EU Data Act: What the September 2026 Milestone Means for SMEs

What changed on 12 September 2026

On 12 September 2026, the EU Data Act reached its second major milestone. The regulation has applied in general since 12 September 2025, as the European Commission explains, but from 12 September 2026 the so-called access-by-design obligation in Article 3(1) also took effect. Connected products and related services placed on the EU market from that date must be designed so that the data they generate is accessible to the user by default, easily, securely and free of charge, in a structured and machine-readable format, according to an analysis by Heuking.

The rule only covers new products. Products already on the market do not need to be retrofitted; the obligation applies to product generations launched after the cut-off. Connected products are broadly defined and can include vehicles, household appliances, wearables and industrial machinery, as McCann FitzGerald notes. For manufacturers, the date came one day after another one: from 11 September 2026, the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours, as Faegre Drinker sets out.

The September milestone is not the end of the timeline. From 12 January 2027, providers of cloud and other data processing services must remove switching charges entirely, according to the Commission. From 12 September 2027, the Data Act's rules on unfair contract terms will also reach many older contracts: those concluded on or before 12 September 2025 that run indefinitely or until at least January 2034, as the German Bundesnetzagentur describes.

Why the EU Data Act matters for a small business

Most small businesses will not be directly hit by the access-by-design rule. Under the Data Act, micro and small companies face reduced obligations as manufacturers, according to the Commission, and Faegre Drinker notes that the Article 3(1) design obligations do not apply to products made by micro and small enterprises, subject to conditions. Those conditions matter, so a growing hardware company, or one linked to a larger group, should check its own position rather than assume it is out of scope.

For many smaller businesses, the more practical effect is on the contracts they sign. The Data Act's unfair-terms rules protect businesses against data-related clauses that a stronger party imposes without real negotiation. The Bundesnetzagentur describes a term as unilaterally imposed when one party proposed it and the other could not influence its content despite trying to negotiate. Terms that exclude or limit liability for intentional acts or gross negligence are always unfair, and a further list of terms is presumed unfair. According to Pillsbury, the rules cover clauses on data access and use in any B2B contract, even where data is not the main subject, and presumed-unfair terms include blocking a party from using its own data or denying it access to data during or after the contract.

This is where AI vendors come in. Many small businesses now buy AI tools, analytics platforms or software-as-a-service products on standard terms that say a great deal about who may use the customer's data, for what purposes and with what liability. Whether a specific clause falls under the Data Act depends on its wording and context, but businesses now have a clearer legal framework for questioning one-sided data terms, and cloud customers have stronger switching rights from early 2027.

The rules are still moving

The Data Act is also part of the EU's wider simplification agenda. Under the Digital Omnibus proposals, the Council's compromise position includes relief from cloud switching obligations for SMEs and small mid-cap providers on contracts concluded before 12 September 2025, and lower thresholds for refusing data sharing on trade secret grounds, as Greenberg Traurig reported on 15 July 2026. That text was not final, and as of 10 September 2026 the Digital Omnibus remained under legislative consideration, according to McCann FitzGerald. Businesses should plan for the rules as they stand today and treat the proposed changes as possible, not certain.

There is also help on the drafting side. In November 2025 the Commission published non-binding model contractual terms for data sharing and standard contractual clauses for cloud computing contracts, covering switching, exit, termination and security, as Bryan Cave Leighton Paisner summarises. They are voluntary templates designed to be adapted, but they give smaller businesses a useful reference point in negotiations.

Practical next steps

First, if you make or sell connected products, map which products will be placed on the EU market after 12 September 2026 and check whether the access-by-design obligation applies, including whether any small-enterprise relief is available in your case. Review how users can get their data and what your product documentation says about it. If you are also a manufacturer under the Cyber Resilience Act, make sure your incident and vulnerability reporting process is in place, since the two regimes can overlap.

Second, review your key vendor contracts, starting with AI tools, cloud services and software platforms that hold business or customer data. Look at clauses on the vendor's right to use your data, your right to access and export it, liability caps and termination. Note which contracts were signed before and after 12 September 2025, as the unfair-terms rules apply differently to each group.

Third, prepare for 12 January 2027. If you plan to change a cloud or software provider, understand your exit rights and data export arrangements now, and check how the provider handles switching charges in the transition period. When negotiating new contracts, the Commission's model terms and standard clauses can serve as a benchmark for what balanced terms look like.

Finally, keep an eye on the Digital Omnibus. If adopted, it may change some obligations, particularly around cloud switching for smaller providers. Because the right approach depends on each business's products, contracts and role in the data chain, it is worth getting advice for your own situation before making changes.

Brenvard's perspective

For Brenvard, the Data Act matters mostly on the buying side, as it does for most small businesses. We rely on cloud and software vendors for everyday work, and the switching and unfair-terms rules give us, and the businesses we work with, a better footing when reviewing those contracts. It also changes our own routine: before adopting a new AI or software tool, data-use clauses, export rights and exit terms deserve the same attention as price and features. The flip side is complexity. Contract review takes longer when there are more rules to check against, and small businesses may be tempted to skip it. We think the practical gain is clear, but only for firms that actually read the data clauses before they sign.

A calm way forward

The Data Act is gradually turning into practical obligations and practical rights. For most small businesses, the immediate task is less about redesigning products and more about understanding contracts, especially with AI and cloud vendors. Brenvard supports startups and smaller businesses with this kind of review through its legal support for small businesses, helping teams prioritise what matters before the 2027 deadlines arrive.

Sources

European Commission – Data Act explained (updated 15 December 2025)
Heuking – Data Act: Access by Design Becomes Mandatory as of 12 September (1 September 2026)
Faegre Drinker – September 2026 EU Compliance Deadlines for Connected Product Manufacturers (10 September 2026)
McCann FitzGerald – Data Act Developments: 2026 and Beyond (10 September 2026)
Bundesnetzagentur – Unfair contractual terms under the Data Act (accessed 1 October 2026)
Pillsbury / Sourcing Speak – The EU Data Act: Scope, Obligations and Enforcement (17 September 2025)
Greenberg Traurig – EU Digital Omnibus Package Proposes Amendments to Data Act (15 July 2026)
Bryan Cave Leighton Paisner – EU Data Act: New Model Contract Terms and Standard Clauses (November 2025)