--- title: "EU Data Act: Connected-Product API Checklist" canonical: https://wavect.io/blog/eu-data-act-connected-product-api-2026/ language: en description: "Prepare connected products for the EU Data Act design duty: catalog data, choose direct or API access, implement identity, isolation, exports, and tests." image: "https://wavect.io/img/blog/headers/header_eu-data-act-connected-product-api-2026.png" --- [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 8 min read · 24 Aug 2026 Last reviewed August 24, 2026 [**Next**](/blog/smart-city-architecture-best-practices-2026/) # EU Data Act for Connected Products: Access-by-Design API Checklist TL;DR Connected products and related services placed on the market after 12 September 2026 need access by design under the EU Data Act. Catalog generated data and necessary metadata, map each class to its user and holder, document whether direct access is feasible, and provide an authenticated API or export path where needed. Test tenant isolation, delegation, revocation, privacy, trade-secret controls, load, and disclosure accuracy. **Connected products and related services placed on the EU market after 12 September 2026 must be designed so generated data and necessary metadata are accessible to users easily, securely, free of charge, in a comprehensive, structured, commonly used, machine-readable format, and directly where relevant and technically feasible. Product architecture now determines whether access is real or theoretical.** This guide focuses on the device-to-cloud implementation gap. It does not repeat the cloud-switching analysis in our software-takeover content and is not legal advice. ## What must the product make possible? | Duty | Product behavior | Implementation control | | --- | --- | --- | | **Access by design** | Direct access where relevant and technically feasible | Document the direct-access decision for each data class | | **On request** | Without undue delay and, where applicable, continuously and in real time | Provide authenticated API or export flows with service monitoring | | **Pre-contract information** | Volume, format, frequency, storage, access, and retention | Generate accurate product disclosures from the same system catalog | ## What data needs an access path? Build a catalog of raw and pre-processed data generated by use of the product or related service, plus the metadata needed to interpret it. For each class, record the user, holder, source, cadence, volume, format, retention, personal-data status, trade-secret risk, security impact, and access method. - Separate observed sensor and event data from inferred or derived analytics. - Map physical ownership, account roles, tenancy, and delegated access to a verified user relationship. - Expose units, timestamps, device identity, quality flags, and schema version with the data. - Keep the product disclosure synchronized with actual firmware, app, API, and retention behavior. ## What does an access-by-design API look like? Use explicit resources, stable identifiers, documented schemas, pagination or streaming, scoped authorization, export jobs for large histories, and auditable revocation. Return useful errors and data-availability windows. Do not make users scrape a dashboard or file repeated support tickets. - Authenticate the user and prove their relationship to the device before issuing access. - Apply tenant and device boundaries on every query, then regression-test cross-tenant isolation. - Rate-limit abusive traffic without making normal continuous or real-time access impossible. - Offer deletion, delegation, and third-party sharing flows consistent with privacy and contract controls. ## How should trade secrets and security be handled? Classify risk per field and access path rather than declaring an entire dataset secret. Apply proportionate technical and organizational measures, preserve reasons for restrictions, and provide escalation. Security controls should narrow abuse without quietly nullifying the user's access right. - Threat-model device takeover, token theft, enumeration, inference, replay, and bulk extraction. - Use data minimization, purpose-aware scopes, encryption, monitoring, and time-limited credentials. - Create an evidence trail for withheld, delayed, or reduced access and the legal basis used. ## An eight-step readiness checklist 1. Identify connected products and related services placed on the market after 12 September 2026. 2. Catalog generated data and metadata, including source, volume, cadence, retention, and user. 3. Decide direct, API, export, or assisted access per data class and document feasibility. 4. Implement device-user identity, delegation, authorization, and tenant isolation. 5. Publish versioned schemas and machine-readable outputs with provenance and quality metadata. 6. Align contracts and pre-contract disclosures with actual technical behavior. 7. Load-test continuous access and rehearse security, privacy, trade-secret, and revocation cases. 8. Measure access success, fulfillment time, stale data, authorization failures, and support escalation. ## EU Data Act connected-product FAQ ### Which products face the access-by-design duty from September 2026? The duty applies to connected products and related services placed on the market after 12 September 2026, subject to the regulation's scope and exceptions. ### Must access always be direct from the device? No. Direct access is required where relevant and technically feasible. Otherwise the data holder must provide an effective request-based access path under the applicable rules. ### Can we charge users for their product data? Article 3 describes access for users as easy, secure, free of charge, comprehensive, structured, commonly used, and machine-readable. ### Does a CSV export satisfy the Data Act? Sometimes an export is part of the solution, but adequacy depends on the data, metadata, cadence, format, volume, and whether continuous or real-time access is applicable. ## Final thoughts Treat access as a product capability with an owner, SLOs, tests, and measurable user outcomes. A privacy-policy paragraph or manual export queue cannot compensate for an architecture that never preserved usable product data. ## Primary sources 1. [Regulation (EU) 2023/2854](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854). Binding Data Act text, including Articles 3 and 4 2. [European Commission Data Act explained](https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained). Official overview of scope, access, sharing, and switching 3. [Bundesnetzagentur Data Act background](https://www.bundesnetzagentur.de/EN/Areas/Digitalisation/DataAct/background/1-Data/start.html). Official implementation overview and the September 2026 design date ## You may also like.. [**Smart-city architecture best practices** Apply the access checklist to device identity, edge, connectivity, and data-platform decisions.](/blog/smart-city-architecture-best-practices-2026/) [**Wavect vs development agencies** Compare product teams for connected-device and API delivery.](/compare/wavect-vs-dev-agencies/) Architecture and platforms ## Continue through this cluster Framework, platform and system-design choices that affect delivery over the long term. [Start with the cornerstone**Smart City Architecture Best Practices: MQTT, LoRaWAN, Kubernetes and Terraform**](/blog/smart-city-architecture-best-practices-2026/) - [EU Battery Passport Software Architecture for 2027](/blog/eu-battery-passport-software-architecture-2027/) - [Cursor Origin vs GitHub: Should Your Team Switch?](/blog/cursor-origin-vs-github-code-hosting/) - [MoneyPrinterTurbo Review 2026: Free AI Video, Real Costs](/blog/moneyprinterturbo-review-2026/) - [Odoo API integration: the five limits that decide your architecture](/blog/odoo-erp-api-integration-limits-2026/) - [AI in Grocery Retail: An MPREIS Opportunity Map](/blog/mpreis-ai-grocery-retail-opportunity-map/) Inbox, without the noise ## Follow the work that matters to you Get a short email when we publish something new. Follow the whole blog or only the problems you care about. [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 8 min read · 24 Aug 2026 Last reviewed August 24, 2026 [**Next**](/blog/smart-city-architecture-best-practices-2026/) New posts by email × × Get new posts by email A short email when we publish. Free, no tracking. ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/blog/eu-data-act-connected-product-api-2026/#webpage", "@type": "WebPage", "dateModified": "2026-08-24", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-08-24", "url": "https://wavect.io/blog/eu-data-act-connected-product-api-2026/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "BlogPosting", "abstract": "Connected products and related services placed on the market after 12 September 2026 need access by design under the EU Data Act. Catalog generated data and necessary metadata, map each class to its user and holder, document whether direct access is feasible, and provide an authenticated API or export path where needed. Test tenant isolation, delegation, revocation, privacy, trade-secret controls, load, and disclosure accuracy.", "articleBody": " Blog overview/Delivery and QA/Architecture and platforms EU Data Act for Connected Products: Access-by-Design API Checklist TL;DR Connected products and related services placed on the market after 12 September 2026 need access by design under the EU Data Act. Catalog generated data and necessary metadata, map each class to its user and holder, document whether direct access is feasible, and provide an authenticated API or export path where needed. Test tenant isolation, delegation, revocation, privacy, trade-secret controls, load, and disclosure accuracy. Connected products and related services placed on the EU market after 12 September 2026 must be designed so generated data and necessary metadata are accessible to users easily, securely, free of charge, in a comprehensive, structured, commonly used, machine-readable format, and directly where relevant and technically feasible. Product architecture now determines whether access is real or theoretical. This guide focuses on the device-to-cloud implementation gap. It does not repeat the cloud-switching analysis in our software-takeover content and is not legal advice. What must the product make possible? DutyProduct behaviorImplementation control Access by designDirect access where relevant and technically feasibleDocument the direct-access decision for each data classOn requestWithout undue delay and, where applicable, continuously and in real timeProvide authenticated API or export flows with service monitoringPre-contract informationVolume, format, frequency, storage, access, and retentionGenerate accurate product disclosures from the same system catalog What data needs an access path? Build a catalog of raw and pre-processed data generated by use of the product or related service, plus the metadata needed to interpret it. For each class, record the user, holder, source, cadence, volume, format, retention, personal-data status, trade-secret risk, security impact, and access method. Separate observed sensor and event data from inferred or derived analytics.Map physical ownership, account roles, tenancy, and delegated access to a verified user relationship.Expose units, timestamps, device identity, quality flags, and schema version with the data.Keep the product disclosure synchronized with actual firmware, app, API, and retention behavior. What does an access-by-design API look like? Use explicit resources, stable identifiers, documented schemas, pagination or streaming, scoped authorization, export jobs for large histories, and auditable revocation. Return useful errors and data-availability windows. Do not make users scrape a dashboard or file repeated support tickets. Authenticate the user and prove their relationship to the device before issuing access.Apply tenant and device boundaries on every query, then regression-test cross-tenant isolation.Rate-limit abusive traffic without making normal continuous or real-time access impossible.Offer deletion, delegation, and third-party sharing flows consistent with privacy and contract controls. How should trade secrets and security be handled? Classify risk per field and access path rather than declaring an entire dataset secret. Apply proportionate technical and organizational measures, preserve reasons for restrictions, and provide escalation. Security controls should narrow abuse without quietly nullifying the user's access right. Threat-model device takeover, token theft, enumeration, inference, replay, and bulk extraction.Use data minimization, purpose-aware scopes, encryption, monitoring, and time-limited credentials.Create an evidence trail for withheld, delayed, or reduced access and the legal basis used. An eight-step readiness checklist Identify connected products and related services placed on the market after 12 September 2026.Catalog generated data and metadata, including source, volume, cadence, retention, and user.Decide direct, API, export, or assisted access per data class and document feasibility.Implement device-user identity, delegation, authorization, and tenant isolation.Publish versioned schemas and machine-readable outputs with provenance and quality metadata.Align contracts and pre-contract disclosures with actual technical behavior.Load-test continuous access and rehearse security, privacy, trade-secret, and revocation cases.Measure access success, fulfillment time, stale data, authorization failures, and support escalation. Useful service paths: Internet of Things See it in production: Bond Analytics Platform Decide it first: How to choose a software development agency EU Data Act connected-product FAQ Which products face the access-by-design duty from September 2026? The duty applies to connected products and related services placed on the market after 12 September 2026, subject to the regulation's scope and exceptions. Must access always be direct from the device? No. Direct access is required where relevant and technically feasible. Otherwise the data holder must provide an", "articleSection": "IoT", "author": { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/" }, "citation": [ { "@type": "WebPage", "name": "Regulation (EU) 2023/2854", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854" }, { "@type": "WebPage", "name": "European Commission Data Act explained", "url": "https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained" }, { "@type": "WebPage", "name": "Bundesnetzagentur Data Act background", "url": "https://www.bundesnetzagentur.de/EN/Areas/Digitalisation/DataAct/background/1-Data/start.html" } ], "dateModified": "2026-08-24", "datePublished": "2026-08-24", "description": "Connected products and related services placed on the market after 12 September 2026 need access by design under the EU Data Act. Catalog generated data and necessary metadata, map each class to its user and holder, document whether direct access is feasible, and provide an authenticated API or export path where needed. Test tenant isolation, delegation, revocation, privacy, trade-secret controls, load, and disclosure accuracy.", "headline": "EU Data Act: Connected-Product API Checklist", "image": "https://wavect.io/img/blog/headers/header_eu-data-act-connected-product-api-2026.svg", "inLanguage": "en", "keywords": "EU Data Act, Connected Products, API Architecture", "mainEntityOfPage": { "@id": "https://wavect.io/blog/eu-data-act-connected-product-api-2026/", "@type": "WebPage" }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/blog/eu-data-act-connected-product-api-2026/", "wordCount": 1061 } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/blog/overview/", "name": "Blog overview", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/blog/topics/delivery-qa/", "name": "Delivery and QA", "position": 3 }, { "@type": "ListItem", "item": "https://wavect.io/blog/clusters/architecture-platforms/", "name": "Architecture and platforms", "position": 4 }, { "@type": "ListItem", "item": "https://wavect.io/blog/eu-data-act-connected-product-api-2026/", "name": "EU Data Act: Connected-Product API Checklist | ", "position": 5 } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "The duty applies to connected products and related services placed on the market after 12 September 2026, subject to the regulation's scope and exceptions." }, "name": "Which products face the access-by-design duty from September 2026?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. Direct access is required where relevant and technically feasible. Otherwise the data holder must provide an effective request-based access path under the applicable rules." }, "name": "Must access always be direct from the device?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Article 3 describes access for users as easy, secure, free of charge, comprehensive, structured, commonly used, and machine-readable." }, "name": "Can we charge users for their product data?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Sometimes an export is part of the solution, but adequacy depends on the data, metadata, cadence, format, volume, and whether continuous or real-time access is applicable." }, "name": "Does a CSV export satisfy the Data Act?" } ] } ```