EU Data Act and connected product data: what US manufacturers must share

Does the EU Data Act apply to a US manufacturer?#

The EU Data Act applies to a US manufacturer when its connected products are placed on the EU market, or when it provides a related digital service for those products, regardless of where the company is established. Selling through an EU distributor or an OEM customer may not take a product out of scope, so the first question is where the equipment ends up in use, not where you invoice.

Connected products are items that collect data about their use or surroundings and can communicate it: networked compressors, CNC machines with cloud monitoring, building controls, fleet equipment. Related services are digital services, such as a companion app or remote monitoring portal, that are tied to the product's functions. The regulation includes exemptions for some smaller enterprises, and some product design obligations apply only to products placed on the market after a later date, so confirm thresholds and timing with counsel.

What counts as product data, and what stays outside?#

Product data is the data a connected product generates through its use and makes accessible, such as sensor readings, operating states, run hours, fault codes and alarm logs. The access obligations focus on readily available data, meaning data the data holder already obtains or can obtain without disproportionate effort, in raw or lightly pre-processed form.

Information your own algorithms infer or derive from raw data, such as a proprietary failure-prediction score, is generally outside the user access right. So are records your company creates for its own purposes in the QMS, MES or ERP. Those internal records follow ordinary contract and confidentiality rules, which is why the boundary matters before any licensing discussion.

What must a manufacturer share, and how?#

A manufacturer acting as data holder generally must give users access to readily available product and related service data, easily and securely, in a structured, commonly used, machine-readable format, and continuously or in real time where relevant and technically feasible. Where a product is designed for direct access, the user pulls data from the device; otherwise the data holder provides it on request.

Users can also ask the data holder to make the same data available to a third party, such as an independent repair shop. In that business-to-business case the data holder can agree compensation that is reasonable and non-discriminatory, and the recipient is generally barred from using the data to build a competing product. Before a sale or lease, users must also be told what data the product generates, in what format and volume, and how to reach it.

• 1Pre-contractual information on data type, format, volume and access method.
• 2A user access route: direct from the device, through a portal or on request.
• 3A third-party sharing route at the user's direction, on fair terms.
• 4A user contract that covers your own use of non-personal product data.
• 5Confidentiality measures for any trade secrets in the data stream.
• 6A procedure to log, answer and document every request.

How do the trade-secret safeguards work?#

Trade-secret safeguards in the Data Act let a data holder protect confidential information without refusing access outright. The usual route is to identify which data or metadata reveal trade secrets and agree proportionate measures with the user or third party before disclosure, such as confidentiality terms, access protocols and technical controls.

If a recipient fails to adopt agreed measures or breaks them, the data holder can generally withhold or suspend sharing of the trade secrets concerned, giving written reasons and notifying the competent national authority. Outright refusal is reserved for exceptional cases where disclosure is highly likely to cause serious economic damage, and the data holder must justify it and notify the competent national authority. A blanket claim that all telemetry is secret is unlikely to hold.

US law points the same way. Under the Defend Trade Secrets Act, information qualifies only if its owner takes reasonable measures to keep it secret and it derives independent economic value from not being generally known. One written register of what is secret, and why, supports both regimes.

How the Data Act shapes licensing field data to AI developers#

The Data Act shapes licensing because a data holder's own use of non-personal product data generally has to rest on a contract with the user, and sharing it with third parties is limited to what that contract allows. Before EU-sourced telemetry goes into any license, check whether your terms of sale, service agreements or platform terms actually permit it.

The regulation also generally bars a data holder from using product data to derive insights about a user's economic situation, assets or production methods in ways that could undermine that user's commercial position. Personal data in the stream, such as operator logins, still falls under GDPR, and pseudonymized data that could be re-attributed with additional information is still treated as information about an identifiable person.

Buyers carry their own duties. Under the EU AI Act, providers of general-purpose AI models must publish a sufficiently detailed summary of the content used for training, so they will ask suppliers exactly how each dataset was sourced and under which terms.

Illustrative: a compressor maker separates two programs#

Illustrative: a fictional mid-sized US maker of industrial air compressors sells into Europe through distributors. Its controllers stream pressure, temperature and fault data to a cloud monitoring portal, its QMS holds many years of NCRs and CAPAs, and its ERP links warranty claims to serial numbers and production lots.

The general counsel splits the work in two. The Data Act program covers portal exports for EU users, a pre-contractual data sheet per product line and a trade-secret register for the controller logic. The licensing review covers only internal records from US accounts: NCRs, CAPAs, warranty claims and technician notes, with customer names removed.

EU field telemetry is parked until the user contracts are updated to address onward licensing. The result is a narrower first package with a clean rights record, and a Data Act process that customers can actually use.

How SourceX treats Data Act-governed records#

SourceX handles Data Act-governed product data as a distinct question in the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The fit check collects metadata only, such as system names, record families and which customers or regions the records cover, so nothing is shared while scope is decided.

Where a manufacturer proceeds, the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization for each package, including which records were excluded because of EU user terms. The manufacturer approves every release, and the records are licensed, not sold.