Data Access by Design: The Article 3(1) Obligation for Connected Products Placed on the Market after 12 September 2026

The duty comes from Regulation (EU) 2023/2854, the EU Data Act.

The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025, but Article 50, third paragraph, staggers the design duty. Users of units already on the market obtain the data on request under Article 4.

The table sums up the obligation in eight points.

What Is Data Access by Design under Article 3(1)?

Data access by design is the obligation under Article 3(1) Regulation (EU) 2023/2854 to build the connected product and its related service so that the user can reach the product data, related service data and metadata without anyone having to extract them first. Article 3 carries the heading "Obligation to make product data and related service data accessible to the user" and opens Chapter II (Articles 3 to 7), the chapter on connected products under the Data Act.

Article 3(1) is a design and manufacturing duty, while Article 3(2) and 3(3) are information duties owed before the contract is concluded.

Who Must Build Products and Services for Access

Article 3(1) binds whoever designs and manufactures the connected product and whoever designs and provides the related service. Article 2 has 43 definitions and none for "manufacturer". Manufacturers of connected products placed on the market in the Union and providers of related services are covered irrespective of their place of establishment (Art. 1(3)(a)). The manufacturer is typically, but not always, the data holder (Commission FAQ (frequently asked questions) v1.4, Q21).

Which Items and Digital Services the Duty Reaches

The duty reaches every connected product, an item that obtains, generates or collects data about its use or environment and can communicate product data via an electronic communications service, physical connection or on-device access (Art. 2(5)). Recital 14 names examples, such as vehicles, home equipment and consumer goods, medical and health devices, and agricultural and industrial machinery.

A related service is a digital service connected with the product at purchase, rent or lease so that its absence would prevent one or more of its functions, or connected later to add to or adapt them (Art. 2(6)); the full test is explained under related services under the Data Act.

When Does the Article 3(1) Obligation Apply?

The obligation resulting from Article 3(1) applies to connected products and the services related to them placed on the market after 12 September 2026 (Article 50, third paragraph, Regulation (EU) 2023/2854). The Regulation itself has applied since 12 September 2025 (Art. 50, second paragraph). The table applies both dates to five situations.

Placing on the market and making available are defined in Art. 2(21) and 2(22); see who the Data Act applies to and Data Act definitions.

Placing on the Market, Unit by Unit

The date test runs on each connected product as an item: placing on the market is the first making available of a connected product on the Union market (Art. 2(22)), and a connected product is an item (Art. 2(5)). Making available is any supply for distribution, consumption or use on the Union market in the course of a commercial activity, paid or free (Art. 2(21)). The Commission FAQ v1.4 (Q8) agrees: placing on the market refers to each individual product, not to a product type, and happens only once.

Units of one model can therefore fall on both sides of the date. The Commission FAQ v1.4 (Q9) treats the registration of cars, rail vehicles or planes in a Member State as an indicator of placing on the EU market.

Units Placed on the Market up to the Cut-Off Date

Units placed on the market on or before 12 September 2026 fall outside the design duty of Article 3(1) but not outside Chapter II: Articles 3(2), 3(3), 4, 5 and 6 have applied to them since 12 September 2025 (Art. 50). The Commission FAQ v1.4 (Q22) reads it the same way: all products had to allow user access from 12 September 2025, directly or under Article 4(1).

For such a unit, the user obtains readily available data on a simple request to the data holder (Art. 4(1)). Every application date is listed on the Data Act timeline.

What Article 3(1) Requires: Six Design Conditions

Article 3(1) sets six conditions for the design: product data, related service data and the relevant metadata must be accessible by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly. The table gives the wording of each condition, the Commission reading where one exists and a design example.

Readings from the Commission FAQ are not binding.

By Default, Easily and Securely

Article 3(1) names by default, easily and securely as three of its six conditions, and lists them together, so the design meets all three at once. Recital 21 shows what an easy route to the data looks like on the request side: a simple request mechanism granting automatic execution, without examination or clearance by the manufacturer or data holder.

Free of Charge to the User

The user pays nothing for access designed under Article 3(1), which makes free of charge a condition. The same holds for access on request (Art. 4(1)) and sharing at the user's request (Art. 5(1)); a third party receiving data under Article 5 compensates the data holder under Article 9.

A Comprehensive, Structured, Commonly Used and Machine-Readable Format

The data must leave the product in a comprehensive, structured, commonly used and machine-readable format, and the Commission FAQ v1.4 (Q22a) names interoperable formats such as XML (Extensible Markup Language), JSON (JavaScript Object Notation) and CSV (comma-separated values). The same answer treats formats subject to licensing constraints as not commonly used. The four adjectives apply together.

What Data and Metadata the Design Must Expose

The design must expose product data, related service data and the relevant metadata necessary to interpret and use those data (Art. 3(1)). Metadata are "a structured description of the contents or the use of data facilitating the discovery or use of that data" (Art. 2(2)), including basic context and a timestamp (recital 15).

Data the design does not store or transmit outside the generating component or the product are not readily available data, and there is no duty to store data on the central computing unit (recital 20). The recital adds that the design duties are without prejudice to data minimisation and that updates that add or restrict accessible data should be communicated to the user with the update. The full data boundary is set out under which data the Data Act covers.

When Must Access Be Direct?

Article 3(1) requires direct access to the user only where it is relevant and technically feasible; where it is not, the data stay accessible through a request to the data holder under Article 4(1) Regulation (EU) 2023/2854. The Commission FAQ v1.4 (Q22) reads Article 3(1) as not obliging manufacturers to grant direct access in all situations and for all connected products, and Q17 leaves the manufacturer flexibility to choose direct or indirect access.

Direct Access from the Device or a Remote Server

Direct access means the product makes data reachable from on-device data storage or from a remote server to which the data are communicated (recital 22). The Commission FAQ v1.4 (Q17) calls access direct where the user can access, stream or download the data without having to ask the data holder. Data generated inside and outside the EU by a product placed on the EU market must be made available (FAQ v1.4, Q9).

Indirect Access on Request as the Fallback

Where data cannot be directly accessed from the product or service, the data holder makes readily available data and the relevant metadata accessible to the user without undue delay, free of charge, on a simple request (Art. 4(1)).

The Commission FAQ v1.4 (Q17) calls this indirect access: the user must ask the data holder, for example through a web portal. Timing, format, verification and refusals of these requests are explained under the user's right to access data under Article 4.

Contract Terms Attached to Direct Access

Direct access may come with contractual conditions, such as trade secret protection or a ban on developing a competing product, as long as they respect Article 7(2) (Commission FAQ v1.4, Q24). Under Article 7(2), a term that excludes, derogates from or varies the user's Chapter II rights to the user's detriment does not bind the user.

The Commission adds that no statutory handbrake applies to directly accessible data, so protection runs only through the contract (Q24), and that the Article 5 sharing duty applies even where the user has direct access (Q31).

Where the Design Obligation Stops

Four limits narrow Article 3(1): the date of placing on the market, the micro and small enterprise exemption of Article 7(1), the medium-sized enterprise year, and the exclusion of prototypes and of data the design never stores or transmits. Each limit rests on its own provision:

• Date: units placed on the market on or before 12 September 2026 (Art. 50).
• Micro and small enterprises: Chapter II does not apply to data from connected products manufactured or designed, or related services provided, by a microenterprise or small enterprise without a partner or linked enterprise that is not micro or small, and not subcontracted to do so (Art. 7(1)); see Data Act SME exemptions for micro and small enterprises.
• Medium-sized enterprise year: connected products for one year after a medium-sized enterprise placed them on the market, and enterprises medium-sized for less than one year (Art. 7(1), second subparagraph).
• Prototypes and unstored data: recital 14 and recital 20.

How to Meet the Design Obligation before a Unit Is Placed on the Market

A manufacturer or related service provider meets Article 3(1) by working through six steps before the first unit of a new design is made available on the Union market, and by recording the result for each model and each unit's date. Each step rests on a provision of the Regulation:

1. Date each unit at its first making available on the Union market (Art. 2(22), Art. 50).
2. Map the product data, related service data and metadata (Art. 2(2), 2(15), 2(16)).
3. Decide direct access where relevant and technically feasible, set the Article 4(1) request path for the rest and name who acts as data holder; see data holder obligations.
4. Choose a comprehensive, structured, commonly used and machine-readable format (Art. 3(1)).
5. Align the pre-contractual information under Article 3(2) and 3(3) with the design; see the Data Act transparency declaration.
6. Check Article 7(1) and, for an entity not established in the Union, designate a legal representative in a Member State (Art. 37(11)); see the Data Act for non-EU companies.

The Data Act sets no EU fine amount; Member States lay down the penalties (Art. 40(1)). As of 5 November 2026, Germany's Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG) caps the national fine for an Article 3(1) breach at EUR 500,000 (§ 15(2) No. 1 with § 15(4) DADG), enforced by the Bundesnetzagentur as competent authority (§ 2(1) DADG); see Data Act penalties and fines.

No contract term can switch off these access rights to the user's detriment (Art. 7(2)).

The other duties of a manufacturer are set out in the Data Act compliance checklist.

How Article 3(1) Connects to the Other Chapter II Duties

Article 3(1) is the design layer of Chapter II, and four duties build on it: the pre-contractual information of Article 3(2) and 3(3), the right of access on request in Article 4, sharing with third parties under Article 5, and the trade secret safeguards.

• Information: four minimum items for the seller, rentor or lessor (Art. 3(2)) and nine for the related service provider (Art. 3(3)); see the Data Act transparency declaration.
• Access on request: Article 4(1) covers data not directly accessible; see the user's right to access data under Article 4.
• Third parties: Article 5 applies even with direct access (Commission FAQ v1.4, Q31); see data sharing with third parties.
• Trade secrets: contract protection for directly accessible data (Q24); see trade secrets under the Data Act.

As of 5 November 2026, neither the Digital Omnibus proposal nor the Council mandate would amend Article 3. Status: pending, Commission proposal COM(2025) 837 of 19 November 2025, Council mandate ST 14756/26 of 22 October 2026, European Parliament committee stage ("Awaiting committee decision", no committee vote) as of 5 November 2026; not law (procedure 2025/0360(COD); Data Act amendments).

Questions about Access by Design

Five questions recur about the Article 3(1) design obligation.

Does Article 3(1) apply to units placed on the market before 12 September 2026?

No: Article 3(1) covers only connected products and related services placed on the market after 12 September 2026 (Art. 50), while Articles 3(2), 3(3), 4, 5 and 6 have applied to earlier units since 12 September 2025.

Must every unit give the user direct access?

No: Article 3(1) requires direct access only where relevant and technically feasible; otherwise the data holder provides access on a simple request under Article 4(1).

Can a manufacturer charge the user for access by design?

No: Article 3(1) makes access free of charge to the user, and compensation under Article 9 is owed only by a third party receiving data under Article 5, to the data holder.

Are micro and small manufacturers bound by Article 3(1)?

Not where Article 7(1) applies: Chapter II does not apply to data from products manufactured or designed by a microenterprise or small enterprise without a partner or linked enterprise that is not micro or small, and not subcontracted. A medium-sized enterprise gets only a one-year window for products it placed on the market; see Article 7 for micro and small enterprises.

Does the Digital Omnibus change Article 3(1)?

No: as of 5 November 2026, the pending proposal COM(2025) 837 of 19 November 2025 would leave Article 3 unchanged, and the proposal is not law.