EU strategy for data, in production: slides (Data Act, DGA)

A right with no SDK

Since 12 September 2025, the user of a connected product in the EU can ask for the data that product generates.

Interface

Who builds it?

The regulation grants a right. It ships no API.

Identity

Who authenticates the asker?

Proving that a person owns a machine is not a solved problem.

Evidence

Who keeps the proof?

An obligation you cannot show you met is one you failed.

Expiry

Who revokes it?

Every grant needs an end date. Most designs forget it.

Data Act, Art. 4 and 5 · Art. 50 application date · eur-lex.europa.eu/eli/reg/2023/2854/oj

Where the data comes from

A Linky electricity smart meter just installed in a French home — A smart meter: consumption, every half hour.

The infotainment screen of a car showing an emergency vehicle alert received over the network — A connected car: position, speed, faults, alerts.

Wind turbines in a field in Ontario — A wind turbine: vibration, yield, maintenance.

Data Act: Art. 2(5) connected product · Art. 2(6) related service · Art. 4 user access

The argument of this hour

Every new right of access the EU creates is a new interface. Every new interface is a new attack surface.

So the Data Act is not only a legal text. Read closely, it is an architecture specification with a compliance deadline attached.

How to read these slides

What the text says

Obligations and rights, paraphrased from the regulation. Set in a serif, like a statute.

Providers shall take measures to prevent unlawful access.

What someone builds

The engineering reading: components, controls, evidence. Set in a sans, like a design document.

Key custody, refusal workflow, request log.

What you can cite

Articles, regulation numbers and dates, in ISO format so they sort. Check them yourself.

Art. 29(1) 2027-01-12

The engineering column is a practitioner's reading, not legal advice. When the two disagree, the text wins.

Your guest lecturer

Sitraka Forler

A practitioner who reads regulations from the engine room.

Data and AI practitioner in Luxembourg: data platforms, machine learning, systems architecture
Lecturer at IAE Metz and at Centrale Méditerranée (Centrale Marseille)
Columnist, AGEFI Luxembourg

Presented in a personal capacity. Nothing here represents the position of any employer, and none of it is legal advice.

In my own name

I speak in my own name only, not on behalf of my employer.

These slides are my reading as a practitioner. They are not legal advice, and they commit no organisation I work with.

Picking up from the 14:15 presentation

The group presentation at 14:15 walked through the texts: what they say, who they bind, when they apply.

Their question was the law. This hour is about what the law makes somebody build.

The Kirchberg plateau in Luxembourg City seen from Pfaffenthal, with the towers of the European institutions above the trees — The Kirchberg plateau, seen from Pfaffenthal: the European institutions, and today's campus.

This afternoon

Time	Part	Length
15:30	Why an engineer is reading two regulations	7 min
15:37	The two instruments, in engineering terms	15 min
15:52	Three obligations turned into architecture	22 min
16:14	Where it breaks in production	16 min
16:30	Your questions, including the ones I cannot answer	30 min

Interrupt at any point. A question asked when it occurs to you is worth three asked at the end.

The two instruments, in engineering terms

By the end of this part you should be able to say what each text makes somebody build.

Two texts, two different jobs

	Data Governance Act 2022/868	Data Act 2023/2854
In force	2022-06-23	2024-01-11
Applies	2023-09-24	2025-09-12
Posture	Enabling: creates roles and a trust framework	Prescriptive: creates rights and hard obligations
Real question	Who may act as a trusted go-between?	Who may read, move and port machine data?
Status	Proposed for repeal	Applies Amendment proposed
Luxembourg	Law of 19 December 2025: CNPD supervises intermediation and altruism	Bill 8809, pending: ILR leads, CNPD for personal data

DGA Art. 38 · Data Act Art. 50 · repeal proposed in COM(2025) 837 · eur-lex.europa.eu

The row that matters is posture. The Data Governance Act is permissive: it offers a status (data intermediation service, data altruism organisation) with conditions, and almost nobody was forced to do anything. That is why, as engineering work, it changed little in most organisations.

The Data Act is the opposite. It tells manufacturers, cloud providers and data holders what they must now make possible, whether they want to or not. That is why it has a budget line.

In Luxembourg, the Data Governance Act is implemented by the law of 19 December 2025 (bill 8395A): it creates the Commissariat du Gouvernement à la souveraineté des données for the re-use of protected public data, and makes the CNPD the authority for data intermediation services and the register of data altruism organisations. The Data Act implementing law is bill no. 8809, filed on 28 July 2026 and still in committee: it designates the Institut Luxembourgeois de Régulation (ILR) as competent authority and data coordinator, the Commissariat for Chapter V, the CNPD for personal data, and sets fines in tiers up to one million euros. Source: Chambre des Députés, dossiers 8395A and 8809.

Dates: the Data Governance Act entered into force on 23 June 2022 and applies from 24 September 2023 (Article 38). The Data Act entered into force on 11 January 2024 and applies from 12 September 2025 (Article 50).

The text, and the explanation of the text

The EUR-Lex page of Regulation (EU) 2023/2854, the Data Act, showing its ELI and the authentic Official Journal versions — EUR-Lex: Regulation (EU) 2023/2854, OJ L of 22.12.2023, its ELI and the authentic PDF in 24 languages.

The European Commission's Data Act page with links to the FAQ, the helpdesk and the Data Act explained — The Commission's Data Act page: FAQ, helpdesk, explainers. Useful, and not binding.

Cite the regulation by its ELI: eur-lex.europa.eu/eli/reg/2023/2854/oj · Commission FAQ of 2024-09-06

The Data Governance Act creates three roles

Re-use of protected public data Ch. II

Public bodies may open data that is confidential, commercially sensitive or personal, under conditions.

You build

Secure processing environments, anonymisation pipelines, an access workflow with an audit trail.

Data intermediation Ch. III

A notified, supervised status for neutral go-betweens matching data holders and users.

You build

Structural separation: the broker may not use the data it brokers. An isolation boundary you must prove.

Data altruism Ch. IV

A register for organisations collecting data donated for objectives of general interest, such as research.

You build

Granular, revocable consent, and a record of the purpose each record was donated for.

DGA Art. 3 to 9 · Art. 10 to 15 (Art. 12 conditions) · Art. 16 to 25 · Art. 31

Every legal role has an engineering consequence. Structural separation is the interesting one for a security audience: it is not a policy you write, it is an isolation boundary you have to demonstrate. Article 12 requires the intermediation service to be provided through a separate legal person, and the provider may not use the data for other purposes. In practice: separate credentials, separate stores, separate staff, and an auditor who will ask you to show that an engineer on the brokerage side cannot read the brokered payloads. That is a threat model, not a privacy notice.

Uptake of the intermediation status has been low across the EU, which is one of the reasons the Commission proposed to fold this text into the Data Act (two slides on).

Article 31 of the Data Governance Act already contains safeguards against unlawful access by third-country authorities to non-personal data. You will meet the same logic in Article 32 of the Data Act.

The Data Act, read as a backlog

Where	What it grants	What somebody builds
Ch. II	Users access the data their connected product generates, and share it with a third party	An authenticated access interface, by design, documented before sale
Ch. III	Fair, reasonable and non-discriminatory terms for making data available	Metering, pricing logic, trade secret protection around the payload
Ch. V	Public bodies may request private data in exceptional need	An escalation path, a legal gate, extraction that does not hand over everything
Ch. VI	Customers may leave a cloud provider with their data and functions	Export formats, functional equivalence, a tested exit runbook
Art. 32	Safeguards against unlawful third-country access to non-personal data	Key custody, jurisdiction mapping, a documented refusal procedure
Ch. VIII	Interoperability of data spaces; rules for smart contracts	Published schemas, and a way to stop automated execution

Three rows deserve attention. Chapter II: "by design, documented before sale" is the expensive phrase. The obligation lands at product definition, not at a compliance review two weeks before launch. Under Article 3(1), it applies to connected products and related services placed on the market after 12 September 2026 (Article 50).

Chapter VI, switching: this is the row with a date on it, twelve weeks from today (case one). Article 32: the sovereignty row, and the only one that can put an engineer in a genuine conflict of laws (case two).

The right-hand column is an engineering reading of the text, not the text. Unfair contractual terms (Chapter IV) are left out of the table: little engineering, large commercial impact. Smart contracts for executing data sharing agreements must, among other things, allow safe termination or interruption (Article 36).

One of the two texts is proposed for repeal

Date	Step	What happened
2025-11-19	Commission proposal	The Digital Omnibus, COM(2025) 837, would repeal the DGA and move intermediation and altruism into the Data Act.
2026-06-22	Parliament draft report	Joint ITRE and LIBE committees; amendments tabled in July. No committee vote yet.
2026-10-20	Today	A proposal, not law. The DGA and the Data Act both apply as published.
2026-10-21	Council mandate	On the Coreper agenda for tomorrow. No mandate adopted so far, no trilogue.

Build capabilities, not article numbers.

Check the procedure file before citing a status: oeil.secure.europarl.europa.eu · 2025/0360(COD)

The syllabus says Data Governance Act 2022 and Data Act 2024, and that is correct today. But the Commission's Digital Omnibus proposal of 19 November 2025, COM(2025) 837, would repeal the Data Governance Act (together with the Free Flow of Non-Personal Data Regulation, keeping its ban on data localisation requirements, and the Open Data Directive) and move intermediation and altruism into a new chapter of the Data Act, with voluntary registration. Business-to-government access in Chapter V would be narrowed to public emergencies, and custom-made cloud services and smaller providers would get a lighter switching regime for contracts concluded before 12 September 2025.

State of play on 17 October 2026, from the Legislative Observatory and the Council register: the joint ITRE and LIBE draft report is dated 22 June 2026, amendments were tabled on 27 July, and the committees have not voted. In the Council, no negotiating mandate has been adopted; the Coreper agenda of 21 October 2026 lists the mandate for negotiations. It is a proposal, not law.

The engineering conclusion: a compliance architecture that hard-codes one text is technical debt with a legal name on it. What survives a rewrite is the capability: can you identify your data, can you move it, can you prove who touched it.

Check the procedure file, not the press

The Legislative Observatory page of procedure 2025/0360(COD), Digital Omnibus, with the status Awaiting committee decision and the list of acts it would repeal or amend — Status: awaiting committee decision. Below the title, every act the proposal would repeal or amend.

One proposal, many texts: it would repeal Regulation 2022/868 and amend the GDPR, NIS2, DORA and the Data Act.

A status in a slide ages in a week. The procedure file is the source.

Three obligations turned into architecture

Cloud switching. Foreign government access. Access to product data.

Case 01: the exit

The LuxConnect data centre at Bissen, Luxembourg, a long low building in a field — A data centre at Bissen, Luxembourg (LuxConnect): where a workload physically runs.

Server racks with network cabling in a data centre — Racks and cables: the easy half of an exit is moving bytes; the hard half is everything wired around them.

Leaving your cloud provider should cost nothing

2027
01-1284 days from today

From this date, providers of data processing services may not impose switching charges on a customer who leaves.

Art. 29(1) · paraphrase

Until then, charges are capped at the provider's costs directly linked to the switching.

Art. 29(2) and (3)

The switching clock

Transition

30 days

maximum transitional period in the contract Art. 25(2)(a)

Notice

2 months

maximum notice period for the customer Art. 25(2)(d)

Parallel use

at cost

egress charges may only pass on costs incurred Art. 34

In parallelFinancial entities already owe exit strategies under DORA Art. 28(8). Same engineering, two legal drivers.

The timeline reads left to right. The third mark is today: eighty-four days between this lecture and 12 January 2027. Since 12 September 2025, the contract must describe the switching process, the assistance owed, and a maximum transitional period of 30 calendar days, with a notice period of at most two months for the customer (Article 25).

In Luxembourg the last line matters most. Banks, fund administrators and other financial entities are also under DORA (Regulation (EU) 2022/2554), which requires exit strategies for ICT services supporting critical or important functions (Article 28(8)). In practice you will meet one project with two regulators behind it.

A contested question worth arguing about: who benefits most from free switching? Customers, obviously. But also the largest providers, who can afford to absorb the cost of winning somebody else's customer. Regulation does not always move power where it intended.

What "reversible" costs

Data is the easy half

Open, documented, machine-readable exports. Not a proprietary dump that only the vendor can restore.

Functions are the hard half

Managed queues, identity services and serverless runtimes rarely have an equivalent elsewhere.

The runbook must be tested

An exit plan never executed is a document, not a capability. Rehearse it yearly on one workload.

Observability is the blind spot

Dashboards, alert rules, traces and retention live in the provider's tooling. You arrive blind.

If the contract ended in ninety days, what could we not rebuild?

Data Act Art. 30 functional equivalence (infrastructure services) and open interfaces

Case 02: the order from abroad

An nCipher nShield F3 hardware security module, a PCI card — A hardware security module (nCipher nShield F3): the keys live here, not in the application.

A court in a third country orders a provider to hand over non-personal data stored in the EU.

Whether the provider can comply depends less on where the data sits than on who holds the keys.

When a foreign authority asks for EU data

The text Art. 32

Providers must take technical, organisational and legal measures to prevent transfer of, or governmental access to, non-personal data held in the Union where it would conflict with EU or national law.

A foreign order is enforceable only on the basis of an international agreement, or after a reasoned, proportionate and reviewable process.

The system 4 controls

Key custody outside the provider's reach
A map of every entity and person that can be compelled
A documented refusal and escalation procedure
A log of every request received, and of the answer

Where are your keys, and who can be compelled to hand them over?

Article 32(1) obliges providers of data processing services to take adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where it would conflict with Union or national law.

Article 32(2) and (3): a decision of a third-country court or authority requiring such a transfer or access is recognised or enforceable only if based on an international agreement, such as a mutual legal assistance treaty. Without one, the provider may comply only where the third-country system requires the decision to be reasoned and proportionate, the order to be specific, and the provider's reasoned objection to be reviewable by a competent court there.

Article 28 adds a transparency duty: providers must publish on their website the jurisdiction to which their infrastructure is subject, and a general description of their measures against unlawful governmental access. That is where the questions about keys start.

The engineering reading is on the right. Encryption alone does not settle the question: if the provider holds the key, the provider can be ordered to use it. That is why the next slide looks at control, not location.

Sovereignty is a chain of control, not a map

	Layer	What decides it
L1	The parent company	Ownership reaches across borders. An EU subsidiary may still answer to a group decision.
L2	The operating entity	Which legal person signs the contract, and under whose law it can be ordered to act.
L3	The privileged staff	Administrators have passports and employers. Compulsion reaches people, not data centres.
L4	The infrastructure	Where the bytes rest. The layer everyone discusses, and the weakest guarantee of the five.
L5	The keys	If the provider can decrypt, it can be ordered to. Custody, not location, is the control.

A reading aid, not legal advice. A real assessment needs the contract, the group structure and counsel in both jurisdictions.

Case 03: the tractor's data

A red tractor pulling a harrow across a field — A tractor at work: engine hours, positions, yields, all logged by the machine.

The farmer wants her machine's data sent to an independent agronomist.

The manufacturer must make it possible, securely, for a recipient it did not choose.

The EU has mandated a feature

The text Art. 3 to 5

Connected products must be designed so that the data they generate is accessible to the user, easily, securely and, where relevant and technically feasible, directly.

On request, the data holder makes it available to the user, or to a third party the user names.

The system 4 components

An authenticated read path into telemetry that used to be internal
A delegation flow to recipients you did not choose
Field-level filtering for trade secrets
Rate limits on a public, mandated endpoint

Access by design applies to products placed on the market after 2026-09-12 Art. 3(1) Art. 50.

Article 3(1) requires connected products and related services to be designed and manufactured so that product data and related service data are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user. It applies to products placed on the market after 12 September 2026. Articles 4 and 5 add the right to obtain the data from the data holder and to have it shared with a third party.

In security terms, the EU has mandated a feature, and mandated features ship on deadlines. Millions of industrial devices are acquiring a documented way to be queried by someone other than their manufacturer. The next slide maps each component to an attack you already know.

The new right, and the old attack

The text creates	The system gets	The failure you already know
A user right to product data	An authenticated read path into internal telemetry	Broken object-level authorisation: ask for record 1042, get 1041
Sharing with a third party	A delegation flow with tokens and an unvetted recipient	Consent phishing: the OAuth grant to a hostile app
Proof that the user is the user	A binding between a person and a resold, shared device	Social engineering of the request, as seen under the GDPR
Protection of trade secrets	Filtering between what is owed and what is confidential	Over-disclosure: an export never reviewed field by field
Availability of access	A public endpoint on an industrial fleet	Denial of service on a system with no spare capacity

Where it breaks in production

Not the law. The implementation.

Four things that fail before lawyers are involved

01 · Identity

The right belongs to the user. Systems know accounts, serial numbers and contracts, not people across resale and leasing.

02 · Evidence

What did you disclose, to whom, when, on which basis? Thirty-day log retention cannot answer.

03 · Quality

Internal telemetry tolerates gaps and drifting clocks. Once it leaves the building, a gap becomes a dispute.

04 · The boundary

These texts mostly govern non-personal data; the GDPR, personal data. A machine ID plus a timestamp often identifies a person.

The fourth failure is the intellectually serious one, and it links back to the whole course. A vibration reading from an industrial motor is non-personal data. The same reading, with a machine identifier and a timestamp, in a workshop where one named technician operates that machine, reveals when that person arrived, left and took a break. Nobody designed it as personal data; it became personal data because it was joined.

There is no clean technical boundary, and the Data Act says so itself: it is without prejudice to the GDPR, which prevails in case of conflict (Article 1(5)). The engineering answer is not to classify a stream once, but to classify per field, record the decision, and re-examine it whenever the schema changes.

The second failure, evidence, leads to the claim on the next slide.

When machine data becomes personal data

Industrial robot arms welding car bodies on a Ford assembly line in Cologne — Robots on an assembly line (Ford, Cologne). Each one logs its cycles, stops and faults.

A vibration reading is non-personal data.

The same reading, with a machine ID and a timestamp, on a line run by one named technician, tells you when that person arrived, paused and left.

Classify per field, record the decision, re-examine it when the schema changes.

Data Act Art. 1(2) personal and non-personal data · Art. 1(5) the GDPR prevails

The adjacent regimes ask the same question

Text	What it asks the platform for	Cite
GDPR 2016/679	Records of processing; breach notified to the authority within 72 hours where feasible	Art. 30 Art. 33
NIS2 2022/2555	Early warning within 24 hours, notification within 72 hours, final report within a month	Art. 23(4)
DORA 2022/2554	Register of ICT third-party arrangements; exit strategies	Art. 28(3) Art. 28(8)
AI Act 2024/1689	High-risk systems log events automatically over their lifetime	Art. 12

Different triggers, different authorities, one shared need: an audit trail somebody designed before the question was asked.

The Data Act does not live alone on a platform. In the same organisation, the GDPR asks for records of processing (Article 30) and a breach notification to the supervisory authority without undue delay and, where feasible, within 72 hours (Article 33). NIS2 asks essential and important entities for an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month (Article 23(4)).

For the AI Act, note that the timeline moved: Regulation (EU) 2026/1744, the Digital Omnibus on AI, published on 24 July 2026, applies the high-risk obligations to Annex III systems from 2 December 2027 and to Annex I products from 2 August 2028. Logging (Article 12) and log retention of at least six months (Articles 19 and 26(6)) are unchanged in substance.

DORA asks financial entities to keep a register of information on all contractual arrangements with ICT third-party service providers (Article 28(3)) and to have exit strategies (Article 28(8)). The AI Act asks high-risk AI systems to technically allow the automatic recording of events over their lifetime (Article 12).

Each regime has its own trigger and its own authority; I am not merging them. The point is architectural: they all end up asking the same logs.

The architect's conclusion

Under this regime, compliance is a telemetry problem.

A regulator does not ask whether you intended to comply. It asks you to show what happened. Showing what happened is observability, and observability was designed for engineers, not for evidence.

A production checklist

InventoryWhich product and service data exist, field by field, personal or not
Access pathAuthenticated, rate-limited, documented before sale
DelegationScoped, expiring, revocable grants to third parties

ExitOpen export formats, a rehearsed runbook, telemetry included
KeysWho holds them, who can be compelled, where requests are logged
EvidenceRetention long enough to answer the slowest regulator

Four common misreadings

Heard in the hallway	What the text says
"The Data Act is about personal data."	It covers personal and non-personal data, and leaves the GDPR untouched for personal data. Art. 1(2), 1(5)
"Free switching starts in 2027, nothing to do now."	Contract terms and the switching process apply since 2025-09-12; only the charges run until 2027. Art. 25, 29
"Data residency solves foreign access."	The text speaks of measures against access, not of location. Art. 32(1)
"The Omnibus already changed it."	A proposal is not law. 2025/0360(COD)

Three things to take out of this room

Read the obligation as a specification.For every article: who builds it, who operates it, who proves it ran?
Build capabilities, not article numbers.Identify your data, move it, prove who touched it. Those survive every rewrite.
Threat-model the rights, not only the system.A mandated access path is attack surface from the day it exists.

Your questions

Including the ones nobody can answer yet.

Law to engineering, a short glossary

The text says	An engineer hears	Where
Data holder	The party that controls the data and must serve the request	Data Act Art. 2(13)
Accessible by design	A requirement at product definition, not a late feature	Data Act Art. 3(1)
Functional equivalence	Same outcome on the target platform, after migration	Data Act Art. 30(1)
Structural separation	An isolation boundary you can demonstrate to an auditor	DGA Art. 12
Adequate measures	Controls, plus the evidence that they ran	Data Act Art. 32(1)

Four questions worth arguing about

01 If free switching mainly benefits providers large enough to absorb migration costs, has the EU increased competition or concentrated it?

02 Can any safeguard against foreign government access survive the fact that compulsion reaches people, not machines?

03 Does opening industrial data to users create more security risk than economic value? How would you measure either side?

04 If a regime is rewritten before it is fully implemented, is that regulatory agility or regulatory failure?

In Luxembourg: who supervises what

Text	Luxembourg	Authority
GDPR	Law of 1 August 2018	CNPD
DGA	Law of 19 December 2025	CNPD for intermediation and altruism
Data Act	Bill 8809, in committee	ILR; CNPD for personal data
NIS2	Law of 5 May 2026	ILR; CSSF for banking
AI Act	Bill 8476, in committee	CNPD by default

The Chambre des Députés page of bill 8809, implementing the Data Act, status en commission, filed on 28 July 2026 — Bill 8809 at the Chambre des Députés: filed on 28 July 2026, still in committee.

Luxembourg in one table. The CNPD supervises personal data under the law of 1 August 2018, and, since the law of 19 December 2025 implementing the Data Governance Act, data intermediation services and the register of data altruism organisations; the same law creates the Commissariat du Gouvernement à la souveraineté des données for the re-use of protected public data.

The Data Act implementing law is still a bill, no. 8809, filed on 28 July 2026: it would make the Institut Luxembourgeois de Régulation the competent authority and data coordinator, with the CNPD for personal data and fines in tiers up to one million euros. NIS2 is transposed by the law of 5 May 2026, with the ILR as main authority and the CSSF for banking and financial market infrastructures. The AI Act bill, no. 8476, would make the CNPD the default market surveillance authority. Sources: Chambre des Députés and Legilux.

Where to read this properly

Source	Reference
Data Governance Act	Regulation (EU) 2022/868, OJ L 152, 3.6.2022
Data Act	Regulation (EU) 2023/2854, OJ L, 22.12.2023
Digital Omnibus	COM(2025) 837, procedure 2025/0360(COD)
Adjacent regimes	GDPR 2016/679 DORA 2022/2554 NIS2 2022/2555 AI Act 2024/1689
Cloud	Draft model terms and cloud clauses, 19.11.2025 · Cloud and AI Development Act, COM(2026) 502
Luxembourg	Law of 19.12.2025 (DGA) · bill 8809 (Data Act) · law of 5.5.2026 (NIS2) · chd.lu, legilux.public.lu

Bound volumes of the Official Journal of the European Union on a library shelf — The Official Journal, bound: the only authentic text, now online.

Presented in a personal capacity. Nothing here represents the position of any employer, and none of it is legal advice. Slides, notes and summary: sitraka.lu/teaching/eu-data-strategy/

Thank you.

Thank you to Roger Tafotie for the invitation, and to this class for an hour of attention.

Sitraka FORLER · lecturer, IAE Metz and Centrale Méditerranée · columnist, AGEFI Luxembourg

Educational material, not legal advice.

University
of Luxembourg