The site's recurring argument — sovereignty is policy, not infrastructure, procurement language that makes supplier independence measurable — has an assumption underneath it that nobody had to argue until now: that the customer is entitled to leave. For the first time, that assumption is written law in the world's largest trading bloc, and it just got teeth in two consecutive deadlines.

September 12, 2026: access by design

The Data Act (Regulation (EU) 2023/2854) has applied generally since September 2025 — you could already request product data and challenge unfair terms. The obligation that was deliberately deferred to this week is Article 3(1): connected products placed on the EU market after September 12, 2026 must be designed so the data they generate is available by default — easily, securely, free of charge, in a structured, commonly used, machine-readable format, and directly accessible to the user where relevant and technically feasible.

The change is sharper than it sounds. Since 2025 the question has been whether a manufacturer can produce your data when asked. From this week it is what the product does unasked. Per the Commission's own reading, the deadline attaches to each individual unit shipped — not to product lines. A machine designed in 2021 and unchanged since escapes the design obligation for every unit placed on the market before September 12, 2026, and falls inside it for every unit after. The clock runs on shipments, not development cycles. A manufacturer with a long-lived catalogue is exposed on its current products starting now.

The fine print matters and it favors users more than the carve-outs suggest:

  • Direct access is not unconditional — the "where relevant and technically feasible" qualifier preserves manufacturer discretion. But where direct access is refused, Article 4(1) still requires the holder to make the data available without undue delay, at the same quality the holder has, free of charge, in a structured machine-readable format. Either route must deliver an interoperable format: XML, JSON, CSV — and where latency matters, an interface, not a manual export. The regulation decides architecture, not entitlement.
  • No trade-secrets handbrake on the design obligation. Articles 4 and 5 have a statutory safeguard mechanism for protected data. Article 3 has none. Direct access can be made conditional only by contract — and Article 7(2) voids any term that weakens the user's rights. A buyer's ability to negotiate the firmware and the interface just became a legal fact, not a purchasing preference.
  • Extraterritorial, with a narrow small-business exemption. Article 1(3) applies regardless of where the manufacturer is established — market access is the trigger. The micro/small-enterprise exemption in Article 7(1) is narrower than it looks: it can fail if the enterprise is linked to a larger group or is subcontracted into a product line. Compliance shops are already telling manufacturers that the obligation "travels with the machine" — a Swiss or US vendor shipping into the EU is in scope the same as a German one.
  • Penalties ride on GDPR enforcement. Supervisory authorities can fine Data Act infringements up to €20 million or 4% of worldwide turnover, whichever is higher.

The Commission's guidance is explicit that this is not a mandate to open every machine — the Commission's FAQ states directly that Article 3(1) does not oblige manufacturers to grant direct access in all situations. But the direction is unambiguous: the data the user co-generates is the user's by default, in a format anyone can process, and the manufacturer's control over the interface is now conditional on documented, justified discretion rather than on architecture alone.

January 12, 2027: the exit fee goes to zero

The second deadline is eight weeks out. Article 29 ends the phased reduction of switching charges: from January 12, 2027, providers of data processing services may not impose any switching charges — no fees for the process of moving your data and digital assets to another provider, or to on-premises infrastructure. Article 23 makes removal of commercial, technical, contractual, and organizational obstacles to switching an explicit obligation, including porting to on-premises ICT — "including after having benefited from a free-tier offering," a clause aimed directly at the free-credit lock-in pattern.

The regulation does not stop at fees. From the same date, open interoperability standards apply to switching processes under Article 28. Combined with the access-by-design rules, the sequence is complete: the law now assumes exit is possible, formats are portable, and moving is free. What it does not — and cannot — do is make a hyperscaler's proprietary interfaces carry your workload somewhere else. Functional equivalence under Article 24 is the customer's job to specify and the vendor's obligation to support. The law removes the price of leaving. Architecture determines whether leaving is possible.

What this changes for the stack

Neither rule tells anyone to self-host. Neither mentions Pelican, OpenWrt, Nextcloud, or Matrix. What they change is the economics of every argument this site makes:

  • The procurement argument gets a legal floor. The September 13 post asked for documented open interfaces, config export, and a supplier exit plan written at purchase time. The Data Act now mandates parts of that list by law for cloud services sold in the EU: export in structured, machine-readable form, no exit fees, open standards for the switching process. A procurement document can cite the regulation instead of asking nicely.
  • The lock-in argument for staying on hyperscalers is gone. "Your data can't leave" was never the real barrier — egress fees and proprietary formats were. The first dies in January. The second was never technically necessary; it was a business model. What remains as a genuine reason to stay is vendor-managed AI features, and that is exactly the layer this site's August analysis already prices in.
  • It reinforces the hardware argument. If a connected product must hand over its data by design, then a router, camera, or inverter whose data path runs exclusively through a vendor cloud is now the worse compliance choice, not just the worse sovereignty choice. Community networks running OpenWrt and self-hosted management already meet a standard that closed stacks will now have to retrofit toward.
  • Self-hosting stops being an argument and becomes an implementation detail. You will not win procurement arguments by explaining jurisdiction. You will win them by pointing at the regulation and the calendar: export, formats, exit fees, Article 24 functional equivalence. The compliance case and the sovereignty case have merged, and the merged version is an architecture review.

What to actually do before January 12

For operators running community or small-business infrastructure — and for anyone negotiating a renewal this autumn:

  1. Inventory your exit paths now. For every service you pay for: what format does the data come out in, through what interface, at what fee? If the answer involves a proprietary export tool, a migration service quote, or a per-GB egress line item — that fee is illegal inside the EU after January 12, 2027.
  2. Write exit into the contract, not the crisis. The Data Act gives you the leverage. Ask for export formats, functional equivalence, and Article 24 support in writing at renewal. The regulation means a vendor arguing about it in 2027 is negotiating against the law, not against your IT department.
  3. For connected products you buy — cameras, sensors, gateways, HVAC, vehicles — require the data path. Article 3(1) means new units sold into the EU must ship with data access by design. Ask the vendor how, before purchase, and record the answer. "Indirect access" is legal but must be justified; direct access is the default the law aims at. For the devices this site recommends, the answer is usually: your own server, your own database, your own logs — which is the standard community-network architecture anyway.
  4. Treat January 12 as an implementation deadline, not a compliance one. The rule is law on that date. The architecture that satisfies it — clean data models, documented export interfaces, no hidden coupling — is the same architecture that makes self-hosting possible. Build the export path once and it serves both.

The EU's own enforcement guidance makes the stakes explicit: switching charges were always the toll bridge. From January they are not. Whether a community takes advantage of the toll-free crossing is a decision about architecture, and it is still yours.

Sources: Regulation (EU) 2023/2854; SDAV analysis of Article 3(1) and Commission FAQ v1.4; Wilson Sonsini alert on the September 2026 deadline; Maples Group switching framework overview; Data Act Article 29 text.