The EU's access-by-design rule binds connected products from 12 September, and grid-edge hardware fits the definition

The access-by-design obligation in the European Union's Data Act, Regulation (EU) 2023/2854, applies from 12 September 2026. Article 3(1) requires manufacturers to design and make connected products, and providers to design and supply related services, so that the data those products generate is accessible to the user easily, securely and free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly from the device. The rest of the regulation has applied since 12 September 2025. Article 50, the entry-into-force provision, held this one clause back by a year and attaches it only to connected products, and the services related to them, placed on the market after 12 September 2026. Hardware already sold sits outside it.

Nothing in the text is about energy, which is why the trade press has read it as a manufacturing compliance chore. Read the definitions and it is hard to see how a grid-edge device escapes them. Article 2 defines a connected product as an item that obtains, generates or collects data about its use or its environment and can communicate that data by an electronic communications service, a physical connection or on-device access. A residential battery, an EV charger, a heat pump and a smart appliance all do exactly that, and a related service is the digital service, typically the vendor's app or cloud, whose absence would cost the product a function. Article 2 also defines the user as the person who owns the product or has been given temporary rights to use it by contract, which matters in a market where solar and storage are increasingly leased rather than bought: on a lease the household is the user, not the financier. [UNVERIFIED] No Commission list or guidance consulted for this piece names energy devices as in scope. The conclusion follows from the definition and from legal commentary that names smart home systems, vehicles and industrial machinery.

The clause that does the work in practice is Article 5. On the request of a user, or of a party acting on the user's behalf, the data holder must make readily available data, together with the metadata needed to interpret it, available to a third party without undue delay. That is the route by which an independent aggregator, a competing optimiser or an auditor obtains the same telemetry the manufacturer's own cloud already holds, on the instruction of the owner and on no other authority.

Three limits deserve to be stated as plainly as the obligation. The first is Article 50 itself. This is a rule about new market placement, so Europe's installed inverters, chargers and heat pumps are untouched and the effect arrives at the speed of replacement rather than the speed of law. The second is Article 7, which exempts micro and small enterprises from the whole of Chapter II unless they have a partner or linked enterprise that is larger, and gives a firm that has been medium-sized for under a year a further year's grace on products it places on the market. A good deal of grid-edge hardware comes from firms of exactly that size. [NEEDS DATA: what share of EU grid-edge hardware is placed on the market by firms below the small-enterprise threshold] The third is the qualifier inside Article 3(1). Direct access from the device is required only where relevant and technically feasible, and a vendor whose architecture routes everything through its own servers has an obvious argument that its cloud is the feasible route. Whether that argument survives is what the first enforcement action will settle.

Enforcement is national. Article 40 leaves penalties to member states, requires them to be effective, proportionate and dissuasive, and set 12 September 2025 as the date by which they were to be notified to the Commission. Where an infringement of Chapter II, III or V involves personal data, a supervisory authority may fine at the levels set by Article 83(5) of the GDPR. [NEEDS DATA: the penalty ranges member states have actually adopted]

The reason this matters is narrower and more concrete than a general claim about data rights. For a decade the operating data a household's own hardware produces has been treated as the manufacturer's asset, reachable only through the manufacturer's cloud and on the manufacturer's terms. That arrangement, rather than market design, has decided who can aggregate distributed capacity in Europe. A market can be opened to aggregators by regulation and the aggregator still cannot read the battery. Article 3(1) changes the default for new hardware, and Article 5 gives the owner a lever to point the data elsewhere. The consequence is that the choice of box and the choice of who optimises it come apart, which is the precondition for competition in the optimisation layer instead of competition only in the hardware, for independent measurement of what a device actually did, and for leaving a vendor without leaving the equipment behind. It is a slow instrument and a hedged one. The direction is not ambiguous: a decision about who may read a device moves from the firm that built it to the person who owns it.

What is still unknown. Which national authority takes a user's complaint about a non-compliant product, and what that process looks like once filed. Whether cloud-only access satisfies Article 3(1) where the vendor offers no local interface. How the obligation sits alongside the smart-metering data access rules already set by the Electricity Directive, which govern the meter but not the battery behind it. And whether any home storage or EV charger manufacturer has a compliant local data interface ready for the date, which is the test of whether the clause changes products or only paperwork.