# EU Data Act Readiness Assessment: [Organisation name]

> Readiness assessment for Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (the Data Act), in force since 11 January 2024 and applicable from 12 September 2025, with later dates for some obligations. It covers role mapping, the product and service inventory, user access to product and related service data (Chapter II), business-to-business sharing terms and compensation (Chapters III and IV), requests from public bodies on exceptional need (Chapter V), switching between data processing services (Chapter VI), international access safeguards (Chapter VII), interoperability (Chapter VIII), a gap register and a roadmap. Replace every `[bracketed]` value and every row marked *Example*. Worked examples use Pellmoor Thermal, a fictional maker of connected heat pumps that also sells a fleet-management cloud service to installers. This is a documentation format, not legal advice: check the current consolidated text on EUR-Lex and consult a qualified lawyer.

<!--
Guidance: How to use this template
- Work from facts to obligations. First record which roles the organisation plays (section 3) and which products and services are in scope (section 4); only then assess each chapter. Most wasted effort comes from assessing chapters that do not apply.
- One organisation can hold several roles at once: manufacturer, data holder, user, data recipient, provider of data processing services, and customer of such services. Assess each role separately.
- Record evidence for every "ready" answer (a design document, a contract clause, a test result). A readiness score without evidence is not useful to an auditor or a regulator.
- Dates and article numbers below were checked against the Official Journal text on 2026-10-30. EU data law is under review: the Commission's Digital Omnibus proposal of 19 November 2025 would amend the Data Act and fold other data acts into it. Check the status of that proposal and the consolidated text before relying on any date.
- This template asks questions and records answers. It does not say what the law requires in your case. Decisions on scope, exemptions and trade secret refusals need legal review.
- Related documents: Data Sharing Agreement (`compliance/data-sharing-agreement`), Data Residency and Sovereignty Assessment (`compliance/data-residency-sovereignty-assessment`), DPIA (`compliance/dpia`), GDPR Record of Processing Activities (`compliance/gdpr-ropa`), Data Catalogue Metadata Standard (`data/data-catalog-metadata-standard`), Data Classification Policy (`data/data-classification-policy`), Data Governance Operating Model (`data/data-governance-operating-model`), Data Contract (`data/data-contract`).
-->

## Document control

<!-- Guidance: Name an accountable owner (often the chief data officer or general counsel) and record which legal review the assessment has had. Reassess when a new connected product launches, when you start offering a cloud service, and when the Data Act is amended. -->

| Field | Value |
|---|---|
| Document ID | [DACT-RA-001] |
| Version | [0.1] |
| Status | [Draft / In legal review / Approved / Superseded] |
| Owner | [@chief-data-officer] |
| Approvers/reviewers | [@general-counsel], [@data-protection-officer], [@product-lead], [@cloud-service-lead], [@ciso] |
| Legal entities in scope | [Entities and EU member states where products or services are offered] |
| Legal text checked | Regulation (EU) 2023/2854, OJ L 2023/2854 of 22.12.2023 [plus consolidated version date, if any] |
| Assessment date | YYYY-MM-DD |
| Next scheduled review | YYYY-MM-DD |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential, legal privilege where applicable] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| General counsel | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Chief data officer | [@name] | [Decision] | YYYY-MM-DD |
| Data protection officer | [@name] | [Decision] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved after legal review; roadmap agreed |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Reassessed for the new heat pump model placed on the market after 12 September 2026 |

## Contents

- [1. Summary](#1-summary)
- [2. Key dates](#2-key-dates)
- [3. Role mapping](#3-role-mapping)
- [4. Product, service and data inventory](#4-product-service-and-data-inventory)
- [5. Chapter II: user access and third-party sharing](#5-chapter-ii-user-access-and-third-party-sharing)
- [6. Trade secrets and security restrictions](#6-trade-secrets-and-security-restrictions)
- [7. Chapters III and IV: B2B terms, compensation and unfair terms](#7-chapters-iii-and-iv-b2b-terms-compensation-and-unfair-terms)
- [8. Chapter V: exceptional need requests from public bodies](#8-chapter-v-exceptional-need-requests-from-public-bodies)
- [9. Chapter VI: switching between data processing services](#9-chapter-vi-switching-between-data-processing-services)
- [10. Chapters VII and VIII: international access and interoperability](#10-chapters-vii-and-viii-international-access-and-interoperability)
- [11. Interaction with GDPR and other law](#11-interaction-with-gdpr-and-other-law)
- [12. Gap register and roadmap](#12-gap-register-and-roadmap)
- [13. Glossary and references](#13-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Summary

<!-- Guidance: Write this last. State the roles that apply, the overall readiness by chapter, the biggest gaps and the decisions needed from leadership. Keep it to one screen. -->

| Chapter | Applies? | Readiness | Key gap | Decision needed |
|---|---|---|---|---|
| II User access and sharing | *Example:* Yes, as manufacturer and data holder | *Example:* Partly ready | No self-service export of related service data | Fund export API before next model launch |
| III and IV B2B terms | *Example:* Yes | *Example:* Partly ready | Installer contracts restrict data use unilaterally | Approve revised installer terms |
| V Public bodies | *Example:* Yes, as data holder | *Example:* Not ready | No intake process for exceptional need requests | Name an owner |
| VI Switching | *Example:* Yes, as provider of the fleet service | *Example:* Partly ready | Exportable data not fully specified in contracts | Approve contract update |
| VII and VIII | *Example:* Yes, as provider | *Example:* Ready | None material | None |

Readiness scale: Ready (evidence exists), Partly ready (gaps with a funded plan), Not ready (no plan), Not applicable (reason recorded in section 3).

## 2. Key dates

<!-- Guidance: Keep this table with the date you checked it. The dates come from Article 29 and Article 50 of the Regulation. Add internal milestones next to the legal dates. -->

| Date | What applies | Source | Internal milestone |
|---|---|---|---|
| 11 January 2024 | Entry into force; from this date to 12 January 2027 providers of data processing services may charge only reduced switching charges, not above their direct switching costs | Art. 50; Art. 29(2) and (3) | [Milestone] |
| 12 September 2025 | General date of application of the Regulation; Chapter IV applies to contracts concluded after this date; Chapter III applies to sharing obligations in Union or national law entering into force after this date | Art. 50 | [Milestone] |
| 12 September 2026 | Design obligation of Article 3(1) applies to connected products and related services placed on the market after this date | Art. 50 | *Example:* New heat pump model PT-H9 launches in November 2026 and must comply at launch |
| 12 January 2027 | Providers of data processing services may no longer impose any switching charges | Art. 29(1) | [Milestone] |
| 12 September 2027 | Chapter IV applies to contracts concluded on or before 12 September 2025 that are of indefinite duration or due to expire at least 10 years from 11 January 2024 | Art. 50 | [Milestone] |

Dates checked against the Official Journal text on 2026-10-30. The Digital Omnibus proposal (19 November 2025) may change obligations or dates; record its status here: [status and date checked].

## 3. Role mapping

<!-- Guidance: For each role, answer yes or no with a reason. Questions: do you place connected products on the EU market? Do you provide a related service (a digital service that affects how a product functions)? Do you control data generated by use of a product? Do you provide cloud or edge services to EU customers? Pitfall: assuming the Act does not apply because the company is established outside the EU; Article 1(3) applies to several roles irrespective of the place of establishment. -->

| Role (Art. 1(3) and Art. 2) | Applies? | Reason and evidence | Chapters triggered |
|---|---|---|---|
| Manufacturer of connected products placed on the EU market | *Example:* Yes | Heat pumps sold in 9 member states | II |
| Provider of a related service | *Example:* Yes | Companion app that changes heating schedules | II |
| Data holder | *Example:* Yes | Pellmoor controls telemetry from installed units | II, III, IV, V |
| User of connected products (as a business) | *Example:* Yes | Pellmoor uses connected factory equipment from suppliers | II (as beneficiary) |
| Data recipient | *Example:* No | Pellmoor does not receive Chapter II data from others today | Not applicable |
| Provider of data processing services to EU customers | *Example:* Yes | Fleet-management service for installers, multi-tenant SaaS | VI, VII, VIII |
| Customer of data processing services | *Example:* Yes | Pellmoor runs on a public cloud provider | VI (as beneficiary) |
| Participant in a data space, or vendor or deployer of smart contracts for data sharing | *Example:* No | Not yet a member of any data space | Not applicable |

### 3.1 Exemptions to consider

| Question | Answer | Evidence | Legal review |
|---|---|---|---|
| Is the organisation a micro or small enterprise without partner or linked enterprises that are larger (Art. 7(1))? | *Example:* No, 1,400 staff | Group structure chart | [@counsel], YYYY-MM-DD |
| Is it a medium-sized enterprise that has qualified as such for less than one year, or a product placed on the market by a medium-sized enterprise less than one year ago (Art. 7(1))? | [Answer] | [Evidence] | [Review] |
| Is any data processing service mainly custom-built for one customer and not offered at broad commercial scale (Art. 31(1), which lifts only some switching obligations), or a non-production test version (Art. 31(2))? | *Example:* One custom deployment for a utility partner | Contract register | [@counsel], YYYY-MM-DD |

## 4. Product, service and data inventory

<!-- Guidance: List each connected product and related service with the data it generates and where that data goes. This inventory feeds sections 5 and 6. Pitfall: listing only data the company uses today; the Act refers to readily available data, which can include data collected but never analysed. -->

| ID | Product or service | Placed on market | Data generated | Readily available to the data holder? | Storage location | Metadata available |
|---|---|---|---|---|---|---|
| PRD-H7 *(Example)* | Heat pump PT-H7 | 2023-03 | Flow and return temperatures, compressor runtime, error codes, energy use | Yes, every 5 minutes | Pellmoor cloud, EU region | Field dictionary v2 |
| PRD-H9 *(Example)* | Heat pump PT-H9 | Planned 2026-11 | As PT-H7 plus refrigerant pressures | Yes, every 1 minute | Pellmoor cloud, EU region | Draft |
| SVC-APP *(Example)* | Companion app (related service) | 2023-03 | Schedules, setpoint changes, comfort ratings | Yes | Pellmoor cloud | Partial |
| SVC-FLEET *(Example)* | Fleet-management service for installers | 2024-06 | Aggregated unit health, service tickets | Derived data, see note | Pellmoor cloud | Yes |
| [ID] | [Product or service] | YYYY-MM | [Data] | [Yes / No] | [Location] | [Status] |

Note: record which data is raw or pre-processed product data and which is derived or inferred by the data holder's own analysis, with the reasoning, and have the classification reviewed by counsel. The scope of Chapter II turns on this distinction.

## 5. Chapter II: user access and third-party sharing

<!-- Guidance: Assess each obligation per product or service. Questions are written as checks; answer with evidence. Article numbers refer to the Regulation. -->

| ID | Check | Article | PRD-H7 | PRD-H9 | SVC-APP | Evidence |
|---|---|---|---|---|---|---|
| DA-201 | For products placed on the market after 12 September 2026, is product and related service data, with the metadata needed to interpret it, directly accessible to the user by default where relevant and technically feasible, free of charge and in a structured, commonly used, machine-readable format? | 3(1) | Not applicable (placed earlier) | *Example:* Partly: local API planned | *Example:* No | Design doc DD-112 |
| DA-202 | Before a purchase, rent or lease contract, does the seller give the user the pre-contract information on data type, format, estimated volume, continuous or real-time generation, storage and retention, and how to access or erase the data? | 3(2) | *Example:* Partly | *Example:* Draft | Not applicable | Product data sheet |
| DA-203 | Before a related service contract, does the provider give the information listed for related services, including the identity of the data holder, its own intended use of the data and any third-party use? | 3(3) | Not applicable | Not applicable | *Example:* Partly | App onboarding screens |
| DA-204 | Where the user cannot access data directly, can the user obtain readily available data and metadata on a simple electronic request, without undue delay, free of charge, of the same quality as the data holder has, and continuously and in real time where relevant and technically feasible? | 4(1) | *Example:* Yes, via portal export | *Example:* Yes | *Example:* No | Portal export test |
| DA-205 | Does the data holder ask only for information necessary to verify the user, and keep access logs no longer than needed? | 4(5) | [Answer] | [Answer] | [Answer] | [Evidence] |
| DA-206 | Are choices presented neutrally, without interface designs that make exercising the rights unduly difficult? | 4(4) | [Answer] | [Answer] | [Answer] | UX review |
| DA-207 | Does the data holder use non-personal data only on the basis of a contract with the user? | 4(13) | [Answer] | [Answer] | [Answer] | Terms of use clause |
| DA-208 | At the user's request, can data be made available to a third party under the same quality and format conditions, free of charge to the user? | 5(1) | *Example:* No process | *Example:* No | *Example:* No | Gap DAG-002 |
| DA-209 | Does the process check that the third party is not a designated gatekeeper under Regulation (EU) 2022/1925? | 5(3) | [Answer] | [Answer] | [Answer] | [Evidence] |
| DA-210 | Where personal data is involved and the user is not the data subject, is there a valid GDPR legal basis before making it available? | 4(12), 5(7) | [Answer] | [Answer] | [Answer] | DPIA reference |
| DA-211 | As a third party receiving data at a user's request, do we limit use to the agreed purposes, erase it when no longer needed, and avoid profiling and onward sharing outside the agreed terms? | 6 | Not applicable | Not applicable | Not applicable | Role not held |

```mermaid
flowchart TD
  U[User request received] --> V{Identity and user status verified}
  V -->|no| R1[Ask only for necessary information]
  R1 --> V
  V -->|yes| T{Recipient is a third party?}
  T -->|no| P{Personal data of others?}
  T -->|yes| G{Third party is a gatekeeper?}
  G -->|yes| X[Refuse for that recipient, record reason]
  G -->|no| P
  P -->|yes| L[Check GDPR legal basis with DPO]
  P -->|no| S{Trade secret data included?}
  L --> S
  S -->|yes| TS[Agree confidentiality measures, section 6]
  S -->|no| D[Deliver data and metadata]
  TS --> D
```

## 6. Trade secrets and security restrictions

<!-- Guidance: Article 4(6) to (8) and Article 5(9) to (11) allow data holders to protect trade secrets through agreed measures, and in exceptional cases to refuse. Article 4(2) allows contractual restrictions where sharing could undermine security requirements with serious effects on health, safety or security. Each refusal or suspension must be substantiated in writing and notified to the competent authority. Pitfall: using trade secrets as a general reason to refuse. -->

| ID | Data element | Trade secret? | Basis for the claim | Measures offered to the user or third party | Refusal possible under Art. 4(8)? | Reviewed by |
|---|---|---|---|---|---|---|
| TS-001 *(Example)* | Compressor control parameters | Yes | Proprietary control algorithm tuning | Confidentiality agreement, access through secured API only, no onward sharing | Assess case by case; demonstration of serious economic damage required | [@counsel] |
| TS-002 *(Example)* | Error code table | No | Published in installer manual | Not applicable | No | [@counsel] |
| [TS-nnn] | [Element] | [Yes / No] | [Basis] | [Measures] | [Assessment] | [@reviewer] |

Process checks:

1. Trade secret data is identified in the metadata before any request arrives.
2. A template confidentiality agreement and technical measures are ready, so that sharing is not delayed.
3. Every withholding, suspension or refusal is written, substantiated, sent to the user without undue delay, and notified to the competent authority designated under Article 37.
4. Security-based restrictions under Article 4(2) are tied to a named Union or national security requirement.

## 7. Chapters III and IV: B2B terms, compensation and unfair terms

<!-- Guidance: Chapter III sets conditions when a data holder is legally obliged to make data available to a data recipient (fair, reasonable and non-discriminatory terms, compensation, dispute settlement, technical protection). Chapter IV makes certain unfair terms on data access and use, unilaterally imposed on another enterprise, not binding. Review templates and live contracts. -->

| ID | Check | Article | Status | Evidence |
|---|---|---|---|---|
| DA-301 | Are arrangements with data recipients agreed on fair, reasonable and non-discriminatory terms, and in a transparent manner? | 8(1) | [Ready / Partly / Not ready] | Data sharing agreement template (`compliance/data-sharing-agreement`) |
| DA-302 | Are comparable categories of recipients, including group companies, treated without discrimination? | 8(3) | [Status] | Pricing policy |
| DA-303 | Is any compensation non-discriminatory and reasonable, based on the factors in Article 9(2), and limited to the costs of making data available where the recipient is an SME or not-for-profit research organisation without larger partner or linked enterprises? | 9 | [Status] | Compensation model |
| DA-304 | Has the compensation model been compared with the Commission guidelines on reasonable compensation once published under Article 9(5)? | 9(5) | [Status] | [Date checked] |
| DA-305 | Have all standard terms on data access and use offered to other enterprises been reviewed against the unfair terms tests? | 13 | [Status] | Contract review log |
| DA-306 | Are contracts concluded on or before 12 September 2025 that are of indefinite duration, or expire at least 10 years from 11 January 2024, scheduled for review before 12 September 2027? | 50 | [Status] | Contract register query |
| DA-307 | Have the Commission's non-binding model contractual terms and standard contractual clauses (Article 41; Recommendation adopted 19 November 2025) been compared with our templates? | 41 | [Status] | Comparison memo |
| DA-308 | Are technical protection measures (for example smart contracts, encryption) used only to prevent unauthorised use, and not to hinder users' rights? | 11 | [Status] | Architecture review |

*Example:* Pellmoor's installer agreement allowed Pellmoor to end installer data access at any time without notice. Counsel flagged it as a term to review under Article 13 for contracts concluded after 12 September 2025. Gap DAG-004 records the fix.

## 8. Chapter V: exceptional need requests from public bodies

<!-- Guidance: Public sector bodies, the Commission, the European Central Bank and Union bodies may request data where an exceptional need exists (Art. 14 and 15), for example to respond to a public emergency. Prepare an intake process so requests are handled lawfully and quickly. -->

| ID | Check | Article | Status | Evidence |
|---|---|---|---|---|
| DA-401 | Is there a named owner and intake channel for requests from public bodies? | 17, 18 | [Status] | [Process doc] |
| DA-402 | Does the process check that the request states the data, purpose, legal basis, deadline and why the need is exceptional? | 17 | [Status] | Checklist |
| DA-403 | Does the process cover grounds and deadlines for declining or seeking modification, as set out in Article 18? | 18 | [Status] | Checklist |
| DA-404 | Where the requested data includes personal data, is it anonymised, or pseudonymised where the request requires personal data to be disclosed? | 18(4) | [Status] | DPO sign-off |
| DA-405 | Is compensation, where allowed, calculated and documented? | 20 | [Status] | Finance note |

## 9. Chapter VI: switching between data processing services

<!-- Guidance: Complete this section if you provide cloud, edge or other data processing services to customers in the EU, and also from the customer side to understand your own rights. The contract must set out switching rights in writing (Art. 25). Pitfall: thinking the obligations only apply to large hyperscalers; they apply to providers of data processing services generally, with the limited exceptions in Article 31. -->

### 9.1 As a provider

| ID | Check | Article | Status | Evidence |
|---|---|---|---|---|
| DA-601 | Are commercial, technical, contractual and organisational obstacles to switching, porting or parallel use removed? | 23 | [Status] | Obstacle review |
| DA-602 | Does the written contract, available before signing, set out switching rights, a maximum notice period of no more than two months, a transitional period of no more than 30 calendar days, and a data retrieval period of at least 30 calendar days? | 25(1), 25(2)(a), (d), (g) | [Status] | Master services agreement clause |
| DA-603 | Does the contract give an exhaustive specification of exportable data and digital assets, and of any data excluded for trade secret reasons? | 25(2)(e), (f) | [Status] | Contract annex |
| DA-604 | Does the contract guarantee full erasure after the retrieval period once switching completes? | 25(2)(h) | [Status] | Clause |
| DA-605 | Is there a process to notify the customer within 14 working days, with justification, when the 30-day transitional period is technically unfeasible, and to propose an alternative of no more than seven months? | 25(4) | [Status] | Runbook |
| DA-606 | Can the customer extend the transitional period once? | 25(5) | [Status] | Clause |
| DA-607 | Are switching procedures, methods, formats, known limitations and an up-to-date online register of data structures and formats published? | 26 | [Status] | Website section |
| DA-608 | Are switching charges reduced to direct costs until 12 January 2027 and removed from that date, and are standard fees, early termination penalties and reduced charges disclosed before contract? | 29 | [Status] | Price list |
| DA-609 | For infrastructure services, are reasonable measures in place to help achieve functional equivalence after switching? | 30(1) | [Status] | Not applicable for SaaS, reason recorded |
| DA-610 | For other services, are open interfaces offered free of charge and equally to all customers and destination providers, and is compatibility with common specifications or harmonised standards for interoperability planned within 12 months of their publication in the Union repository? | 30(2), (3) | [Status] | API docs, standards watch list |

*Example:* Pellmoor's fleet service contract currently sets a notice period of three months and does not state a retrieval period. Under DA-602 both clauses need review; gap DAG-006 tracks the update.

```mermaid
sequenceDiagram
  participant C as Customer
  participant P as Source provider
  participant D as Destination provider
  C->>P: Notice of switching, then wait for the notice period, max 2 months
  P-->>C: Confirm start of transitional period, max 30 days
  P->>D: Port exportable data and digital assets
  D-->>C: Confirm data received
  C->>P: Confirm switching completed
  P-->>C: Retrieval period, at least 30 days
  P-->>C: Erasure confirmation after retrieval period
```

### 9.2 As a customer

| ID | Question | Answer |
|---|---|---|
| DA-651 | Do our cloud contracts state notice, transitional and retrieval periods and exportable data? | [Answer] |
| DA-652 | Do we have an exit plan per critical service that uses these rights? | [Answer, link to exit plan] |

## 10. Chapters VII and VIII: international access and interoperability

<!-- Guidance: Chapter VII requires providers of data processing services to take adequate technical, organisational and legal measures against unlawful third-country governmental access to non-personal data held in the EU. Chapter VIII sets essential requirements for data space participants, smart contracts and data processing service interoperability. -->

| ID | Check | Article | Status | Evidence |
|---|---|---|---|---|
| DA-701 | Are measures against unlawful third-country governmental access to non-personal data documented and in place? | 32 | [Status] | Data residency assessment (`compliance/data-residency-sovereignty-assessment`) |
| DA-702 | Is there a procedure to assess third-country access requests before any disclosure and to inform the customer where permitted? | 32 | [Status] | Legal request procedure |
| DA-703 | Are the jurisdiction of ICT infrastructure and the measures under Article 32 published on the provider's website? | 28 | [Status] | Website section |
| DA-704 | If we participate in a data space, do our datasets and services meet the essential interoperability requirements, including dataset descriptions and metadata? | 33 | [Status] | Catalogue metadata standard (`data/data-catalog-metadata-standard`) |
| DA-705 | If we use or offer smart contracts to execute data sharing agreements, do they meet the essential requirements (robustness, safe termination, data archiving, access control, consistency)? | 36 | [Status] | Not applicable |
| DA-706 | Are we tracking harmonised standards and common specifications for interoperability of data processing services adopted under Article 35? | 35 | [Status] | Standards watch list |

## 11. Interaction with GDPR and other law

<!-- Guidance: The Data Act is without prejudice to EU data protection law. Where personal data is concerned, GDPR rules on legal basis, data subject rights and security apply in parallel. Record the joint review with the DPO. -->

| Topic | Question | Answer and reference |
|---|---|---|
| Personal data in product data | Which product data relates to identified or identifiable persons (for example the household using a heat pump)? | [Answer, link to RoPA entry in `compliance/gdpr-ropa`] |
| Legal basis for sharing | When a user who is not the data subject asks for data, which GDPR basis applies? | [Answer, DPIA reference] |
| Portability | How do Data Act requests relate to GDPR Article 20 portability requests in our process? | [Answer] |
| Sector law | Which sector rules (for example energy, automotive, medical devices) also govern this data? | [Answer] |
| Penalties | Which member state penalty rules apply to us (Art. 40 requires member states to set them)? | [Member states and date checked] |
| Competent authorities | Which authorities and data coordinators are designated in our main member states (Art. 37)? | [Authorities and date checked] |

Outside the EU, the Data Act applies to products placed on the EU market and to services provided to EU customers, regardless of where the organisation is established (Art. 1(3)). Organisations in the UK and the US that sell into the EU should therefore assess it alongside their home-country data and consumer law.

## 12. Gap register and roadmap

<!-- Guidance: Turn every Partly ready or Not ready answer into a gap with an owner and a date. Order the roadmap by legal date first, then by risk. -->

| ID | Linked checks | Gap | Risk | Action | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| DAG-001 *(Example)* | DA-201 | PT-H9 has no direct data access for users at launch | High: model placed on market after 12 September 2026 | Local API and app export before launch, or postpone launch | Product lead | 2026-11-15 | In progress |
| DAG-002 *(Example)* | DA-208, DA-209 | No process to share data with third parties at user request | High | Build request flow with gatekeeper check | Data platform lead | 2027-01-31 | Planned |
| DAG-003 *(Example)* | DA-202 | Pre-contract information incomplete for PT-H7 | Medium | Update data sheet and retail listings | Product marketing | 2026-12-15 | Planned |
| DAG-004 *(Example)* | DA-305 | Installer agreement allows termination of data access without notice | Medium | Revise term after counsel review | General counsel | 2026-12-31 | Planned |
| DAG-005 *(Example)* | DA-401 to DA-405 | No intake process for public body requests | Medium | Write procedure, train legal team | General counsel | 2027-02-28 | Planned |
| DAG-006 *(Example)* | DA-602, DA-608 | Fleet service notice period 3 months; no retrieval period; switching fee in price list | High: charges must end by 12 January 2027 | Contract and price list update | Cloud service lead | 2026-12-31 | In progress |
| [DAG-nnn] | [DA-nnn] | [Gap] | [Risk] | [Action] | [@owner] | YYYY-MM-DD | [Status] |

```mermaid
flowchart LR
  A[DAG-006 contract and price list, Dec 2026] --> B[DAG-001 PT-H9 data access, Nov 2026]
  B --> C[DAG-003 data sheets, Dec 2026]
  C --> D[DAG-002 third-party sharing, Jan 2027]
  D --> E[DAG-005 public body intake, Feb 2027]
```

The diagram shows the order of work agreed by the steering group; DAG-006 starts first because the contract change needs the longest customer notice, even though DAG-001 is due earlier.

## 13. Glossary and references

<!-- Guidance: Use the Regulation's terms consistently, paraphrased in plain words. Record the date you checked each source. -->

### 13.1 Glossary

| Term | Meaning in this document (paraphrase, see Art. 2 for legal definitions) |
|---|---|
| Connected product | An item that obtains or generates data about its use or environment and can communicate it, and whose primary function is not storing, processing or transmitting data on behalf of anyone other than the user |
| Related service | A digital service, other than electronic communications, connected with a product so that without it the product could not perform one of its functions, or that changes how the product functions |
| Data holder | A person who has the right or obligation to use and make available certain data, under the Regulation or other law |
| User | A person who owns a connected product, or to whom rights to use it have been transferred, or who receives a related service |
| Readily available data | Product and related service data that the data holder obtains or can obtain without disproportionate effort |
| Data processing service | A digital service that enables on-demand network access to a shared pool of configurable computing resources, such as cloud and edge services |
| Switching | Moving from one provider of data processing services to another, or to on-premises infrastructure |
| Exceptional need | Limited circumstances, such as a public emergency, in which public bodies may request data under Chapter V |

### 13.2 References

| Reference | Version or date checked | Use |
|---|---|---|
| Regulation (EU) 2023/2854 (Data Act), Official Journal text, https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng | OJ L of 22.12.2023; text checked 2026-10-30 through the Publications Office (EUR-Lex blocked automated access) | Articles 1, 3 to 9, 13 to 20, 23 to 36, 37, 40, 41, 50 |
| European Commission, Data Act policy page, https://digital-strategy.ec.europa.eu/en/policies/data-act | Checked 2026-10-30 | Date of application |
| BIPT (Belgian regulator), Application of the Data Act, https://bipt.be/operators/digital/the-data-act/application-of-the-data-act | Checked 2026-10-30 | Cross-check of application dates |
| European Commission, Recommendation on non-binding model contractual terms and standard contractual clauses, https://digital-strategy.ec.europa.eu/en/library/draft-recommendation-non-binding-model-contractual-terms-data-access-and-use-and-non-binding | Adopted 19 November 2025 (C(2025) 7750); checked 2026-10-30 | DA-307 |
| European Commission, Digital Omnibus proposal | 19 November 2025; under negotiation as of October 2026 | Watch item for amendments |
| Regulation (EU) 2016/679 (GDPR) | Consolidated text | Section 11 |

## Standard and licence note

Based on Regulation (EU) 2023/2854 (Data Act) as published in the Official Journal of the European Union, a public legal act. Article numbers and dates are cited and obligations are paraphrased in original words; no long passages are reproduced, and the glossary paraphrases rather than quotes the legal definitions in Article 2. The checks, scoring, gap register and examples are original, and Pellmoor Thermal is fictional. This template is original text written for this collection. This is a documentation format, not legal advice: check the current consolidated text on EUR-Lex, the status of the Digital Omnibus proposal and guidance from your competent authority, and consult a qualified lawyer. Template licence: MIT.