With businesses, individuals, and government policy makers aligned by direct financial interests to see the Data Act enforced, the impact on manufacturers is likely to be faster and stronger than the industry currently comprehends.
Facing the Data Act and Data-driven Incentives
Most device manufacturers believe their products are compliant — until a regulator asks for their API logs. Many are waiting for that moment, believing it marks the turning point that breaks down the boundary between hardware and software compliance. Yet it changes nothing. Those changes are already codified in national laws, and the wait only exposes how unprepared the industry and its leaders are. Again.
The EU Data Act, enforceable in January 2026, redefines what compliance means for manufacturers. For the first time, regulators won’t focus on policy documents or privacy statements as evidence. They’ll inspect systems and capability directly. They’ll test APIs. They’ll verify data export functions. They’ll check whether third-party services can actually operate with the data you deliver.
The stakes are real. Penalties range from 4-10% of annual turnover, depending on jurisdiction — Finland and Germany up to 4%, France 5%, the Netherlands 10%. Enforcement applies wherever your devices operate; headquarters location doesn’t matter as 27+ member state authorities enforce the regulation through national laws.
But fines aren't the only risk. Reputational and brand damage, audit delays, and development resources tied up in rework aggravate costs. Yet the true risk is decreased competitiveness relative to strategies that build data ecosystems and competitive advantage by incentivizing 3rd party services. The penalties are an immediate threat, but competitive gap compounds to threaten the future.
The math is unforgiving. A bare minimum implementation might take 4-8 weeks, but it won't satisfy real user needs. Data Act compliance isn't just about technical capability; the regulation focuses on users' holistic ability to access and use their data, e.g., processes and communication channels. Proper compliance requires two weeks for diagnostic assessment plus 10-18 weeks for implementation and validation, totaling 12-20 weeks. No matter which strategy is chosen, the window for proper preparation closes in Q4 2025.And enforcement won't wait for scheduled audits. As AI and digitalizing economies drive up the value of data, both business and individual users will have incentive to leverage their data access rights. When manufacturers cannot fulfill those requests, users will have direct financial interest to appeal to national authorities. This will inevitably draw the attention of authorities, who will view the proper enforcement of the act as foundational to secure the data generating layer that empowers AI-driven growth. With businesses, individuals, and government policy makers aligned on their interests, the January 2026 enforcement is likely to be faster and stronger than most manufacturers currently comprehend.The regulatory shift is real. The timeline compressed. The Architecture Gap is solvable with sufficient clarity — if you act now.
Understanding Your Position in the Data Act
The Data Act connects users (both businesses and individuals), manufacturers, devices, and third-party services in a network of obligations regulators will audit.
Figure 1. Each connection point must demonstrate compliance through verifiable system behavior, not documentation .
Every relationship demands evidence that your systems perform as required: APIs that deliver data when asked, exports in machine-readable formats, standardized interfaces for third-party access, and logs that prove each obligation was enforced. And these requirements will evolve from now into the 2030s as the 2020 European strategy for data transitions to the forthcoming European Data Union Strategy .
But what qualifies as that evidence? The Data Act grants user rights without technical specifications. Article 4 says ‘users must be able to allow 3rd parties to access the data’, but doesn't define authentication requirements, response timeframes, or logging standards. Article 5 requires ‘machine-readable formats’, but doesn't specify which formats, whether relational structures must be preserved, or how completeness gets validated. Legal teams can read the obligations. Engineering teams can build systems. But the translation layer between regulatory language and technical implementation doesn't exist in the regulation itself.
The Architecture Gap: Why Organizations Can’t Produce Evidence
Here’s how most companies divide responsibility for compliance:
Legal teams interpret regulations. They understand intent and penalties but can’t design APIs or data flows. When legal writes “data shall be made available within a reasonable timeframe,” they’ve documented a requirement but haven’t told engineering what to build.
Engineering teams build systems to product requirements, not laws. They understand architectures and APIs. When they receive a requirement like ‘users must be able to allow 3rd parties to access the data’, they build something — but their assumptions about authentication, logging, and evidence come from product patterns, not regulatory interpretation.
Compliance teams document everything from legal obligations to technical implementations and policy matrices. What they can’t do is verify that the implementation actually satisfies the obligation. They can show that Legal approved a policy and engineering built an API; they can’t provide technical proof that users can authorize third-party access to their data at a level of effort that satisfies the soft definitions of the regulation.
When regulators ask for technical proof, no single department can deliver it. Legal has interpretation, engineering has capability, compliance has documentation. The translation layer between them doesn't exist.
This breakdown stems from what we call the translation problem. Legal says “data must be portable in machine-readable formats.” Engineering asks which formats qualify, how many they must support, and what “portable” really means — flat files or relational structures? Legal can’t answer; those choices are technical. Engineering creates a JSON export, and Compliance records it as meeting Article 5, but has no way to validate this interpretation. The Data Act entered into force in September 2025 and enforcement begins in January 2026, but the harmonized standards that would provide presumption of conformity won't be published until 2027-2028, leaving organizations to navigate a critical uncertainty period without official technical guidance . In the meantime, does the current implementation include every relevant data category? Data generated by legacy products in the same product line? Should it? Compliance can’t tell. Each handoff erodes shared understanding and that loss of translation is what ultimately breaks compliance.
Importantly, this breakdown doesn’t just create audit risk, it multiplies costs and breaks budgets. Industry analysis of GDPR implementation from 2018-2020 showed this pattern: Sequential handoffs (legal analyzes, IT designs, engineering implements) commonly produced cost overruns of 3-5× initial estimates . The high volume of enforcement (over 6,680 fines totaling €4.2 billion by 2024) confirms the high cost of reactive non-compliance and with the Data Act the industry is largely unprepared to face the situation. Again. Here's what that looks like:
A manufacturer budgets €200,000 for internally implementing Data Act compliance. Implementation begins. Then the gaps appear:
- Export functions don't include legacy product and system data → €45 000 to re-architect
- Access logging insufficient for audit evidence → €30 000 to rebuild
- Authentication incompatible with third-party OAuth → €50 000 for identity federation
- Emergency fixes near deadline → €65 000
Total: €400 000-€600 000.
The original estimate wasn't wrong, the internal execution broke down due to the translation problem.
Budgets are a result of compliance complexity, but overruns come from handoffs. Every translation gap triggers rework, and rework compounds.
This disconnect between planned and realized budgets can be addressed through diagnostic assessment that uses GDPR precedent data to identify translation problems; the outcome of which is strategic analysis, technical roadmaps, and compliance evidence to overcome the Architecture Gap.
Three Approaches to Compliance Strategy
Connected product manufacturers are faced with a decision between three approaches to compliance with the Data Act in Q4 2025. Each approach comes with different cost profiles and long-term implications:
Option 1 – Minimum Compliance
Build only what’s needed for 2026 enforcement. You’ll meet the law but face retrofit costs as certification rules arrive between 2027 and 2030.
Implementation investment €180 000 – €240 000. Lifetime cost through 2028 ≈ €600 000 – €820 000 (including retrofits).
Option 2 – Certification-Ready Architecture
Design for 2026 compliance and future certification by focusing on policy-driven controls. Authentication schemes, logging formats, and export schemas defined as configuration rather than code, informed by previous CEN, CENELEC, and ETSI specifications. When new standards and specifications are published, you adjust policies instead of rewriting systems.
Implementation investment €320 000 – €450 000. Lifetime cost €400 000 – €570 000 (around 30 – 40 percent lower than minimal compliance due to avoided retrofits).
Option 3 – Strategic Investment
Treat the same data-sharing infrastructure the Data Act requires as a foundation for third-party services that produce competitive advantage by helping your users get the most out of your products. Compliance is made secondary to a strategy for manufacturers whose products act as the data generating foundation of a data- and AI-driven economy.
Implementation investment €450 000 – €600 000. Revenue upside emerges through product differentiation with 3rd party services in 3-5 years.
After January 2026 you’re locked into whatever architecture exists. Minimum compliance requires unwinding what’s already built later, at added cost as CEN, CENELEC, and ETSI deliver standards and technical specifications in the coming years.
The decision isn’t whether to comply — non-compliance has been purposefully made unsustainable . It’s whether to treat compliance as a short-term obligation or a strategic investment. This decision requires a foundation of understanding that goes beyond the traditional legal, technical, and compliance team boundaries, yet one that is simultaneously tailored to your product lifecycle and market positioning
The Integrated Diagnostic Approach
Strategic decisions require clear diagnosis. You can’t choose between approaches or select vendors without knowing which Data Act obligations apply to your devices, what your architecture can support, and where gaps exist across legal, governance, and technical layers.
Internal teams can’t cover all angles. Legal knows rules but not systems. Engineering knows systems but not law. Compliance tracks processes but can’t bridge them. Integrated diagnostics bring those disciplines together. When evaluating Article 4, regulatory and architecture experts work side by side, so authentication and logging questions get resolved in design, not during implementation. That eliminates the handoffs, endless training seminars, and rework that create the 3-5x overruns that GDPR became infamous for.
Specifications produced this way are implementation-ready from day one. They fit existing architectural constraints and remove ambiguity before code is written. Budgets stay predictable; projects finish on schedule. At fixed-price and with full execution flexibility.
Traditional consulting charges hourly, incentivising scope creep and over-cautious interpretation of regulation, causing the exact budget risk which the diagnostics need to solve. Our fixed-price diagnostic assessment (€25 000 – €30 000 depending on complexity) is different: We succeed by delivering the enablers you need to decide on your compliance approach, achieve implementation readiness, and eliminate 3-5× overrun risk in two weeks.
After diagnostic completion, you choose the next step: continue with our team for implementation, hand the roadmap to your preferred integrators or Big Four partners, or execute internally with your own teams. No lock-in. No long-term contracts. You get clarity, control, and necessary foundation to meet the fast approaching January 2026 enforcement.
Does the Architecture Gap Exist in Your Organization?
Five questions reveal the existence of an Architecture Gap:
- Can your legal team specify technical requirements without ambiguity?
- Can your engineers interpret what regulators mean by users' right to authorize third-party data access within a reasonable time-frame?
- Can compliance validate that implementations generate acceptable evidence?
- Do your logs map to Data Act articles or only to debugging?
- Have you tested portability with third-party consumption rather than internal use only?
If any answer is "no" or "uncertain," the Architecture Gap exists. An integrated diagnostic assessment can provide the enablers necessary to fix it.
Decision Window for 2026 Enforcement
The correct time to act was yesterday, the next best is today. With businesses, individuals, and government policy makers aligned on their interests, the enforcement is likely to be faster and stronger than most manufacturers currently comprehend. Data Act compliance isn't just about technical capability and the math is unforgiving; a bare minimum implementation might take 4-8 weeks, but it won't satisfy real user needs.
No matter which strategy is chosen, the decision window for proper preparation for 2026 enforcement is closing. Reactive projects under regulatory pressure cost far more than proactive ones.
Once audits and customer requests for data sharing begin, organizations need to face the new reality with whatever architecture they have. Fixes under enforcement orders multiply costs and limit strategic choice. The Architecture Gap is structural, not incidental. Now is the moment to close it while options remain.
Reserve Your Diagnostics Assessment
Two-week engagement delivers:
- Strategic Analysis • Applicable Data Act obligations per device class • Penalty exposure across jurisdictions • Compliance strategy recommendations aligned to product lifecycle and architecture
Technical Roadmap • Implementation-ready specifications and gap analysis • Data Act article-by-article technical requirements • Vendor coordination plan and cost model
- Compliance Evidence • Board-ready evidence pack for audit preparation • Certification roadmap through 2030 • Convergence analysis (Data Act, AI Act, & Cyber Resilience Act)
- Timeline: Diagnostics completed in two weeks allow implementation within 2 months, leaving adequate time for strategic decisions while options remain open.
- Pricing: €25 000 to €30 000 depending on data and device portfolio scope – delivering the enablers you need to decide on your compliance approach, achieve implementation readiness, and eliminate 3-5× overrun risk.
The regulatory shift is real. The timeline compressed. The Architecture Gap is solvable — if you act now.
About the Author
Olli Jesperi Vuorinen is Silmaril's Chief Strategy Officer and leads the firm's Data Act and strategy practice.