Connected Products under the Data Act: What Counts, What Data Is Covered and Who Must Share It

Chapter II runs from Article 3 to Article 7 and binds manufacturers, data holders, sellers and third parties alike. The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025, while the design duty of Article 3(1) covers only connected products and related services placed on the market after 12 September 2026 (Art. 50). How the rest of the EU Data Act is built is explained on the home page.

This page sets out the three elements of the definition, the items outside it, the data Chapter II covers, the actors who must make data available and to whom, the chain of duties with its application dates, and the eight section pages that explain each duty in depth.

What Chapter II of the Data Act Requires for Connected Products

Chapter II of the Data Act gives the user of a connected product or related service the right to obtain the data the use generates, free of charge, and the right to have it shared with a third party, while the product and service must be designed for access and the data holder may use non-personal data only under a contract with the user. Chapter II of Regulation (EU) 2023/2854 carries the title "Business to consumer and business to business data sharing" and covers Articles 3 to 7. Its duties reach manufacturers of connected products placed on the market in the Union and providers of related services irrespective of their place of establishment (Art. 1(3)(a)).

The user's position is protected against contract drafting: a term that, to the user's detriment, excludes, derogates from or varies the user's Chapter II rights is not binding on the user (Art. 7(2)). The user pays nothing for access or sharing, while the third party that receives data at the user's request compensates the data holder under Article 9 (Art. 5(1), Art. 9). The Commission explains these rules in its frequently asked questions on the Data Act, version 1.4 of 22 January 2026, which is non-binding guidance and, in the Commission's own words, "should not be considered as representative of the European Commission's official position".

What Counts as a Connected Product

An item is a connected product when it obtains, generates or collects data about its use or environment, can communicate product data by an electronic communications service, a physical connection or on-device access, and has a primary function other than storing, processing or transmitting data for anyone other than the user (Article 2(5)). A related service is a digital service, other than an electronic communications service, connected with the product so that its absence would prevent the product from performing a function, or connected later to add to, update or adapt its functions (Art. 2(6)); the related services page in the section index below explains that test. As of 5 November 2026, the pending Digital Omnibus proposal (COM(2025) 837) would not change Article 2(5).

The Three Elements of the Definition

Article 2(5) sets three cumulative elements: data collection about use or environment, the ability to communicate product data, and a primary function that is not data storage or transmission for others. The first element requires the item to obtain, generate or collect data concerning its use or environment. The second requires that it can communicate product data, and any one of the three channels the Act names is enough: an electronic communications service, a physical connection or on-device access. The third excludes items whose primary function is storing, processing or transmitting data on behalf of a party other than the user.

Virtual assistants are covered insofar as they interact with a connected product or related service (Art. 1(4)). Placing on the market means "the first making available of a connected product on the Union market" (Art. 2(22)). The Commission's FAQ (Q8) reads this per individual product, not per product type, and a product is placed on the market only once. The other terms of Article 2 are collected in the Article 2 definitions.

Examples from Vehicles to Home Equipment and the Internet of Things

Recital 14 describes connected products as items "often referred to as the Internet of Things" and names vehicles, ships, aircraft, home equipment and consumer goods, health and lifestyle equipment, medical and health devices, agricultural and industrial machinery and private, civil or commercial infrastructure. Recital 14 lists these product groups:

• private, civil or commercial infrastructure;
• vehicles, ships and aircraft;
• health and lifestyle equipment;
• home equipment and consumer goods;
• medical and health devices;
• agricultural and industrial machinery.

Products that need type approval or conformity assessment, such as motor vehicles, aircraft and medical devices, are connected products under the Data Act in the Commission's reading (FAQ v1.4 Q12). Which data a given product can make available is decided by the manufacturer's design choices and, where relevant, by Union or national sector law or decisions of competent authorities (recital 14).

Items Outside the Definition

Three groups fall outside: prototypes (recital 14), items whose primary function is storing, processing or transmitting data on behalf of others (Article 2(5)), and, in the Commission's reading, servers and routers unless the user owns, rents or leases them (FAQ v1.4 Q7). Prototypes are excluded by the same recital that brings the Internet of Things into scope, and storage or transmission devices fail the third element of the definition.

The same FAQ answer (Q7) counts communication of data outside the product on an ad hoc basis, for example during maintenance, as communication. A product without permanent connectivity therefore stays within the definition when its data leave the product on such occasions.

What Data Is Covered under Chapter II: A Summary

Chapter II covers data, with the exception of content, concerning the performance, use and environment of connected products and related services (Article 1(2)(a)). In the Commission's reading, only data generated or collected after the Regulation became applicable on 12 September 2025 falls within the scope of Chapter II (FAQ v1.4 Q4).

The Act splits this data into product data, related service data and readily available data with its metadata, and only readily available data must be handed over on request. The data scope page in the section index below gives each definition and the edge cases.

Who Must Make the Data Available, and to Whom

Chapter II binds four groups named in Article 1(3): manufacturers of connected products placed on the market in the Union and providers of related services, users in the Union, data holders that make data available to data recipients in the Union, and those data recipients. Data holders are covered irrespective of their place of establishment, on the same basis as manufacturers and related service providers (Art. 1(3)(a), (c)). The full list of addressees, including the other chapters, is set out under who the Data Act applies to.

The table maps each Chapter II role to its definition, its addressee hook in Article 1(3) and its main position.

The data holder is whoever has the right or obligation under the Regulation, Union law or national law "to use and make available data" (Art. 2(13)), which is typically, but not always, the manufacturer. The Regulation has 43 definitions in Article 2, and none of them defines the manufacturer. The pre-contractual duty of Article 3(2) falls on the seller, rentor or lessor, which may be the manufacturer.

Chapter II does not apply to data from products manufactured or designed, or related services provided, by a microenterprise or small enterprise, provided it has no partner or linked enterprise that is not micro or small and is not subcontracted to manufacture or design the product or provide the related service (Art. 7(1)); medium-sized enterprises get a grace period of one year only.

The Chapter II Obligation Chain, Step by Step

The Chapter II duties form one chain: design for access (Article 3(1)), information before the contract (Article 3(2) and (3)), access on request (Article 4), sharing with a third party (Article 5) and the third party's limits (Article 6), with Article 7 setting who is outside. Each link of the chain has its own page, and the table lists the provision, the party that owes the duty and the date from which it applies. The steps per role are listed in the Data Act compliance checklist.

Trade secrets are no general ground for refusing access or sharing: a trade secret holder may refuse only in exceptional circumstances, case by case, where it is highly likely to suffer serious economic damage from the disclosure (Art. 4(8), 5(11)). The trade secrets page in the section index explains the protective measures that come first.

Undertakings designated as gatekeepers under Article 3 of Regulation (EU) 2022/1925, the Digital Markets Act, are not eligible third parties under Article 5(3). Voluntary agreements between gatekeepers and data holders remain possible (recital 40).

When the Chapter II Duties Apply

Chapter II has applied since 12 September 2025, except the design duty of Article 3(1), which applies to connected products and related services placed on the market after 12 September 2026 (Article 50). Entry into force on 11 January 2024 is a separate date and marks no duty of its own under Chapter II. Every application date of the Regulation sits in the Data Act timeline.

A unit placed on the market on 12 September 2026 itself falls outside the wording of Article 50, which says "after". Units placed on the market earlier have owed the duties of Articles 3(2), 3(3), 4, 5 and 6 since 12 September 2025 (Art. 50 second paragraph), and the Commission FAQ (Q22) reads it the same way.

The table sets out the three dates and the provision behind each.

Application dates of Chapter II, Regulation (EU) 2023/2854, as of 5 November 2026; the pending Digital Omnibus proposal would not change them.

As of 5 November 2026, the Digital Omnibus proposal COM(2025) 837 is pending: the Committee of Permanent Representatives (Coreper) agreed the Council mandate on 21 October 2026, and the European Parliament is at committee stage. The proposal would add a refusal ground for trade secrets at high risk of reaching third-country entities while leaving Article 2(5), Article 3 and Article 7 unchanged; the full proposal is tracked under Data Act amendments: the Digital Omnibus.

The Connected Product Pages in This Section

This section has eight pages, one for each part of Chapter II that needs more than a summary: the data covered, related services, access by design, pre-contractual information, the user's access right, third-party sharing, trade secrets and the data licence agreement. The model contractual terms behind the data licence agreement are a draft Recommendation approved by Communication C(2025) 7750 of 19 November 2025, with formal adoption pending as of 5 November 2026.

What Chapter II Does Not Decide

Chapter II decides who may obtain which product data and on what terms; it does not override data protection law, set product-security requirements or replace sector rules. Cybersecurity requirements for connected products come from separate EU product legislation.

Is Data from Products Used Outside the EU Covered?

Yes: in the Commission's reading, data generated inside and outside the EU by a product placed on the EU market must be made available (FAQ v1.4 Q9).

The Commission also reads Chapter II as creating no obligation to share data with third parties not established in the EU, although a data holder may agree to do so (FAQ v1.4 Q37). The Regulation itself addresses "data recipients in the Union" (Art. 1(3)(d)).

How Chapter II Relates to the GDPR

The General Data Protection Regulation (GDPR) prevails in a conflict, and the Data Act is no legal basis for processing personal data (Article 1(5)). The overlaps are compared in the Data Act vs the GDPR.

The Chapter II rights complement the GDPR rights of access and data portability in Articles 15 and 20 GDPR.

How Chapter II Applies Sector by Sector

The Commission's guidance on vehicle data (C/2025/5026) states that it is for the OEM (original equipment manufacturer) or data holder to assess whether a vehicle qualifies as a connected product (para. 12). The guidance is non-binding.

Sector application differs for vehicles, machinery, farm equipment, smart homes and energy devices, and each sector is covered in the Data Act by sector.