Legal Perspective on the EU Data Act: A Q & A with Frederik Roos of Setterwalls
As of 12 September, 2026, new connected hardware or software entering the market must be designed to make data available to customers. This is the latest development in the ongoing rollout of the EU Data Act, which entered into force on 12 September 2025. It also has serious implications for anyone making or using predictive maintenance solutions, from OEMs, to sensor makers, to analytics providers.
Viking Analytics has, therefore, been covering the Data Act as it applies to predictive maintenance. You can read our article on the subject here.
For a legal expert's perspective on the Data Act, we reached out to Frederik Roos, Partner at Gothenburg's Setterwalls. As a specialist in IT law and data protection, intellectual property, and commercial agreements, Roos is particularly qualified to speak on the Data Act. And we found his answers so illuminating we've decided to publish them here.
Read on to learn how the EU Data Act affects data ownership, prospects for switching service providers, and conditions for data sharing, as well as how it creates opportunities in operations beyond maintenance, in AI development, for renewing digital strategies, and global data sharing.
Viking Analytics: One of the key insights behind the Data Act seems to be that users of connected devices and services have contributed to the creation of data, and are, therefore, on some level entitled to the fruits of that data. Could you comment on this?
Frederik Roos: Yes, one of the foundations behind the Data Act is the idea that users contribute to the generation of data and should be able to benefit from it. The reasoning is e.g. elaborated in Recital 6 of the Data Act, which explains that data generation results from the actions of at least two actors: the designer or manufacturer of the connected product, and the user of the product or service.
It is important to point out that the Data Act does not give the user “ownership” of the data. The Data Act allocates rights of access and use. Discussing “ownership” is a common misunderstanding, under Swedish and European law there is no such clear concept in regards to data. There are several different laws which affect data, including the GDPR with privacy protection rules, the Data Act, copyright, trade secrets acts, etc.—but there is no clear ownership regime. Between two parties—such as customer/product user and a manufacturer, or a product user and a service company—the majority of data rights can be divided between the parties through an agreement (“contract is king for data”).
The Data Act has now introduced some mandatory rights for product users which cannot be changed through such contracts. This is an important change, e.g. since data recorded by connected products is an important input for aftermarket, ancillary and other services.
In terms of scope of such mandatory user rights it is important to clarify that they apply to raw data (as-is generated by the product or service) and pre-processed data (e.g. cleaned up or formatted raw data). The user rights do not apply to “inferred or derived” data, e.g. data created by the manufacturer through more sophisticated analysis or proprietary algorithms.
VA: In predictive maintenance, we look at, for example, vibration data from sensors either built in to industrial equipment or added later, and we analyze that data to make inferences about when and how machines might break down. There are service providers dedicated to doing this manually and service providers who provide automations that accelerate this process. To what extent does the Data Act create opportunities for either with respect to service switching or data sharing?
FR: What you are describing is one type of activity that the Data Act is intended to help enable by securing mandatory data access rights for the product user and its designated service providers. The Data Act intends to level the playing field and increase competition for ancillary services. The intention is that this will accelerate innovation.
A manual and an automated predictive maintenance provider are in the same position: both are third parties, and both can receive the sensor data either from the user or directly from the manufacturer or another data holder. Vibration data from sensors would typically be data in scope for such access rights. Access is free of charge to the user, but under Articles 8 and 9 Data Act a data holder may charge a third party reasonable compensation on fair, reasonable and non-discriminatory (FRAND) terms, (which may include a margin unless the recipient is an SME or a not-for-profit research organization).
In addition to the user’s mandatory rights to data access—which can be seen as the core part of the Data Act—the act also includes a chapter with new rules for “service switching” which can be described as a type of data portability rights for non-personal data. The service user/customer should have the option to switch to another competitive service provider without being locked in with its current supplier by means of the current supplier holding all data or heavy break-up-fees in the contract (which are prohibited by the Data Act).
The service switching rules apply to scalable, elastic, on-demand cloud services (e.g. IaaS, PaaS or SaaS). Therefore, if the user of a connected product (the customer) has an existing predictive maintenance provider then the service switching rules in the Data Act can further support the possibility for a competing service provider to win over the customer. The competing service provider can get access not only to new data generated from the product (e.g. vibration data) but also to the customer’s existing service data. Furthermore the existing supplier would need to support migration without applying break-up-fees (under Article 29 Data Act switching charges may only be reduced to the costs incurred from 11 January 2024 and may not be imposed at all from 12 January 2027).
VA: Predictive maintenance can involve a lot of different parties, between equipment manufacturers, sensor makers, analytics software providers like us, maintenance service providers, and in-house maintenance teams. How effectively does the Data Act set a groundwork for the free sharing of information between these groups?
FR: The Data Act does not regulate data sharing between the entire ecosystem of actors—but indirectly the Data Act access rights for the users will indirectly affect all of these parties and to some extent incentivize data sharing. The equipment manufacturers will need to contract with its suppliers (including sensor makers) in order to fulfil its transparency and data sharing obligations towards the product users. Third party maintenance services providers will receive increased data access (through the users). In-house maintenance teams will also gain increased data access rights—and will have the opportunity to both use such data, but also to designate third parties who should receive access to the data.
Taken together, the groundwork is real but conditional. The Data Act gives the user a reliable right to pull data out of its equipment and to direct it to whichever supplier it chooses, which is the decisive change for an independent analytics provider. What it does not do is create a shared data environment among manufacturers, sensor suppliers, analytics providers and maintenance contractors: each link needs the user’s authorization, confidentiality arrangements have to be agreed up front, coverage across an industrial installation may be uneven where small suppliers are involved, and it can change from one year to the next as those suppliers grow. In practice, the Data Act lowers the barriers to multi-party projects considerably, but the contract will still be king when it comes to dividing data rights and other commercial terms between the parties.
VA: When we think about the logical conclusion of predictive maintenance, we foresee maintenance planning so airtight that production and staffing can plan around maintenance, rather than vice versa. To what extent does the Data Act support sharing data in this context? Could we see recruiters or logistics companies requesting data through third parties?
FR: The Data Act supports this use case, but only in one direction: the customer can push its data outwards to whoever it chooses, and no one can pull data in. Recital 26 Data Act confirms that the user is free to use the data for any lawful purpose, and Article 5 Data Act allows it to require the data holder to make the data available to a third party. Nothing in limits that third party to a technical or maintenance-related supplier, so a staffing agency or a logistics provider could be eligible as a recipient as an analytics platform.
A third party that has received data may not pass it on to another party unless it does so on the basis of a contract with the user. So, a recruiter can typically not approach an analytics provider and ask it to route product data across, and it cannot approach the equipment manufacturer directly either. The route runs through the customer in every case.
Data privacy must also always be taken into account—the GDPR still applies in parallel to the Data Act. Maintenance and production data can identify individual operators, shift teams or contractors, and where the requested data include personal data a valid legal basis under the GDPR is required.
The recipient’s hands are also tied once it has the data. Under Article 6(1) Data Act a third party (such as an analytics provider or logistic company) may process the data only for the purposes and on the conditions agreed with the user. Purpose limitation should therefore be negotiated at the outset.
VA: AI has been a big topic for the last three years, with much of the discussion focused on the major LLMs, their insatiable hunger for data, and the controversy surrounding how they access it. Gatekeeper laws may prevent the major AI players from abusing the Data Act, but does the Data Act create opportunities for new developments in AI?
FR: It does, though the opportunity is narrower and more specific than the framing of the question might suggest. The Data Act is not an AI statute, and facilitating AI development is not one of its stated objectives. What it does is open a new supply of industrial machine data to companies that previously had no way of reaching it. Indirectly this may lead to increased opportunities for machine learning and AI development.
The premise about gatekeepers in the question is correct. Companies designated as gatekeepers under the Digital Markets Act (Regulation (EU) 2022/1925) cannot be third parties within the meaning of Article 5 Data Act and cannot use the mandatory data-sharing mechanism in Articles 4 and 5. The rationale, set out in Recital 40 Data Act and question 36 of the Commission FAQ, is that the largest platforms already have an unrivalled ability to acquire data, so extending a mandatory access right to them would be disproportionate and would dilute the benefit for smaller businesses. This does not exclude gatekeepers from the market: they may still obtain the same data by other lawful means, may participate in voluntary arrangements, and may supply the cloud infrastructure on which a third party runs its own analysis.
There are also limits on what the data may then be used for. Article 4(10) Data Act prevents a user from using the data to develop a connected product that competes with the product the data came from. Recital 32 explains that the aim is to protect the manufacturer’s investment in the machine itself, not to shield its service business, and question 26 of the Commission FAQ confirms that the non-compete does not extend to competing related services. For an AI developer the boundary is therefore usually comfortable: building a better diagnostic model is permitted, building a rival machine on the strength of the data is not.
The Regulation also protects what the developer builds on top of the data, which matters as much as the access right itself. The Data Act obliges data holders to share raw and pre-processed data. Highly enriched data, however, falls outside the scope of the data sharing obligations.
VA: OEMs in manufacturing have developed data strategies around controlling access to data generated by the equipment they manufacture. How will they need to re-evaluate their data strategies in response to the Data Act?
FR: The central shift is that data control moves from being an engineering decision to being a contractual one. Recital 20 Data Act describes the position OEMs have occupied until now: through their control over the technical design of their products, manufacturers have been able to determine what data are generated and how access to them is granted. That is the strategy the Data Act dismantles. Design still matters, but it can no longer be used to decide who gets access, so an OEM that has built its aftermarket position on exclusive access to machine data needs a different basis for it.
In practice this means four things. The first is transparency at the point of sale. Under Article 3(2) Data Act the seller, rentor or lessor must tell the customer, before the contract is concluded, what data the machine is capable of generating, in what type, format and estimated volume, whether it can do so continuously and in real time, whether data are stored on the device or on a remote server and for how long, and how the customer may access, retrieve or erase them. Related service providers have a corresponding and more extensive obligation under Article 3(3). This is a documentation exercise that must be completed product line by product line.
The second is design, and here the timing is more generous than is sometimes assumed. Although the Regulation applies from 12 September 2025 under Article 50 Data Act, the design obligation in Article 3(1) applies only to connected products, and the services related to them, placed on the market after 12 September 2026. For those products, data must by default be easily, securely and free of charge accessible to the user in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible.
The third, and the most immediate, is that the OEM’s own use of the data now needs a contractual basis. Under Article 4(13) Data Act a data holder may use readily available non-personal data only on the basis of a contract with the user and may not use those data to derive insights about the user’s economic situation, assets or production methods in a way that could undermine the user’s commercial position.
The strategic conclusion is that exclusivity is no longer available as a business model, but differentiation is. The Data Act does not require an OEM to give away the insights it generates from product data, only the raw and pre-processed data themselves, and it leaves the OEM free to compete on the quality of its own analytics and aftermarket services. The manufacturers that adapt best are likely to be those that treat compliance as a product feature—offering clean, well-documented data access as part of the value proposition—rather than those that spend the transitional period looking for ways to keep the gate closed.
VA: The EU Data Act is obviously European. But EU regulations tend to produce ripple effects that span the globe. How are markets outside the EU aligning their policies with the Data Act? And will OEMs operating in Europe have no choice but to adapt worldwide?
FR: The question has two halves, and the honest answer differs for each. On the first, we are not in a position to say how markets outside the EU are aligning their national policies with the Data Act; that is a question of domestic legislative developments in those countries rather than of Data Act itself. What can be said with confidence is how far the Data Act reaches on its own terms, and that is what drives the adaptation question.
The Data Act reaches non-EU businesses directly. Article 1(3)(a) Data Act covers manufacturers of connected products placed on the Union market and providers of related services, and Article 1(3)(f) covers providers of data processing services offered to customers in the Union, in each case irrespective of where the entity is established. A manufacturer in a third country that sells into the EU is therefore caught, and question 28 of the Commission FAQ confirms that all connected products placed on the EU market must be designed so that the user’s access rights can be exercised.
We are not aware of foreign local legislative policies building on the Data Act—at least not yet—but for manufacturers outside the EU with a global customer base commercial logic, rather than law, is what pushes OEMs towards worldwide adaptation. While a manufacturer is legally free to run a two-track model this will be expensive in practice. Once a product line has been designed for Data Act access, maintaining a separate non-EU version means duplicated engineering, parallel documentation and two sets of contract terms. For global manufacturers it may be simpler, more cost-effective—and more customer centric—to voluntarily apply the EU framework across the board. That may be how the ripple effect actually travels in the first phase: not through third countries copying the legislation, but through manufacturers exporting their compliance architecture to markets that do not require it.
MultiViz - AI powered vibration analysis-conditioning monitoring for smarter predictive maintenance.