The EU Data Act – how manufacturers lose control over connected device data

English

Regulation (EU) 2023/2854 – the European Union (EU) Data Act – which largely became applicable on 12 September 2025, introduces a paradigm shift in data governance by granting users enforceable rights to access data generated by connected products, including connected medical devices. This article by Cécile van der Heijden examines the profound implications of the Data Act for the medical technology industry. The Act mandates data accessibility by design, real-time user access to device and service-generated data, and the facilitation of data sharing with third parties under fair, reasonable, and non-discriminatory terms. Medical device manufacturers that manufacture connected devices are classified as data holders and must adapt to obligations that extend across a broad digital ecosystem encompassing cloud platforms, remote monitoring services, and software components. The Act further imposes restrictions on contractual terms, requires new pre-contractual transparency measures, and demands architecture that enables data portability and service switching. This article outlines how these obligations challenge conventional models of data ownership, contractual arrangements, and product design in the medical technology sector. Far from a marginal compliance issue, the Data Act constitutes a structural overhaul with significant strategic and operational consequences for medical technology companies operating in the European Economic Area.

Specification: 6 pages plus covers, in English, supplied by email as a PDF.

This article has been published in the November 2025 issue of the Journal of Medical Device Regulation.