The Data Act is Regulation (EU) 2023/2854, applicable since 12 September 2025. Its Article 50 extends the “data access by design” obligation to connected products placed on the market after 12 September 2026. And its Article 29 bans charging switching fees for changing cloud service provider from 12 January 2027.
What the Data Act is and why it matters to an SME
The Data Act allocates access to the data that machines generate and limits what a provider can do to hold on to you. It is not about privacy, which remains the domain of the GDPR. It is about who may read the telemetry of a forklift, a meter or a piece of medical equipment, and under what conditions you can take that data elsewhere.
For a business that does not manufacture connected products, the Regulation has three points of entry:
- As a user of connected machines. If you buy machinery, vehicles or equipment fitted with sensors, you are entitled to the data they generate and to share it with a third party, such as your maintenance contractor, even if the manufacturer would rather you did not.
- As a customer of cloud services. Chapter VI of the Regulation requires your contract to include exit clauses with fixed time limits and removes switching charges.
- As a party to a business-to-business data contract. Article 13 declares unilaterally imposed terms on data access and use that are unfair to be non-binding.
The second and third apply to anyone running a document management system, an ERP or a process platform as SaaS. In other words, to almost everyone.
That is the question the Data Act answers on your behalf from 2027. In 30 minutes we show you how a complete repository is exported from Dokuflex, with documents, metadata, versions and audit trails, without asking anyone's permission.
The Data Act dates, in one table
The Regulation did not take effect all at once: it spreads its obligations across four milestones, two of which have already passed.
| Date | What happens | Basis |
|---|---|---|
| 11 Jan 2024 | Entry into force. Start of the transitional period in which cloud switching charges are capped at direct cost. | Art. 50 and Art. 29(1) |
| 12 Sep 2025 | General application of the Regulation: data access rights, control of unfair terms between businesses and provider-switching obligations. | Art. 50 |
| 12 Sep 2026 | “Access by design” is required of connected products and related services placed on the market after this date. | Art. 50 + Art. 3(1) |
| 12 Jan 2027 | Switching charges for data processing services are removed entirely. Changing cloud no longer carries an exit price. | Art. 29(1) |
| 12 Sep 2027 | End of the transitional regime for certain long-term contracts concluded before 12 September 2025. | Art. 50 |
That staggered calendar bears an uncomfortable resemblance to those of mandatory B2B e-invoicing and VERI*FACTU: whoever waits for the final milestone ends up buying in a hurry.
Access by design: what the 12 September 2026 milestone means
It means that a new connected product must be born with its data door open. Article 3(1) requires connected products to be designed and manufactured, and related services to be designed and provided, in such a way that product data and related service data, including the metadata needed to interpret them, are by default “easily and securely” accessible to the user, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and directly accessible where relevant and technically feasible.
Three nuances worth keeping in view:
- New products only. The design obligation applies to what is placed on the market after 12 September 2026. The fleet of machines you already own does not magically become accessible because a date has passed.
- “Free of charge” does not mean “without infrastructure”. Direct access is mandatory where relevant and technically feasible; in other cases the manufacturer may offer indirect access, with justification.
- Metadata counts. A dump of numbers without the information needed to interpret them does not satisfy Article 3. This is exactly what should be demanded of a document management system: documents without their metadata, versions and audit trails are not an archive, they are a folder.
If you are buying machinery in the coming months, that is the moment to ask in writing for the export format and the API. Once the contract is signed, the room for negotiation is a different matter.
Switching cloud provider: the time limits your contract must include
Chapter VI turns into a contractual obligation what until now depended on the provider's goodwill. Article 25 establishes that the contract for a data processing service must include a maximum notice period for initiating the switch of no more than two months and a mandatory maximum transitional period of 30 calendar days to complete it.
| Item | Legal limit | Nuance |
|---|---|---|
| Notice period to initiate the switch | Max. 2 months | Set by the contract, but it cannot go beyond this. |
| Transitional period | Max. 30 calendar days | The customer may extend it once, for the period it considers appropriate. |
| Exception for technical unfeasibility | Max. 7 months | The provider must give notice within 14 working days and justify it. |
| Switching charges (until 11 Jan 2027) | Direct cost only | No margins and no penalties dressed up as “migration fees”. |
| Switching charges (from 12 Jan 2027) | Zero | The ordinary service fees up to termination do remain payable. |
In addition, the provider must offer reasonable assistance during the switch and act with due care to maintain business continuity. In practice, that neutralises the classic argument of “exporting is a project, let's talk budget”.
Unfair terms between businesses: the novelty almost nobody has read
Article 13 introduces an unfairness test for business-to-business contracts, something previously reserved for consumer relationships. The rule is simple: a term concerning access to and use of data, or liability and remedies for breach, that has been unilaterally imposed by one party on the other and is unfair does not bind the party on which it was imposed.
Examples of the kind of wording worth examining closely in a business software contract:
- “The provider shall deliver the data in the format it determines at its sole discretion.”
- “Data export shall be invoiced in accordance with the professional services rate card in force.”
- “The provider may unilaterally modify the API access conditions with 15 days' notice.”
- “Upon termination, the provider shall delete the data 10 days after the end of the service”, without first guaranteeing an export window.
Not all of them are automatically void, since that depends on whether they were unilaterally imposed and whether they grossly deviate from good commercial practice, but all of them are negotiable and none of them has to remain there at the next renewal.
Checklist: seven questions to audit your software provider
These seven questions can be answered by reading the contract and testing the product in one afternoon. If any of them is left without a clear answer, you know what to negotiate.
- Is there an exit clause with the Article 25 time limits? No more than two months' notice, 30 days of transitional period.
- Can I export myself, from the interface, without raising a ticket? If the export depends on someone at the provider running it, that is not portability, it is a favour.
- What exactly comes out in the export? Documents, yes; but what about metadata, versions, signatures, approval history and audit trails?
- In which format? Structured and commonly used (XML, JSON, CSV, PDF/A). A proprietary dump that only its own product can read does not meet the spirit of the Regulation.
- Does the contract include any switching charge, migration fee or early termination penalty? From 12 January 2027, switching charges cannot exist.
- How long does the provider retain my data after termination, and how does it certify deletion? There must be an export window before deletion, and a certificate afterwards.
- Where is the data physically hosted and who can access it? The Data Act also adds safeguards against access by third-country authorities.
The same logic applies when you choose a new platform. If you are at that point, how to improve document management details what you actually take with you in a migration, and the ROI calculator helps you put figures on the cost of staying put.
How Dokuflex solves it: leaving has to be as easy as joining
Dokuflex, a low-code BPM platform with AI, starts from an idea that is uncomfortable for a vendor: the customer must be able to leave without asking permission. It is the only way for a renewal to be a decision rather than a surrender.
- Complete export from the interface itself. Documents with their metadata, versions, electronic signatures and audit trails, in structured, commonly used formats. It is not a billable professional service: it is a feature of the Dokuflex document management system.
- Processes are data too. Workflows designed in Dokuflex low-code BPM are exported in BPMN, which is a standard and not an in-house format.
- Self-contained signature evidence. A document signed in accordance with eIDAS is validated outside Dokuflex, with its seal and its evidence, as explained on the eIDAS electronic signature page. If a signature is only valid inside the product that generated it, it is a dependency, not a signature.
- Hosting in the European Union and published access rules. These are detailed on the security page, alongside the retention and deletion model.
- No switching charges, before they become illegal. No exit migration fee and no early termination penalty.
What Dokuflex cannot do is read your current contract with another provider. Someone on your team has to do that, and the best time is now, while the renewal is still a long way off.
Book 30 minutes and we will show you the complete export live →
Frequently asked questions
What is the Data Act and who does it apply to? +
The Data Act is Regulation (EU) 2023/2854, the EU regulation on harmonised rules for fair access to and use of data. It has applied since 12 September 2025 and governs who may access the data generated by connected products and related services, which terms are unfair in data contracts between businesses, and how customers must be able to switch between cloud service providers. It affects manufacturers of connected products, providers of data processing services and, as users, practically every business operating in Europe.
What exactly changed on 12 September 2026? +
Article 50 of the Regulation establishes that the obligation in Article 3(1), data access by design, applies to connected products and the related services linked to them placed on the market after 12 September 2026. In other words, from that date a new connected product must be designed so that the user can access its data easily, securely, free of charge and in a structured, machine-readable format. Products already placed on the market before that date are not subject to that design obligation.
Is it true that the Data Act bans charging for switching cloud provider? +
Yes, from 12 January 2027. Article 29 of the Data Act sets out a gradual withdrawal: from 11 January 2024 until 12 January 2027, providers of data processing services may only charge reduced switching charges, which must not exceed the direct costs they incur as a result of the switching process; from 12 January 2027 they may not impose any switching charges at all. The ordinary service fees up to termination remain payable.
How long can my provider take to return my data? +
Article 25 of the Data Act requires the contract to include a maximum notice period for initiating the switch of no more than two months, and a mandatory maximum transitional period of 30 calendar days to complete it. If it is technically unfeasible, the provider must notify the customer within 14 working days with a justification and may propose an alternative period not exceeding seven months. The customer also has the right to extend the transitional period once, for a period it considers more appropriate.
Does the Data Act replace the GDPR? +
No. The Data Act coexists with the GDPR and does not displace it. Where the data from a connected product includes personal data, a legal basis under the GDPR is still required to process it, and the right to data portability under Article 20 of the GDPR remains in force. The Data Act adds a layer covering data that is often not personal, such as industrial telemetry, usage logs and sensor data, and covering contractual relationships between businesses.
What should I check in the contract with my business software provider? +
Four things: whether there is an exit clause with a notice period of no more than two months and a transitional period of 30 days; whether the provider specifies which export formats it delivers and whether they include metadata, versions and audit trails in addition to the documents; whether any switching charges, early termination penalties or export fees appear; and whether there are unilaterally imposed terms restricting your access to your own data, which Article 13 of the Regulation treats as potentially unfair.
What happens if my provider does not comply with the Data Act? +
The Regulation leaves penalties to each Member State, which designates the competent authorities and sets the penalty regime. On the contractual level the effect is more immediate: an unfair term within the meaning of Article 13 is not binding on the business on which it was unilaterally imposed, and the rest of the contract remains in force if it can continue to exist without it. In practice, the useful lever for an SME is negotiation at renewal, not litigation.
Sources
- Regulation (EU) 2023/2854 of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act): Articles 3, 13, 25, 29 and 50.
- Article 3 of the Data Act: obligation to make product data and related service data accessible to the user.
- Article 25 of the Data Act: contractual terms concerning switching, two-month notice period and 30-day transitional period.
- Article 29 of the Data Act: gradual withdrawal of switching charges, with the 12 January 2027 milestone.
- European Commission — Data Act: entry into force on 11 January 2024 and application from 12 September 2025.
Make your next renewal a decision, not a surrender
Book 30 minutes: we go through the seven-question checklist against your current provider and show you live how a complete Dokuflex repository is exported, with metadata, versions and audit trails. No commitment.