The EU Data Act’s Access-by-Design Deadline: What Life Sciences Companies Need To Know Before September 2026

Since 12 September 2025, the EU Data Act (Regulation (EU) 2023/2854, the “EU Data Act”) has required manufacturers of connected products and providers of related services to make in-scope data accessible to users, whether through direct or indirect access mechanisms. On 12 September 2026, a further dimension of that obligation becomes applicable: new connected products and related services placed on the EU market after that date must be designed with direct access capabilities built in by default, where relevant and technically feasible. Because the obligation to provide direct access is explicitly not absolute, manufacturers that already offer users indirect access through a portal or account may find that the practical change is limited.

The September 2026 date is nonetheless a valuable opportunity for companies, including those in the life sciences sector, to review their compliance position: not only on access by design, but across the broader set of EU Data Act obligations that have been applicable for almost a year and are now increasingly attracting scrutiny from marketplaces, customers, and emerging national enforcement bodies.

Why life sciences companies are in scope

The EU Data Act applies to “connected products” (items that generate or collect data about their use, performance, or environment and can communicate that data via any electronic connection) and to the “related services” linked to them (digital services connected to the product that affect its functionality, such as a companion app, or a software tool that delivers updates or remote configuration). The European Commission’s guidance expressly includes medical devices among the examples of connected products. A connected blood glucose monitor, an IVD analyser with cloud reporting, or a connected surgical instrument all likely qualify as connected products, and the companion app or cloud platform linked to the device will often qualify as a related service with its own, separate obligations.

The EU Data Act applies to both manufacturers and related-service providers regardless of where they are established: non-EU companies placing connected products on the EU market or offering related services to EU users are in scope and must designate an EU legal representative. The EU Data Act also applies alongside, not instead of, sector-specific frameworks such as the MDR¹ and IVDR².

Access is not new. What changes in September may be less extensive in practice than it looks.

The obligation for users to be able to access the data generated by their connected product or related service is not new. Since 12 September 2025, data holders have been required to make readily available data accessible to users on request, without undue delay, free of charge, in a machine-readable format. Companies have had to decide whether that access is provided directly (the user can retrieve data without the data holder’s involvement) or indirectly (the user submits a request through a portal or account). That obligation already applies to all connected products and related services on the EU market, including legacy devices.

What changes on 12 September 2026 is that connected products and related services placed on the EU market after that date onward must be designed with direct access built in by default, so that in-scope data is accessible to the user easily, securely, free of charge, and in a structured, machine-readable format. Critically, however, direct access is only required “where relevant and technically feasible”. The European Commission’s guidance is explicit: manufacturers retain discretion to assess whether direct access is technically possible, proportionate in cost, compatible with trade secret and IP protection, and consistent with the security of the connected product. Based on that assessment, a manufacturer may choose to design for indirect access instead.

For many life sciences products, where security, data integrity, patient safety, and regulatory considerations constrain direct access to raw device telemetry, indirect access will often be the more appropriate and defensible design choice. That said, it is recommended that the access decision be documented with a product-specific justification based on the factors mentioned above. A manufacturer that defaults to indirect access without reasoning risks having that choice challenged by a user, competitor or a competent authority. Equally, a manufacturer that already provides indirect access through a user account or portal (as many connected device companies do) may find that it is already substantially compliant with the new requirement, and that the practical gap to close is smaller than anticipated.

Moreover, not all data falls within scope of this new requirement. “Content” (for example, audiovisual or textual material typically covered by intellectual property rights) and inferred or derived data produced by proprietary algorithms are excluded. What is in scope is the raw and pre-processed operational telemetry: device status, usage logs, connectivity data and performance metrics. Within that in-scope data, the direct-versus-indirect decision can be made on a category-by-category basis. A manufacturer might, for example, make basic device status directly accessible through a dashboard while offering detailed diagnostic logs only on request. Where any data access includes personal data, the GDPR³ continues to apply in full, and the data holder must ensure it has a valid legal basis for making that personal data available.

Reminder of what already applies today, not just in September

The access-by-design “deadline” is the next milestone, but several other obligations imposed by the EU Data Act already apply since 12 September 2025 to all connected products and related services on the EU market, including legacy devices:

• Access on request: where data is not directly accessible, the data holder must make it available on a simple electronic request, without undue delay, free of charge, in a machine-readable format.
• Pre-contractual transparency: before sale, or before a user starts using a related service, specified information about the data generated must be provided to the user. Delivery via a stable URL or QR code is permitted.
• Contractual basis for data use: the data holder may only use non-personal data on the basis of a contract with the user, and may not use it to undermine the user’s commercial position.
• EU legal representative: non-EU manufacturers placing connected products on the EU market must designate a legal representative in an EU Member State.

These are not future obligations. They are current ones, and companies that have not yet addressed them face a growing compliance gap.

Enforcement is coming, even if it is not fully here yet

Enforcement of compliance with the obligations imposed by the EU Data Act is decentralised to national authorities, and many EU Member States are still finalising their frameworks. No EU Data Act fines have been publicly reported to date.

This, however, is not a reason to delay ensuring compliance with the EU Data Act. Where there is a breach of the EU Data Act and personal data is involved, data protection authorities can apply GDPR-level fines (up to €20 million or 4% of global turnover) to EU Data Act breaches. Other economic operators, such as marketplaces, increasingly require the products in their supply chains to comply with the EU Data Act obligations, as a condition of continued market access. The commercial consequences of non-compliance can arrive before the regulatory ones.

What life sciences companies should do now

• Identify which products qualify as connected products and which apps or platforms qualify as related services under the EU Data Act.
• Confirm that transparency documentation is in place for each product and service, across all EU sales channels.
• Check that the company and product terms and conditions contain a valid contractual basis for the company’s use of non-personal device data, with purposes specified transparently.
• Confirm a valid EU legal representative is in place where needed.
• For any new product or related service launching after 12 September 2026, confirm access-by-design is addressed in the development process and document the direct-versus-indirect decision and its justification.

Footnotes

1. Regulation (EU) 2017/745 of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC.

2. Regulation (EU) 2017/746 of 5 April 2017, on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU.

3. Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).