EU Data Act Access-by-Design Deadline Hits Connected Medical Devices Sept. 2026
Life sciences manufacturers placing new connected devices on the EU market after 12 September 2026 must build direct user data access into product design or document a defensible indirect-access justification.
The EU Data Act (Regulation 2023/2854) has required connected-product makers to give users access to device-generated data since September 2025. From 12 September 2026, that obligation tightens: new connected products and related services must be designed with direct access capabilities by default, where relevant and technically feasible. The European Commission’s guidance expressly lists medical devices as in-scope connected products, meaning blood glucose monitors, IVD analysers with cloud reporting, connected surgical instruments, and their companion apps all qualify. Direct access is not absolute—manufacturers may opt for indirect access via a portal if justified by security, IP, trade-secret, or proportionality factors, but the reasoning must be documented per product. Non-EU manufacturers must designate an EU legal representative. Existing obligations already in force include pre-contractual transparency, contractual basis for non-personal data use, and on-request access. GDPR fines up to €20m or 4% of turnover apply where personal data is involved, and marketplaces are beginning to require compliance as a supply-chain condition.