Does the EU Data Act affect my machinery business?

Probably yes, and in two roles. Anyone manufacturing connected machines has to build every product newly placed on the market from 12 September 2026 so that the user can reach the data arising from it. Anyone buying connected machines has had a claim to the data from their own equipment since 12 September 2025. The second point is the one barely used in the mid-market so far.

Next week’s date concerns only the first role, and it does not apply retroactively. Existing machines in the field do not have to be retrofitted. Whatever comes newly to market from 12 September 2026 has to meet the requirement.

This article sets out which role applies to your own business, how narrow the exemption for small enterprises really is, and what can realistically still be done before the deadline.

What exactly changes on 12 September 2026?

For connected products newly placed on the market from that day, the product design requirement applies. The Data Act requires such products and their related services to be designed so that the data from operation is accessible to the user by default, easily and securely, and where appropriate and technically feasible directly.

The remaining duties of the regulation have been in force since 12 September 2025. These include the user’s claim to access the data from their equipment, the option to have that data passed on to a third party, and the duty to inform before contract conclusion about which data arises and how to get at it.

For a machine builder this means the question is no longer accessibility itself, but the route to it. An interface through which the customer can retrieve their operating data becomes part of the product description from the deadline onwards, rather than an extra negotiated in the service contract.

As a mid-sized company, am I covered by the exemption for small enterprises?

Only if the business itself is a micro or small enterprise. The threshold sits below 50 employees, and the exemption falls away if the enterprise is linked to a larger one. A machine builder with 120 employees is a medium-sized enterprise and therefore not exempt.

This is where the most common misjudgement arises. In Germany the term Mittelstand covers businesses from 15 to 2,000 employees, while the regulation’s exemption ends at 49. Anyone claiming the relief should hold the number against their own headcount statistics and ownership structure before relying on it.

It is also worth noting who the exemption is aimed at. It relieves the small-sized manufacturer of duties, not the buyer of rights. A 30-person business buying machines from a large group still has its access rights.

Who enforces this in Germany?

Enforcement sits with the Bundesnetzagentur. It is therefore also the body a user turns to when access to their machine data is refused.

For day-to-day sales practice another authority is closer. Customers ask about it themselves, increasingly in tender documents. An enquiry asking about data accessibility arrives sooner than a regulatory check, and an answer to it is either available or it costs the contract.

What can realistically still be done before the deadline?

For a product going to market next week, the design is settled. What holds up in the remaining time is clarifying the current state, so that the answer to a customer enquiry is not improvised.

Three questions are enough for this stocktake. Which data arises in our connected products, and where does it sit. By which route would a customer reach that data today, and how long does it take. What do our contracts and privacy notices say about it, and does that match the actual route.

Anyone with those three answers in writing can respond to a tender question and knows which rework has to be planned for the next product generation. Anyone without them will be answering the question in front of the first customer who asks it.

On the user side the reverse view is worth taking, because a claim has been sitting there for a year and is barely used. Anyone who wants to know which data their own equipment supplies, and which of it the manufacturer currently keeps to itself, has a lever for maintenance planning and for negotiating the next service contract.

Is this an AI topic?

No, but the two topics meet at one point. The Data Act decides whether a business can reach its machine data. Whether that data is fit for analysis is decided by data quality, and that is the question on which AI projects in manufacturing regularly stall. How to check that is set out in Is our data quality good enough for AI?.

The order is therefore access first, then quality, then analysis. A business that has not taken the first step ends up debating tools at the third that it cannot feed.

Conclusion

12 September 2026 is a manufacturer deadline and applies to connected products newly placed on the market. The exemption ends at 49 employees and falls away within a group structure, so it does not carry for most mid-market machine builders. The user rights have applied for a year already and have largely lain idle.

To clarify your own position, start with the stocktake. For a business with two or three connected product lines that is half a day, and afterwards there is an answer ready for the next tender.