This time the grandfathering holds

On 10 September we wrote about the reporting obligations of the Cyber Resilience Act, and the point was Article 69(3): no grandfathering. The obligation also covers the product shipped in 2019.

Two days later, on 12 September, the next obligation begins, and it is the exact opposite.

What applies from 12 September

Article 3(1) of the Data Act requires connected products and their related services to be designed so that product data and related service data are accessible to the user: easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly.

That is access by design. Not a right you have to assert, but a property the product has to bring with it.

Whom it covers, and this is the point

Article 50 governs application, and it distinguishes: the regulation has applied since 12 September 2025. The obligation under Article 3(1) applies to connected products placed on the market after 12 September 2026.

After, not from. The first day on which a newly placed product must meet the obligation is therefore 13 September. And for everything placed on the market before that, it does not apply. Not on substantial modification, not on update, not at all.

Cyber Resilience Act: the installed base is in. Data Act: the installed base is out. Read both regulations by their headline date and you reach the wrong conclusion both times. The answer is in the transitional provision each time, and each time it sits at the end.

What has applied for longer

Part of Article 3 is not new. Since 12 September 2025, paragraph 2 has obliged sellers, renters and lessors to inform before the contract is concluded: about the type, format and volume of data the product generates, whether continuously and in real time, where and for how long they are stored, and how the user can retrieve and erase them. That has applied for a year to every purchase.

You are usually the user

The obligation under paragraph 1 falls on manufacturers. Most organisations reading this page are not manufacturers but operate connected products: meters, building technology, vehicles, machines, sensors. For them the regulation is a property that future purchases must have. And because the grandfathering is complete, everything hangs on the date of purchase: what is in operation today will not receive access by design after the fact. What is procured from now on must bring it along.

One sentence for the next tender

That leads to a very practical consequence for procurement. Anyone buying connected products from now on can and should make the property from Article 3(1) a requirement: access to the generated data, structured, machine-readable, free of charge. Not as a wish, but as a reference to the obligation the manufacturer has anyway.

Two questions to ask

Take the last three connected products your organisation procured since September 2025. Do you have the particulars under paragraph 2 for them? If not, information you were entitled to has been missing for a year.

And open the next specification for a connected product. Does it state that the data must be accessible under paragraph 1? For anything placed on the market from now on, that is no longer an extra but a description of what the manufacturer owes.

The deadlines with legal references are in the compliance calendar. Which connected products are in your inventory and since when is answered by asset management.

Sources

Regulation (EU) 2023/2854 (Data Act), Article 3(1) and (2) and Article 50, in the Official Journal: EUR-Lex. The 10 September article on the Cyber Resilience Act: Grandfathering stops at reporting.