~/teaching · eu digital sovereignty · class 5
EU strategy for data, in production: the Data Act and the DGA for engineers
What the Data Governance Act and the Data Act make somebody build, and where it breaks in production. Summary of a guest lecture at the University of Luxembourg
Notice. Educational material, written in a personal capacity: not legal advice, and not the position of any employer. Before relying on an article, read it in the Official Journal; the state of play of the proposals is given as of 17 October 2026.
Abstract
The European strategy for data of February 2020 promised a single market for data. Two regulations carry it into systems: the Data Governance Act (Regulation (EU) 2022/868), which creates trusted roles, and the Data Act (Regulation (EU) 2023/2854), which creates rights over machine-generated data and obligations for manufacturers, data holders and cloud providers.
This page reads both texts the way a platform team has to: as a backlog. Each new right of access is a new interface, and each new interface is a new attack surface. Three cases make it concrete (cloud switching, foreign government access, access to product data), then four failure modes show where compliance breaks before any lawyer is involved.
It summarises class 5 of the course EU Digital Sovereignty at the University of Luxembourg (20 October 2026). The slides are public, with the speaker notes under each slide.
Plan of the deck
- Overview. A right with no SDK; the argument of the hour; three typefaces for three voices (what the text says, what someone builds, what you can cite).
- The two instruments. Two texts, two jobs; the three roles of the DGA; the Data Act read as a backlog; the Digital Omnibus that would repeal the DGA.
- Three cases. Leaving a cloud provider (Articles 23 to 31), a foreign authority asking for EU data (Article 32), a mandated feature on connected products (Articles 3 to 5).
- In production. Identity, evidence, quality, the personal data boundary; the adjacent regimes that ask for the same logs; a checklist; four common misreadings.
- Questions. A law-to-engineering glossary, four questions worth arguing about, and where to read the texts.
Data Governance Act vs Data Act: two texts, two different jobs
The DGA offers statuses that nobody is forced to take; the Data Act creates rights that somebody has to serve.
| Data Governance Act | Data Act | |
|---|---|---|
| Reference | Regulation (EU) 2022/868 | Regulation (EU) 2023/2854 |
| In force | 23 June 2022 | 11 January 2024 |
| Applies | 24 September 2023 (Art. 38) | 12 September 2025 (Art. 50) |
| Posture | Enabling: roles and a trust framework | Prescriptive: rights and hard obligations |
| Real question | Who may act as a trusted go-between? | Who may read, move and port machine data? |
| Status | Proposed for repeal (COM(2025) 837) | Applies; amendments proposed |
The DGA creates three roles. Public bodies may allow the re-use of protected data (confidential, commercially sensitive or personal) under conditions (Chapter II, Articles 3 to 9), which means secure processing environments and an access workflow with an audit trail. Data intermediation services must notify a competent authority (Article 11) and, under Article 12(a), may not use the data for other purposes and must provide the service through a separate legal person: an isolation boundary you must be able to demonstrate. Data altruism organisations can be entered in a public register and use the label of a data altruism organisation recognised in the Union (Article 17).
The Data Act is the opposite posture. Chapter II gives users of connected products access to the data their use generates (Article 4) and the right to have it shared with a third party (Article 5). Chapter III sets fair, reasonable and non-discriminatory terms when a data holder must make data available (Article 8). Chapter V lets public bodies request data in exceptional need. Chapter VI governs switching between cloud providers. Article 32 deals with unlawful third-country governmental access to non-personal data. Chapter VIII adds interoperability and essential requirements for smart contracts, including a way to stop them (Article 36(1)(b)).
Access to product data: the EU has mandated a feature
Since 12 September 2025 the user of a connected product can ask for its data; products placed on the market after 12 September 2026 must be designed for it.
Article 3(1) requires connected products and related services to be designed so that product data and related service data, with the metadata needed to interpret them, are by default accessible to the user easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and directly where relevant and technically feasible. Under Article 50 this design obligation applies to products and services placed on the market after 12 September 2026. Articles 3(2) and 3(3) add pre-contractual information.
Where data cannot be accessed directly, the data holder makes it available on request (Article 4) or shares it with a third party the user names (Article 5). A company designated as a gatekeeper under the Digital Markets Act is not an eligible third party (Article 5(3)). Trade secrets are preserved through measures agreed before disclosure; the data holder may withhold or suspend sharing when no agreement is reached, and may refuse only in exceptional circumstances, on a reasoned basis (Article 4(6) to 4(8)). Chapter II does not apply to data from products made, or related services provided, by micro and small enterprises (Article 7).
| The text creates | The system gets | The failure you already know |
|---|---|---|
| A user right to product data | An authenticated read path into internal telemetry | Broken object-level authorisation |
| Sharing with a third party | A delegation flow with tokens | Consent phishing: the OAuth grant to a hostile app |
| Proof that the user is the user | A binding between a person and a resold device | Social engineering of the request |
| Protection of trade secrets | Field-level filtering | Over-disclosure of an unreviewed export |
| Availability of access | A public endpoint on an industrial fleet | Denial of service |
Cloud switching under the Data Act: the clock runs to 12 January 2027
From 12 January 2027, a cloud provider may not charge a customer for leaving; until then it may charge only the costs directly linked to the switch.
The switching clock
- 11 January 2024. Entry into force. Switching charges may not exceed the costs incurred by the provider that are directly linked to the switching process (Article 29(2) and (3)).
- 12 September 2025. The Act applies. The contract must state the switching process, the assistance owed, a maximum transitional period of 30 calendar days (Article 25(2)(a)) and a maximum notice period of two months (Article 25(2)(d)).
- 12 January 2027. No switching charges at all (Article 29(1)). Ordinary service fees remain; egress for parallel use may only pass on costs incurred (Article 34).
For infrastructure services (scalable and elastic computing resources limited to infrastructural elements), the source provider must take reasonable measures so that the customer reaches functional equivalence on the destination service (Article 30(1)). Other services must offer open interfaces free of charge (Article 30(2)).
In engineering terms, data is the easy half: open, documented, machine-readable exports. Functions are the hard half: managed queues, identity services and serverless runtimes rarely have an equivalent elsewhere. And observability is the blind spot: dashboards, alert rules, traces and retention live in the provider's tooling. An exit plan never rehearsed is a document, not a capability.
Remark (Luxembourg finance). Financial entities already owe exit strategies for ICT services supporting critical or important functions under DORA, Article 28(8) of Regulation (EU) 2022/2554. One project, two legal drivers.
Article 32: when a foreign authority asks for EU data
Providers must take measures against unlawful foreign governmental access to non-personal data held in the EU; residency alone does not settle it, key custody does.
Article 32(1) obliges providers of data processing services to take adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where it would conflict with Union or national law. A third-country decision is recognised or enforceable only on the basis of an international agreement such as a mutual legal assistance treaty (Article 32(2)). Absent such an agreement, the provider may comply only where the order is reasoned, proportionate and specific, and its reasoned objection can be reviewed by a competent court in that country (Article 32(3)). Article 28 adds that providers publish the jurisdiction their infrastructure is subject to.
| Layer | What decides it |
|---|---|
| L1 The parent company | Ownership reaches across borders; an EU subsidiary may still answer to a group decision |
| L2 The operating entity | Which legal person signs the contract, and under whose law it can be ordered to act |
| L3 The privileged staff | Compulsion reaches people, not data centres |
| L4 The infrastructure | Where the bytes rest: the layer everyone discusses, and the weakest guarantee |
| L5 The keys | If the provider can decrypt, it can be ordered to: custody, not location, is the control |
Four controls follow: key custody outside the provider's reach, a map of every entity and person that can be compelled, a documented refusal and escalation procedure, and a log of every request received and of the answer given. On 3 June 2026 the Commission proposed a Cloud and AI Development Act (COM(2026) 502), whose Article 16 would set up a Union cloud sovereignty framework; it is a proposal.
Where compliance breaks in production
Four things fail before lawyers are involved: identity, evidence, data quality and the line between personal and non-personal data.
- Identity. The right belongs to the user; systems know accounts, serial numbers and contracts, not people across resale and leasing.
- Evidence. What did you disclose, to whom, when, on which basis? Thirty-day log retention cannot answer.
- Quality. Internal telemetry tolerates gaps and drifting clocks; once it leaves the building, a gap becomes a dispute.
- The boundary. The Data Act covers personal and non-personal data (Article 1(2)) and is without prejudice to the GDPR, which prevails in case of conflict (Article 1(5)). A machine identifier plus a timestamp often identifies a person: classify per field, record the decision, re-examine it when the schema changes.
| Text | What it asks for | Where |
|---|---|---|
| GDPR, Regulation (EU) 2016/679 | Records of processing; breach notified within 72 hours where feasible | Art. 30, Art. 33 |
| NIS2, Directive (EU) 2022/2555 | Early warning within 24 hours, notification within 72 hours, final report within one month | Art. 23(4) |
| DORA, Regulation (EU) 2022/2554 | Register of ICT third-party arrangements; exit strategies; major incidents notified within 4 hours of classification and at the latest 24 hours from awareness | Art. 28(3), 28(8); Del. Reg. 2025/301, Art. 5 |
| AI Act, Regulation (EU) 2024/1689 | High-risk systems log events automatically; logs kept at least six months | Art. 12, 19(1), 26(6) |
The AI Act timeline moved in 2026: Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ 24 July 2026) applies the high-risk obligations to Annex III systems from 2 December 2027 and to Annex I products from 2 August 2028. The architect's conclusion of the lecture: under this regime, compliance is a telemetry problem. A regulator asks you to show what happened, and showing what happened is observability, designed for engineers rather than for evidence.
The Digital Omnibus: one of the two texts is proposed for repeal
The Commission proposed in November 2025 to repeal the DGA and fold it into the Data Act; on 17 October 2026 it is still a proposal.
The Digital Omnibus, COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)), would repeal the Data Governance Act, the Free Flow of Non-Personal Data Regulation (keeping its ban on data localisation requirements) and the Open Data Directive, and move intermediation and altruism into a new chapter of the Data Act with voluntary registration. Business-to-government access would be narrowed to public emergencies, and custom-made cloud services and smaller providers would get a lighter switching regime for contracts concluded before 12 September 2025.
State of play: the joint ITRE and LIBE draft report of the European Parliament is dated 22 June 2026 and amendments were tabled on 27 July 2026, without a committee vote; the Council has not adopted a negotiating mandate, which is on the Coreper agenda of 21 October 2026. The engineering lesson: build capabilities, not article numbers. Identify your data, move it, prove who touched it; those survive every rewrite.
In Luxembourg: who supervises what
The CNPD supervises personal data and DGA intermediaries; the ILR leads on NIS2 and, if bill 8809 passes, on the Data Act.
| Text | Luxembourg instrument | Authority |
|---|---|---|
| GDPR | Law of 1 August 2018 | CNPD |
| Data Governance Act | Law of 19 December 2025 (bill 8395A) | CNPD for intermediation and altruism; Commissariat du Gouvernement à la souveraineté des données for re-use |
| Data Act | Bill 8809, filed 28 July 2026, in committee | ILR as competent authority and data coordinator; CNPD for personal data; fines up to EUR 1 million |
| NIS2 | Law of 5 May 2026 | ILR; CSSF for banking and financial market infrastructures |
| AI Act | Bill 8476, in committee | CNPD as default market surveillance authority, with sectoral authorities |
Key takeaways
- Read every obligation as a specification: who builds it, who operates it, who proves it ran?
- The Data Act applies since 12 September 2025; access by design applies to products placed on the market after 12 September 2026.
- Cloud switching charges are capped at directly linked costs until 12 January 2027 and forbidden afterwards; the 30-day transition and two-month notice already apply.
- Against foreign access, key custody decides more than data residency.
- A mandated access path is attack surface from the day it exists: threat-model the rights, not only the system.
- Compliance under these texts is answered from logs, traces and records kept by design, years before the question is asked.
Glossary
- Data holder
- The party with the right or obligation to use and make available the data (Data Act, Article 2(13)); in practice, the system owner who must serve the request.
- Accessible by design
- The Article 3(1) obligation on connected products: a requirement at product definition, not a late feature.
- Functional equivalence
- Re-establishing a minimum level of functionality on the destination infrastructure service after switching (Article 2(37), Article 30(1)).
- Structural separation
- For data intermediation services, a separate legal person and no use of the data for other purposes (DGA, Article 12(a)): an isolation boundary to demonstrate.
- Switching charges
- Charges for the switching process itself, distinct from the price of the service; phased out on 12 January 2027 (Article 29).
- Data intermediation service
- A neutral go-between establishing commercial relationships between data holders and data users (DGA, Chapter III).
- Data altruism
- Voluntary sharing of data for objectives of general interest, such as research, by recognised organisations (DGA, Chapter IV).
Official sources
Every legal claim of the deck and of this page was checked against these pages on the revision day. Article numbers refer to the texts as published in the Official Journal.
- Regulation (EU) 2023/2854 (Data Act), OJ L, 22.12.2023. eur-lex.europa.eu/eli/reg/2023/2854/oj
- Regulation (EU) 2022/868 (Data Governance Act), OJ L 152, 3.6.2022. eur-lex.europa.eu/eli/reg/2022/868/oj
- Communication COM(2020) 66 final, A European strategy for data, 19.2.2020. eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020DC0066
- Proposal COM(2025) 837 (Digital Omnibus), procedure 2025/0360(COD), Legislative Observatory. oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)
- Regulation (EU) 2016/679 (GDPR). eur-lex.europa.eu/eli/reg/2016/679/oj
- Regulation (EU) 2024/1689 (AI Act). eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 24.7.2026. eur-lex.europa.eu/eli/reg/2026/1744/oj
- Directive (EU) 2022/2555 (NIS2). eur-lex.europa.eu/eli/dir/2022/2555/oj
- Regulation (EU) 2022/2554 (DORA). eur-lex.europa.eu/eli/reg/2022/2554/oj
- Commission Delegated Regulation (EU) 2025/301 (DORA incident reporting deadlines). eur-lex.europa.eu/eli/reg_del/2025/301/oj
- Regulation (EU) 2025/327 (European Health Data Space). eur-lex.europa.eu/eli/reg/2025/327/oj
- European Commission, Common European Data Spaces. digital-strategy.ec.europa.eu/en/policies/data-spaces
- European Commission, Data Act FAQs (6.9.2024). digital-strategy.ec.europa.eu/en/library/commission-publishes-frequently-asked-questions-about-data-act
- European Commission, draft model contractual terms and cloud standard contractual clauses (19.11.2025). digital-strategy.ec.europa.eu/en/library/draft-recommendation-non-binding-model-contractual-terms-data-access-and-use-and-non-binding
- European Commission, proposal for a Cloud and AI Development Act, COM(2026) 502. digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
- Chambre des Députés, bill 8809 (Data Act implementation in Luxembourg). www.chd.lu/fr/dossier/8809
- Chambre des Députés, bill 8476 (AI Act implementation in Luxembourg). www.chd.lu/fr/dossier/8476
- Legilux, law of 5 May 2026 on cybersecurity (NIS2), Mémorial A n° 225. legilux.public.lu/eli/etat/leg/loi/2026/05/05/a225/jo
- Legilux, law of 1 August 2018 on the organisation of the CNPD. legilux.public.lu/eli/etat/leg/loi/2018/08/01/a686/jo
About this page
Written by the lecturer from the slides of the deck, as a public summary. The deck itself is public too: every slide carries its source line and the speaker notes are readable under each slide.
Educational material, written in a personal capacity: not legal advice, and not the position of any employer. Before relying on an article, read it in the Official Journal; the state of play of the proposals is given as of 17 October 2026.
Revision: .