Compliance tools · Cybersecurity and data protection

Data Act compliance tool

Regulation (EU) 2023/2854 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Data Act documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Data Act is Regulation (EU) 2023/2854, a binding instrument in the European Union. Data access and sharing obligations for connected products and related services, lifted from microenterprises and small enterprises.

The free assessment screens for Data Act when a business makes or supplies products or services with digital elements. The connected product duties in Chapter II are lifted from micro and small enterprises.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Data Act: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Data Act applies to your business, free →

Does Data Act apply to my business?

The Data Act applies to you if you design or manufacture connected products that collect and communicate data, provide related services, hold data, receive data, or provide data processing services in the EU. It also covers users of connected products, data space participants and smart contract vendors. The trigger is the activity, not the size of your business.

Who does Data Act apply to?

It applies to manufacturers and designers of connected products, providers of related services, data holders (Article 2(13)), data recipients (Article 2(14)), users (Article 2(5) context, Recital 18), providers of data processing services (Article 2(8)), data space participants, smart contract vendors (Recital 104, Article 36) and legal representatives of non-EU entities (Article 37(11)).

Does Data Act apply to a small business?

Yes, with an exemption for the smallest businesses. Microenterprises and small enterprises acting as manufacturers or designers of connected products or providers of related services are exempt from Chapter II design obligations, unless they have partner or linked enterprises that do not themselves qualify as micro or small (Article 7(1)). Medium-sized enterprises that qualified for less than one year get a one-year transitional period (Article 7(1), Recital 41).

When does Data Act apply from, and what are the deadlines?

The Regulation entered into force on 11 January 2024 and applies from 12 September 2025 (Article 50). The Article 3(1) design obligation applies to products placed on the market after 12 September 2026, switching charges are abolished from 12 January 2027 (Article 29(1)), and Chapter IV applies to certain older contracts from 12 September 2027 (Article 50).

What does Data Act require me to do?

You must design connected products so product data is accessible by default (Article 3(1)), give pre-contractual information (Articles 3(2), 3(3)), give users access to data (Article 4(1)), make data available to third parties at user request (Article 5(1)), share on fair, reasonable and non-discriminatory terms (Article 8(1)), and meet cloud switching duties (Article 23).

What records or documents does Data Act require me to keep or produce?

You must identify data protected as trade secrets before any disclosure (Articles 4(6), 5(9)), keep a reasonable data retention policy in line with storage limitation (Recital 24), provide a permission management interface (Article 4(5)), and issue an EU declaration of conformity for smart contracts (Articles 36(2), 36(3)).

What happens if I do not comply with Data Act?

Supervisory authorities under Regulation (EU) 2016/679 may impose administrative fines up to the Article 83(5) GDPR amount, being EUR 20,000,000 or 4 per cent of total worldwide annual turnover, whichever is higher, for infringements of Chapters II, III and V. Member States also lay down national penalties that are effective, proportionate and dissuasive (Article 40(1)).

Does Data Act apply to a UK business selling into the EU?

The Regulation applies throughout the European Union to connected products placed on the EU market and related services provided to users in the Union (Article 1). A UK business selling into the EU is caught by that territorial scope. The instrument does not state any separate rule for UK sellers.

Does Data Act apply to an EU business selling into the UK?

An EU business selling into the UK is not covered by the territorial scope stated, which is connected products placed on the EU market and related services provided to users in the Union (Article 1). The instrument does not state any reach into the UK market.

How do I start complying with Data Act?

The first practical step is to classify your enterprise size under Recommendation 2003/361/EC, taking account of partner and linked enterprises, because that classification decides whether Chapter II design obligations apply (Article 7(1)), whether compensation is capped at direct costs (Article 9(4)) and whether data must go to public sector bodies outside emergencies (Article 15(2)).

Which ComplianceSME account includes the Data Act toolkit?

The Data Act agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive