The Regulation (EU) 2023/2854, known as the Data Act, has been directly applicable across the Union since 12 September 2025. Among other things, it requires providers to facilitate switching between data processing services and restricts the clauses that make it harder. And on 12 September this year, the design requirements for access to connected product data come into play.

It has mostly been reported as a compliance rule. I find it more interesting to read it as what it is: the end of a business model.

Data lock-in was a strategy

For twenty years, much of enterprise software has rested on a simple idea: getting in is easy, getting out is expensive. Not because of the licence price, but because of what it costs to retrieve your data in a format that is good for anything.

Anyone who has migrated a CRM knows what I mean. The export exists, it is technically correct and it is useless: the relationships are missing, the history is missing, and rebuilding it costs more than staying. That was not a defect. That was the product.

What actually changes

The rule does not require migration to be free or instant. It requires it to be possible without artificial obstacles, and that shifts the ground. If a customer can leave with their data on reasonable terms, the provider has to give them reasons to stay.

Excellent news for anyone building product, bad news for anyone living off friction.

What we do about it

When we design an engine that several companies in the group will share, there is one rule we apply from the start: customer data must be able to leave complete and meaningful, even when the customer is one of our own companies.

It sounds counterintuitive. It does three specific things:

  • It forces good modelling. A data model that cannot be exported whole is usually a model nobody fully understands.
  • It lets you swap a component without rebuilding the system. If a piece stops making sense tomorrow, you replace it. Without a clean export, every component is permanent.
  • It removes the temptation. A team that knows the customer can leave builds so that they will not want to.

The part almost nobody has looked at

The design requirements for connected products arriving in September affect far more people than assume they do. This is not only industrial machinery: any device that generates usage data and is tied to a service falls inside the perimeter.

For a telecoms operator, that includes the router in the customer’s home. The performance data from that device stops being exclusively ours, and how it gets handed over has to be decided now.

Interoperability costs and pays

None of this is free. Designing for portability adds work and removes shortcuts. In exchange, it also removes the quietest debt a software company accumulates: having built something not even it can get out of.

The law has turned good architecture into an obligation. Anyone already doing it has nothing to change; everyone else has a long year of work ahead.