Basics
EU Data Act: what manufacturers of connected products in Switzerland and Liechtenstein need to do now
By Dominik Natter · Last updated on 5 November 2026 · 13 min read
In short
The EU Data Act applies to manufacturers from Switzerland and Liechtenstein as soon as they place connected products on the EU market. Since 12 September 2025, users have been able to request the data from their machines and devices free of charge and have it passed on to third parties, and products placed on the market after 12 September 2026 must provide data access by design. Micro and small enterprises with fewer than 50 staff and no more than EUR 10 million in turnover or balance sheet total are exempt from these obligations, provided they are not part of a larger group. Everyone else needs a data inventory, an access route such as a customer portal with export or an API, and updated contracts.
Does the EU Data Act apply to manufacturers in Switzerland?
Yes, as soon as you place connected products on the EU market. Under Article 1, the Data Act, Regulation (EU) 2023/2854, applies to manufacturers of connected products and providers of related services regardless of where they are established. What counts is the market, not the registered office.
For a company in the Rhine Valley, eastern Switzerland or Liechtenstein, this means that every machine, device and installation you supply to customers in Germany, Austria or any other EU country falls under the Data Act if it collects and can transmit data. If you sell a device only in Switzerland, the Data Act does not apply to it. Switzerland has not adopted the Data Act.
The Data Act has applied since 12 September 2025. Since then, users have been able to request the data from their products. Since 12 September 2026, a design obligation has been added: new products must be built so that users can access their data easily, securely and free of charge.
- The Data Act has applied since this date, including users' right to their data
- 12.09.2025
- Products placed on the market after this date must offer data access by design
- 12.09.2026
- Staff and no more than EUR 10 million turnover: small enterprises are exempt
- under 50
- Maximum fine in Germany for failing to provide data access under Articles 3 to 5
- EUR 500,000
What is a connected product under the Data Act?
A connected product collects or generates data about its use or environment and can transmit that data, for example via mobile networks, Wi-Fi, cable or a diagnostic port. Related services come on top: digital services such as a control app or a remote monitoring portal without which the product could not perform certain functions, or which add functions later. Many products from our region are affected:
- Machines and installations with controllers, sensors and remote maintenance
- Commercial and household appliances with an app or cloud connection
- Measuring devices, pumps, heating and cooling systems and vehicles with telemetry
- Tools and construction equipment that report operating hours or locations
What users can ask of manufacturers
The user is whoever owns, rents or leases the product, usually your customer. If they cannot access the data directly on the product, the data holder must provide it on request: without undue delay, easily, securely, free of charge and in a machine-readable format. The quality must match what is available to you. Where relevant and technically feasible, this includes continuous and real-time access.
This right has applied since 12 September 2025, including for older products, as far as the data is available without disproportionate effort.
The user can ask you to deliver the data directly to a third party, such as an independent service company, an insurer or a software provider. This is free of charge for the user.
You may charge the third party reasonable compensation. If the third party is an SME, it may not exceed the cost of making the data available. Very large platforms designated as gatekeepers under the Digital Markets Act are excluded as recipients.
You only have to disclose trade secrets once protective measures have been agreed, such as a confidentiality agreement or strict access protocols. If no agreement is reached or confidentiality is breached, you may withhold or suspend the sharing.
In exceptional cases you may refuse if, despite protective measures, you are highly likely to suffer serious economic damage. You must justify this in writing on the basis of objective facts and notify the competent authority.
The user may not use the data to develop a product that competes with your connected product. Nor may they pass it on to third parties for that purpose or use it to gain insights into your economic situation.
Do not overlook this point: as data holder, you may only use non-personal data that your product generates at the customer's site on the basis of a contract with the user. If you already analyse machine data for product development or service, you need a contractual basis for it.
If the data relates to people, such as operators or drivers, data protection law applies as well.
Do we have to hand over machine data free of charge?
To your customers, yes. You must provide the data a product generates during use to the user free of charge. You may not charge the user a fee for accessing the data.
You may charge third parties to whom the customer has the data passed. The compensation must be non-discriminatory and reasonable and may include a margin. If the recipient is an SME, you may charge no more than the costs of formatting, transmitting and storing the data. You must disclose the calculation in enough detail for the recipient to check it.
Not every figure in your system is covered. Raw and pre-processed data are, for example temperature, pressure, running time or error codes, together with timestamps and context. What you derive from them with your own algorithms, such as a wear forecast, is outside the scope according to recital 15, unless you agree otherwise.
Free of charge also does not mean you have to collect new data. You must provide what is available without disproportionate effort and, for new products, what you make accessible by design.
Data Act: key dates for manufacturers
11 January 2024
Entry into force
The regulation enters into force but does not yet apply.
12 September 2025
Data Act applies
Users' right to their data and to sharing with third parties, pre-contractual information, rules on unfair terms for new contracts.
12 September 2026
Data access by design
Products and related services placed on the market after this date must provide data access by design.
12 January 2027
No more switching charges
Providers of cloud and data processing services may no longer charge customers for switching providers.
12 September 2027
Older contracts
The rules on unfair contract terms also apply to contracts concluded up to 12 September 2025 if they are open-ended or end in January 2034 or later.
Are SMEs exempt from the Data Act?
Micro and small enterprises are, medium-sized ones only briefly. Under Article 7, the data access obligations do not apply to data from products manufactured or designed by a micro or small enterprise. This covers the design obligation, the information obligations and sharing with users and third parties.
The EU SME definition applies. A small enterprise has fewer than 50 staff and no more than EUR 10 million in annual turnover or balance sheet total. Partner and linked enterprises are included in the count, so if your business is part of a group, the whole group often counts.
The exemption does not apply if a partner or linked enterprise does not itself qualify as a micro or small enterprise, or if you manufacture the product as a subcontractor for another company.
Data Act by size of manufacturer
| Size under the EU definition | Thresholds | Data access obligations |
|---|---|---|
| Micro enterprise | under 10 staff, no more than EUR 2 million turnover or balance sheet total | exempt, unless partner or linked enterprises are larger |
| Small enterprise | under 50 staff, no more than EUR 10 million turnover or balance sheet total | exempt, unless partner or linked enterprises are larger |
| Medium-sized enterprise | under 250 staff, no more than EUR 50 million turnover or EUR 43 million balance sheet total | apply, except in the first year after reaching this size and for products in the first year after placing on the market |
| Larger enterprise | above that | apply in full |
| As a subcontractor | any size | no exemption for the manufactured product |
Implementing the Data Act: how to make machine data accessible to customers
The Data Act does not prescribe any particular technology. It requires users to receive their data easily, securely and in a commonly used, machine-readable format, directly on the product where relevant. In practice there are three routes: directly on the device, via an export in a customer portal, or via an API to which customers and third parties connect their systems. This approach has proven itself:
Six steps to data access
01
Create a data inventory
What data does each product generate, where is it stored, for how long and in what format? This is the basis for everything else.
02
Trade secrets and personal data
Flag data that contains trade secrets or relates to people, and define the protective measures.
03
Choose the access route
On the device, export in a portal or API: decide per product line what is technically feasible and useful for customers.
04
Set up permissions
Each customer sees only the data from their own devices. The customer authorises sharing with third parties and can end it again.
05
Build export and API
Export as CSV or JSON with timestamps and field descriptions, plus a documented API for continuous data.
06
Update contracts and information
Pre-contractual information, a usage agreement for your own data use, confidentiality with third parties and fair terms.
What information you must provide before the contract
Since 12 September 2025, the seller, lessor or rental company has had to inform the user before the contract is concluded. That may be your dealer or you. Supply your dealers with the required information. Article 3(2) requires, among other things:
- the type, format and estimated volume of data the product generates
- whether it can generate data continuously and in real time
- whether the data is stored on the device or on a server, and for how long
- how the user can access, retrieve and delete the data
For related services such as an app or a service portal, further information is required: who the data holder is, whether and for what purposes you use the data yourself, how the customer can request and end sharing with third parties, their right to complain to the authority, whether the data contains trade secrets and how long the contract runs.
Take the opportunity to review your supply, service and maintenance contracts. Under Article 13, terms on data access and liability that you unilaterally impose on another business are not binding if they are unfair. This applies, for example, to excluding liability for intentional acts or gross negligence. In November 2025, the European Commission recommended non-binding model contractual terms on data access and use. They are a good starting point.
No software of your own, or a data portal?
Without your own software, this is often enough
- The device already has an export, for example via USB, a web interface or a diagnostic port, that customers can use themselves.
- You sell few devices into the EU and data requests are rare.
- Your controller or cloud supplier already offers data access as a feature.
- A documented process is sufficient: request via a form, export within a few days, encrypted delivery.
A data portal pays off when
- Your devices continuously send data to a cloud and customers should be able to retrieve it themselves.
- Customers want to pass the data to service partners or their own systems.
- You have many customers, sites or product lines and do not want to handle requests one by one.
- You want to build service, maintenance contracts or spare parts sales on the data.
The Data Act as an opportunity: service, maintenance and spare parts
The Data Act forces you to open up your data. Done well, it brings you closer to your customers. A portal in which customers see the running times, error messages and maintenance intervals of their machines is the natural place for service requests, maintenance contracts and spare parts orders.
The logic is simple: customers will get their data either way. If they get it from you in a useful form, the service business is more likely to stay with you. If they have to export raw data and analyse it elsewhere, you open the door to third-party providers. That is our assessment from customer portal projects, not a survey.
Existing customer portal features fit in well: documents such as operating manuals and declarations of conformity, order status, invoices and tickets. You can find more on our customer portal solution page.
What does implementing the Data Act cost?
That depends on where your data is today. All amounts are guide values excluding VAT.
If you already have a customer portal or a cloud platform, a data export with an API is an extension. A single interface or automation costs CHF 8,000 to 25,000 with us. A new customer portal with ERP integration costs CHF 25,000 to 80,000 depending on scope. For maintenance and operation, 15 to 20 percent of the project cost per year is typical. Details are in the guide "What does a customer portal cost in Switzerland and Liechtenstein?".
This does not include changes to the controllers and firmware of the devices themselves. Clarify those with your engineering team or your controller supplier. Keep the Cyber Resilience Act in mind as well, which brings security obligations for connected devices. More in the guide "Cyber Resilience Act: what applies to software from SMEs in Switzerland and Liechtenstein?".
What fines apply?
EU member states set the fines themselves. The Data Act only requires them to be effective, proportionate and dissuasive. In Germany, the Federal Network Agency (Bundesnetzagentur) has been the competent authority since 30 May 2026. The German implementing act provides for fines of up to EUR 500,000 for breaches of the design obligation and for data not provided, provided incorrectly or provided late, and up to EUR 100,000 or EUR 50,000 for other obligations.
In day-to-day business, a customer insisting on their rights or filing a complaint with the authority is more likely than a fine, in our assessment. That also costs time and trust.
Checklist for manufacturers of connected products
Go through these points with management, engineering and sales:
- Check your size: including partner and linked enterprises, are you a micro or small enterprise? Do you manufacture as a subcontractor?
- List your products: which products and apps do you supply to the EU, and which of them collect and transmit data?
- Mind the deadline: which devices go to the EU for the first time after 12 September 2026, including from current series?
- Create a data inventory: what data is generated, where is it stored, in what format and for how long?
- Define the access route: device, portal export or API, and who handles requests?
- Flag trade secrets: which data needs a confidentiality agreement?
- Update contracts: pre-contractual information, a usage agreement for your own data use, fair terms, documents for dealers.
- Review cloud offerings: if you run a platform yourself, the switching rules without switching charges apply from 12 January 2027.
Where this information comes from
EU Data Act
The information on scope, obligations and deadlines comes from Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data, in particular Articles 1 to 5, 7, 9, 13, 29, 40 and 50 and recital 15. For the interpretation of placing on the market we rely on the European Commission's frequently asked questions on the Data Act, for model contractual terms on the Commission's recommendation of November 2025, and for the Digital Omnibus on the Commission's proposal of November 2025.
SME definition
The thresholds for micro, small and medium-sized enterprises come from Commission Recommendation 2003/361/EC, which the Data Act refers to, and from the Commission's SME definition page.
Germany and Liechtenstein
Competent authority and fines in Germany come from the German act on the application and enforcement of the Data Act (DADG), in particular section 15, published in the Federal Law Gazette 2026 I No. 157. For Liechtenstein, we checked EFTA's EEA-Lex database entry for the Data Act.
Not legal advice
This guide is not legal or tax advice. Clarify your situation with a lawyer specialising in EU data law, particularly where group structures, trade secrets and contracts are involved.
As of November 2026.
Frequently asked questions
Does the EU Data Act apply to Swiss manufacturers?
Yes, as soon as you place connected products on the EU market or offer related services such as an app to users in the EU. Under Article 1, the Data Act applies regardless of where the manufacturer is established. It does not apply to devices you sell only in Switzerland, because Switzerland has not adopted it.
Does the Data Act apply in Liechtenstein?
For products you supply to the EU, yes, regardless of the EEA. Domestically it only applies once the EEA Joint Committee has incorporated it into the EEA Agreement. We had not found such a decision as of November 2026; the EFTA EEA-Lex database shows the current status.
Are SMEs exempt from the Data Act?
Micro and small enterprises are, medium-sized ones only briefly. A manufacturer with fewer than 50 staff and no more than EUR 10 million in turnover or balance sheet total does not have to meet the data access obligations, unless a partner or linked enterprise is larger or you manufacture as a subcontractor. Medium-sized enterprises are only exempt in their first year at that size and for products in the first year after they are placed on the market.
Do we have to hand over machine data free of charge?
To your customers as users, yes: you must provide the data the product generates during use free of charge, including timestamps and context. If the customer has the data passed to a third party, you may charge that third party reasonable compensation, but no more than your costs if it is an SME. You do not have to hand over your own analyses, such as wear forecasts from your algorithms.
How secure is customer data in the portal?
Each customer sees only their own data, enforced at the level of the database queries and verified with automated tests. On top of that come two-factor sign-in, encrypted transmission, access logging and hosting in the EEA.
Who holds the rights to the code and the data?
The data is yours. The source code is kept in a repository you have access to, and the usage rights to it pass to you once the work is paid in full. We rely on widely used technologies such as Next.js, C# and PostgreSQL, so that another team can take the software forward if needed.
Matching services:Customer portalsIntegrationsCustom software
Let us talk about your case.
20 minutes are enough to find out whether a custom solution is worth it for you.