The EU Data Act, Regulation (EU) 2023/2854, sets rules on who may access and share data from connected products, on switching between cloud services, and on unfair terms imposed in data contracts between businesses, and each of these reaches a company asked to license data for AI training. It is an access and contract law, not an AI law, and it is also called the European Data Act.
The official text is Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, CELEX 32023R2854, available at the EUR-Lex text of the Data Act. It entered into force on January 11, 2024 and applies from September 12, 2025. The page covers the rules that touch AI training data licensing, as of November 10, 2026, and keeps the pending amendment proposal apart from the final text.
Each date and article on this page was checked against the Official Journal or a Commission or Parliament page, following the rules on how we source, date and check every figure.
What the Data Act Regulates and Where AI Training Data Fits
The Data Act regulates four things that matter in an AI data deal: how a data holder may use and pass on product data, how connected products are designed for access, how a customer leaves a cloud or SaaS provider, and which data contract terms bind between businesses. Each has its own article and its own date.
- Product data: a data holder uses non-personal data from a connected product only under its contract with the user (Art. 4(13)-(14), applicable from 2025-09-12).
- Access by design: connected products and related services placed on the market after 2026-09-12 must be built for data access (Art. 3(1), Art. 50).
- Switching: cloud and SaaS customers have a statutory route to take their data when they change provider (Chapter VI, Arts. 23 to 31).
- Imposed terms: an unfair data term that one enterprise imposes on another is not binding (Chapter IV, Art. 13).
The Act is not an AI law, and the record used for this page does not mention AI training. Its effect on a training data deal comes through these four routes. The Act has further chapters, on public-sector access and on international access, that sit outside what this page describes. The reading order that follows starts with the dates, because the same company can be inside one part of the Act and outside another on the same day.
Not the AI Act and Not a Marketplace Law: Telling the EU Data Rules Apart
The Data Act is a different regulation from the AI Act and from the Data Governance Act, although searches and even search results mix them up. The AI Act is Regulation (EU) 2024/1689 and binds providers of general-purpose AI models, whose Art. 53 duties apply from 2025-08-02; those are the buyer's obligations, described under the EU AI Act Article 53 duties.
The Data Governance Act is Regulation (EU) 2022/868 and applies from 2023-09-24 (Art. 38). It sets rules for data intermediation services, and the Commission's proposal COM(2025) 837 would repeal it.
When Each Part of the Data Act Applies
The Data Act took effect in stages, and nine dates between 2023 and 2027 decide which part binds a given product, cloud contract or data license. The table lists them in date order, as of 2026-11-10.
| Date | What happens | Provision | Status as of 2026-11-10 | Source |
|---|---|---|---|---|
| 2023-12-22 | Published in the Official Journal (OJ L, 2023/2854) | citation | done | eur-lex.europa.eu |
| 2024-01-11 | Entry into force, 20th day after publication | Art. 50 | done | eur-lex.europa.eu |
| 2024-01-11 to 2027-01-12 | Cost-based switching charges allowed | Chapter VI | running | digital-strategy.ec.europa.eu (Commission summary) |
| 2025-09-12 | Regulation applies | Art. 50 | in effect | eur-lex.europa.eu |
| 2025-09-12 | Chapter IV applies to contracts concluded after this date | Art. 50 | in effect | eur-lex.europa.eu |
| 2026-09-12 | Art. 3(1) access by design for connected products and related services placed on the market after this date | Art. 50 | in effect | eur-lex.europa.eu |
| 2026-11-06 | Model terms published: Recommendation (EU) 2026/2394 of 2026-10-29, non-binding; Art. 41 had set "before 2025-09-12" | Art. 41 | published | eur-lex.europa.eu (CELEX 32026H2394) |
| 2027-01-12 | No switching charges | Art. 29 | ahead | eur-lex.europa.eu |
| 2027-09-12 | Chapter IV reaches contracts concluded on or before 2025-09-12 that are of indefinite duration or expire at least 10 years from 2024-01-11 | Art. 50 | ahead | eur-lex.europa.eu |
The regulation-wide date is September 12, 2025, never "applies from 2024", because the entry into force of January 11, 2024 only started the 20-month run-up. Chapter IV has its own transition: a contract concluded on or before September 12, 2025 stays outside the unfair-terms test unless it runs for an indefinite period or for at least 10 years from January 11, 2024. Two dates are still ahead as of 2026-11-10: January 12, 2027 for switching charges and September 12, 2027 for older long contracts.
Connected-Product Data: Why a Manufacturer Cannot Simply Pass It to an AI Buyer
A data holder may use non-personal data from a connected product only under its contract with the user, and it may not make that data available to a third party, such as an AI buyer, outside that contract (Art. 4(13) and (14) of Regulation (EU) 2023/2854). The rule is the AI-training consequence of the Act that comparable explainers leave out.
It applies from 2025-09-12 and hits the sectors the record names: manufacturers, automotive companies and energy companies. For a deal, the user contract, not the data holder's own wish, decides whether product data can be licensed. The contract terms are therefore the first document to check, before any buyer is approached. A manufacturer whose user contracts say nothing about third-party sharing cannot treat that silence as permission, because the restriction sits in the Act itself and not in the contract.
Personal data in a product data set also falls under the GDPR, which this page does not restate. What the user's own access right and third-party sharing right contain is not described here. A company assessing product data starts with the rights audit before licensing data to AI companies.
Access by Design for Products Placed on the Market After September 12, 2026
Connected products and related services placed on the market after September 12, 2026 must meet the access-by-design obligation of Art. 3(1), so newer devices must be built for data access while older ones carry no such duty (Art. 50). The date therefore splits a manufacturer's product fleet by the day each product is placed on the market. A seller can use that split to sort its fleet into products that must be built for access and products that need not be. Products placed on or before that day carry no Art. 3(1) design duty, while the Art. 4(13)-(14) restriction on passing data to third parties covers the data holder's use of data from both groups. This page states no technical content of the design duty beyond that label.
Getting Company Data Out of a Cloud Service: Switching Under Chapter VI
Chapter VI of the Data Act (Arts. 23 to 31) gives a cloud or SaaS customer a statutory route to take its data with it when it switches provider, but it is not a general right to export data in order to sell it. Three points from the Commission's summary and Art. 29 matter for a seller.
- Providers must offer open interfaces and machine-readable export (Commission summary, checked 2026-11-09).
- Cost-based switching charges are allowed from 2024-01-11 to 2027-01-12 (Commission summary).
- Switching charges are removed from 2027-01-12 (Art. 29).
The export a licensing deal needs therefore follows the provider's own export features and contract terms, not a Data Act entitlement to ship records to a buyer. Notice and transition periods are not stated on this page. How each provider exports data is covered under export rights and mechanics by source system, and the Data Act adds only the switching route on top of those. A customer that moves from one provider to another faces no switching charges from 2027-01-12, but a buyer of its records gains no right from that route.
Imposed Clauses in a Business Data License: Chapter IV in Brief
When one enterprise unilaterally imposes a term on data access and use, or on liability and remedies, on another enterprise, the term is not binding if it is unfair (Art. 13(1)), which can reach the standard license terms a large AI buyer offers a data seller. Three points frame the rule.
- Test: a term is unfair if it grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing (Art. 13(3)).
- Exclusions: the main subject matter of the contract and the adequacy of the price are outside the test (Art. 13(8)); a term is unilaterally imposed if one party supplied it and the other could not influence it despite trying to negotiate (Art. 13(6)).
- Dates: Chapter IV applies to contracts concluded after 2025-09-12, and from 2027-09-12 to older contracts of indefinite duration or expiring at least 10 years from 2024-01-11 (Art. 50).
Art. 41 required the Commission to recommend non-binding model terms before 2025-09-12. The Commission adopted them as Recommendation (EU) 2026/2394 on October 29, 2026 (OJ 2026-11-06), together with standard contractual clauses for cloud computing contracts. Both are non-binding, so a party may use them as a reference or depart from them. They replace the status of a draft that earlier commentary still describes. The black list, the grey list and the model terms are set out under Data Act Article 13 unfair terms in B2B data licenses.
How the Data Act Sits Beside the GDPR, Copyright and Trade Secrets
The Data Act decides access to data and the fairness of data terms, while other EU instruments decide whether personal data may be disclosed, whether content may be mined and whether a delivered dataset stays confidential. Four instruments recur in a training data deal.
- GDPR: Regulation (EU) 2016/679 applies from 2018-05-25 and governs any personal data in the set.
- Copyright: Art. 4 of Directive (EU) 2019/790 allows commercial text and data mining of lawfully accessible content unless the rightholder reserves it, machine-readably for online content.
- Trade secrets: Directive (EU) 2016/943 treats use by a recipient who knew or ought to have known of an unlawful source as unlawful (Art. 4(4)) and caps limitation periods at 6 years (Art. 8(2)).
- Database right: Directive 96/9/EC gives a database maker a right against extraction and re-utilisation (Art. 7(1)) that can be licensed (Art. 7(3)).
A deal that involves personal product data needs both layers, and the GDPR rules for AI training data apply next to the Data Act. This page does not state which instrument prevails where they meet. For a seller the practical point is that a clean answer under the Data Act does not settle personal data, mining reservations or confidentiality, and each layer needs its own check.
Pending, Not Final: The Amendment Proposal That Would Reach the Data Act
The Commission's Digital Omnibus proposal COM(2025) 837 of November 19, 2025 would amend the Data Act, and as of November 10, 2026 the European Parliament lists it as "Awaiting committee decision", so every rule on this page is the final text in force. A proposal binds nobody until it is adopted and published. Three facts describe its status.
- The procedure is 2025/0360(COD).
- A joint ITRE-LIBE committee draft report dates from 2026-06-22 and amendments were tabled on 2026-07-27.
- The proposal would also repeal the Data Governance Act and the Open Data Directive.
Which Data Act articles the proposal changes is not stated here, and no Council position is described. Procedure detail sits with the EU Digital Omnibus proposal.
Benefits, Risks, Downsides and Alternatives for a Data Holder Under the Data Act, Including Not Licensing
The Data Act gives a data seller some protection against imposed terms but also fences off product data it might have wanted to license, and licensing other data or not licensing at all remain valid choices. The lists show both sides, with the article and date behind each item.
Benefits
- Unfair data terms imposed by another enterprise are not binding, from 2025-09-12 for new contracts (Art. 13, Art. 50).
- A published non-binding reference text exists since 2026-11-06 (Recommendation (EU) 2026/2394).
- Switching charges end on 2027-01-12 (Art. 29).
Risks
- Licensing product data outside the user contract breaches Art. 4(13)-(14).
- Negotiated terms fall outside Art. 13, which needs unilateral imposition, and price is excluded (Art. 13(6), (8)), so a seller may still need to negotiate the clauses of an AI data licensing agreement instead.
- The amendment proposal could change rules later; it is pending only.
Downsides
- User contracts must be reviewed product line by product line.
- Older long contracts reach Chapter IV only from 2027-09-12.
- Switching is not an export-for-sale right.
Alternatives
- License only data outside the product-data rule, such as internal business records, after a rights check.
- Renegotiate user contracts before any product-data license.
- Wait for the outcome of the amendment proposal, without assuming it passes.
- Not licensing at all.
Every alternative to selling data to AI labs, including not selling stays open to a data holder.
Beyond This Page: Related EU Instruments, Sectors and Seller Steps
The Data Act is one of several EU instruments on a training data deal, and the parent page compares them all with their dates. The full set of EU rules for AI training data sits beside the wider AI training data law by jurisdiction.
- Content: whether content may be mined under the EU text and data mining exception
- Marketplaces: rules for data intermediation services
- Confidentiality after delivery: trade secrets and licensed datasets
- Rights in a dataset: database right and licensing datasets
- Data type most touched by the product-data rule: sensor, IoT and telemetry data
- Sectors: manufacturers licensing industrial data, automotive companies licensing data and energy and utility companies licensing data
- Terms: how buyer terms compare in the license clause matrix
- Process: the full seller process in sell or license company data to AI companies
How This Page Is Sourced and Dated
Every rule here cites the Official Journal text of Regulation (EU) 2023/2854 or a Commission or Parliament page, with the date it was checked. The method is described under how we source, date and check every figure, and this page is general information about the Data Act, not legal advice for any specific product, contract or deal.
Frequently Asked Questions
What is the EU Data Act?
The EU Data Act is Regulation (EU) 2023/2854, applicable since September 12, 2025, on access to connected-product data, cloud switching and unfair data terms between businesses. It entered into force on January 11, 2024.
Who does the EU Data Act apply to?
It applies to data holders of connected-product data such as manufacturers, to cloud and SaaS providers, and to enterprises that impose data contract terms on each other. The product-data rule, the switching chapter and the unfair-terms chapter each address one of these groups, so a single company can fall under one, two or all three depending on what it holds and whom it contracts with.
Is the EU Data Act the same as the EU AI Act?
No: the AI Act is Regulation (EU) 2024/1689 and binds AI model providers, while the Data Act governs data access and data contracts. A training data deal can touch both, but the Data Act duties fall on data holders, providers and contract parties, not on the model provider as such.
Does the Data Act let a company export its cloud data to sell to AI companies?
No: Chapter VI is a switching route, not a general right to export data for sale. It lets a customer move data when it changes provider, and the provider's own export features still decide how.