent workshops and app developers need predictable terms under Article 9.
- Keep the guidance's logic on feasibility. Manufacturers should justify, not assume, that direct access is infeasible. The guidance already says claims of technical impossibility must be justified. National authorities should hold to that.
- Sequence the legislation. If sector-specific in-vehicle data rules are pursued, they should replace overlapping mechanics rather than add to them, and they should be settled before the next Omnibus changes to Article 3(1) are considered.
- Test with real cases. Early enforcement should favour guidance and dialogue over penalties until the market shows what compliant design looks like.
The design obligation is a reasonable bet that interoperable vehicle data will grow the aftermarket and not just shift rents. It deserves a chance to work as written.