The EU's access-by-default rule for connected products has started, and every inverter, charger and heat pump placed on the market after 12 September is inside it
This is the clearest legal statement anywhere that the data a device generates belongs to the person who uses the device rather than to the company that built it, and it is enforced at the point of design rather than by asking manufacturers to be reasonable after the fact. For the grid edge it removes the precondition that has quietly blocked third party control of household assets: an owner who cannot get structured data out of their own inverter, battery, charger or heat pump cannot hand it to an aggregator, a rival optimiser or an independent auditor, and so cannot really switch. From 12 September the manufacturer's data moat has to be designed out of new products rather than defended.
On 12 September 2026 the part of the EU Data Act that most directly concerns edge hardware came into application. Article 3(1) of Regulation (EU) 2023/2854 requires that connected products, and the services related to them, be designed and manufactured so that the data they generate is accessible to the user by default: easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, including the metadata needed to make sense of it, and directly from the device where that is technically feasible.
The important qualifier is which products it binds. This is not a retrofit obligation. It applies to connected products and related services placed on the EU market after 12 September 2026, so the installed base is untouched and the rule bites only on what ships from now on. The remainder of the regulation has applied since 12 September 2025.
For a publication that tracks control moving to the edge, this is a more consequential instrument than most energy-specific regulation, because it attacks the precondition rather than the symptom. Consider what a householder with a home battery can currently do. They own the asset. They do not, in the general case, own a usable export of what it did, at what state of charge, in response to what signal. That data goes to the manufacturer's cloud, is returned as a phone app, and is available to third parties on whatever commercial terms the manufacturer chooses to offer, if any. Every downstream freedom depends on breaking that: handing the asset to an aggregator, switching optimiser, having an independent party verify a savings claim, or repairing and re-commissioning the unit outside the original vendor's network. Access-by-design is the legal instrument that turns those from favours into entitlements, and it does so at the design stage, where it is cheap, rather than by complaint, where it is not.
Two cautions belong on this. The first is scope. Every source that describes the rule gives an illustrative list of covered products: vehicles, industrial and agricultural machinery, monitoring equipment, IoT devices, smart home systems. None of the sources retrieved for this piece names inverters, home batteries, heat pumps or EV chargers explicitly. The reading that they are covered is the natural one and it is not a quoted one. [UNVERIFIED]
The second is that this sweep could not read the regulation. The EUR-Lex HTML returned the recitals and not the articles, and the two most authoritative law firm notes on the September deadline returned payment and access errors. The date and the scope are consistent across four independent secondary sources, including Wikipedia's timeline and a dated DLA Piper commentary, and the underlying text was not among them. Anyone relying on the specifics here for a compliance decision should read Article 3 and Article 50 directly.
What happens next is the part worth watching. A right that nobody enforces is a design suggestion. The open question is which member states have actually stood up a competent authority, and whether a manufacturer can keep a product effectively closed by satisfying the letter of the rule with an interface that is technically machine-readable and practically unusable. [NEEDS DATA: designated competent authorities by member state; any enforcement action since 12 September 2026]
Public comments
Loading…