Who owns your machine data? Industrial AI and the EU Data Act

"Who owns the machine data?" comes up in almost every industrial AI project, usually late and usually in a contract negotiation. The EU Data Act changes how that question is answered in Europe. It does not hand out ownership. It assigns rights to access and use data generated by connected products, and it limits what the party holding the data may do with it.

This article explains what the EU Data Act means for machine data in industrial AI: which data it covers, what operators and machine builders can and must do, and the dates that matter. It reflects the situation in October 2026.

Who owns machine data? Access rights instead of ownership

The Data Act does not treat data as property to be allocated. Instead, it defines roles and gives each role rights and obligations:

• The user is the person or company that owns, rents or leases a connected product, or receives a related service.
• The data holder is the party that has the right or obligation to use and make available the data, in practice often the manufacturer or the provider of a related digital service.
• A third party is anyone the user asks to receive the data, such as an independent maintenance provider or an AI developer.

The practical effect for industrial AI is a shift in bargaining power. A machine operator who wants to use the data from its machines, for its own analysis or with a partner of its choice, now has a legal basis to ask for it. A machine builder that wants to use operator data to train its own models needs a contract with the operator to do so.

What is the EU Data Act?

The EU Data Act is Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data. It was adopted on 13 December 2023 and, according to the European Commission, published in the Official Journal on 22 December 2023. As a regulation, it applies directly in all EU member states without national implementation.

The key dates are set in Article 50:

Beyond machine data, the regulation also covers data sharing with public bodies in exceptional need and switching between cloud and other data processing services. This article concentrates on the parts that matter for machines.

Changes are on the table but not yet law. The Commission's Digital Omnibus proposal of 19 November 2025 would amend parts of the Data Act, including, according to a Simmons & Simmons summary, a new ground for refusing to share trade secrets where there is a high risk of unlawful acquisition, use or disclosure to third countries with weaker protection. As of autumn 2026 the proposal is still at an early stage of the legislative procedure, and the Data Act applies as adopted.

Which machine data is covered?

The definitions in Article 2 decide what is in scope.

• A connected product is "an item that obtains, generates or collects data concerning its use or environment" and can communicate that data. Most modern machines with networked controllers or sensors fall into this category.
• A related service is "a digital service, other than an electronic communications service, including software" that is connected with the product, at the time of purchase or later, so that the product performs or extends its functions.
• Product data is "data generated by the use of a connected product that the manufacturer designed to be retrievable".
• Related service data represents the digitisation of user actions or of events related to the connected product during the provision of a related service.
• Readily available data is product and related service data the data holder can obtain "without disproportionate effort going beyond a simple operation".

The Commission's explanation adds an important line for AI. The access rights cover "raw and pre-processed data generated from the use of a connected product", including relevant metadata, while "inferred or derived data and content" are excluded.

Applied to a typical industrial AI system, that suggests the following split. The right-hand column is our reading, not legal advice, and borderline cases depend on the specific product.

What the Data Act means for machine operators

For the user of a machine, the central provision is Article 4. Where the user cannot access the data directly from the product, the data holder must make "readily available data, as well as the relevant metadata" available to the user promptly, free of charge, in a structured, machine-readable format, and where relevant and technically feasible continuously and in real time. The user can also ask the data holder to make the data available to a third party.

In practice this means an operator can:

• obtain the raw data from its machines for its own condition monitoring or quality analysis;
• have that data shared with an independent service provider or AI developer of its choice;
• compare machines from different builders using a common analysis.

There are limits. Under Article 4(10), the user must not use the data to develop a connected product that competes with the product the data came from, or share it with a third party for that purpose. Competing in related or aftermarket services is not prohibited, according to the Commission. Trade secrets also remain protected: under Article 4(6) to 4(9), data holders and users agree on confidentiality measures, and a data holder may withhold or suspend sharing of trade secrets if those measures are not agreed or not respected, or, in exceptional cases, refuse if it can show it is "highly likely to suffer serious economic damage". Refusals must be justified in writing and notified to the competent authority.

What it means for machine builders and AI providers

For manufacturers and providers of related services, three provisions stand out.

Access by design. Under Article 3(1), connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, including the necessary metadata, are by default easily and securely accessible to the user, free of charge, in a machine-readable format, and where relevant and technically feasible directly. Article 3(2) and 3(3) add pre-contract information duties, for example on the type, format and likely volume of data a product can generate. The design obligation applies to products placed on the market after 12 September 2026, so designs being finalised now are affected.

Use only by contract. Under Article 4(13), a data holder may use readily available non-personal data only on the basis of a contract with the user, and may not use it to derive insights about the user's economic situation, assets, production methods or use of the product in ways that could undermine the user's commercial position. Article 4(14) restricts passing non-personal product data to third parties to what is needed to fulfil the contract with the user. A machine builder that wants to train fleet-wide models on operator data needs that use written into its contracts.

Relief for small companies. According to the Commission, micro and small enterprises as manufacturers or related service providers are not subject to the same obligations as larger companies, and when data is shared business-to-business, micro, small and medium-sized enterprises cannot be charged more than the cost of making it available.

A practical checklist for industrial AI projects

1. Map your data. List every data stream from the machine and classify it as raw, pre-processed, metadata or derived.
2. Identify the roles. For each machine, who is the user, who is the data holder, and which third parties are involved?
3. Review contracts. Check that every use of operator data for analysis or model training is covered by an agreement with the user. Check new contracts for terms that could be considered unfair under Chapter IV.
4. Define trade secrets. If some data reveals confidential process knowledge, identify it, including in metadata, and agree on protection measures in advance.
5. Plan export. Make sure data can be provided in a structured, machine-readable format, with the metadata needed to interpret it.
6. Check product timelines. For products placed on the market after 12 September 2026, verify that data access by design is part of the specification.
7. Watch adjacent rules. Personal data remains subject to the GDPR, and connected sensors also fall under cybersecurity rules, covered in our article on the Cyber Resilience Act and connected sensors.

Where edge architectures help

The Data Act does not prescribe an architecture. But where data is evaluated and stored influences how easy compliance is. When raw data stays on a device at the machine, under the operator's control, the operator already has access, and the question of what leaves the site becomes an explicit decision rather than a default. We compared the options in edge vs cloud for industrial sensing, and the general case for evaluating at the machine is in what is edge AI in manufacturing.

Edge evaluation also produces a clean separation that maps onto the regulation's categories: raw and pre-processed recordings on one side, model outputs on the other. Keeping both well documented makes it easier to answer an access request precisely. The same documentation discipline supports other EU requirements, for example in AI-based quality inspection under the EU AI Act.

How NeuroControls approaches this

Our systems record on site, at the machine. Recordings carry a versioned manifest, per-segment SHA-256 hashes and an append-only journal, and are exported in open formats: NWB, MKV/HEVC, JSONL and CSV. That makes it straightforward for an operator to hand raw data and the metadata needed to interpret it to a partner of its choice. Details are on our data solutions page and our software page.

When we train custom models on customer data, recordings, labels and models belong to the customer, and none of this data ends up in a third-party cloud. Integration with Grafana, OpenSearch, Kafka or MES systems is available on request.