EU Data Act: What Changes for Machine Data and How to Build a Sovereign Factory

The European Data Act is now an operational reality for anyone running connected plants. An article published by IIoT World on 13 November 2026 summarises a panel from the 2025 edition of Manufacturing & Supply Chain Day, with speakers from Cybus, Schunk, MaibornWolff and Schwarz Group. It should be read with caution: the content is sponsored by Cybus, an industrial connectivity technology vendor, and the discussion dates back to 2025. Even so, the insights remain useful for those responsible for production and IT/OT on the shop floor.

What the Data Act provides

The regulation became applicable on 12 September 2025. Users of connected equipment have the right to access the data produced by their own machines and to share it with third parties. A manufacturer can therefore demand this access from its own suppliers. The text addresses a well-known problem: extracting data from machines was often difficult or, in some cases, cost significant sums.

In addition, from 12 September 2026, new connected products placed on the EU market must meet "Access by Design" requirements, meaning data must be accessible from the design stage. The Data Act also interlocks with the AI Act, which governs how AI systems process production data.

The speakers flag a practical risk: internal compliance departments sometimes impose constraints stricter than the law itself. The recommendation is to engage with the authorities rather than defaulting to the most restrictive reading.

Three dimensions of data sovereignty

According to the panel, sovereignty is not just a cloud question:

• Technology: can you switch cloud providers without losing data, and run the same workloads on premises and in the cloud?
• Regulation: compliance with the Data Act and the AI Act.
• Organisation: who owns each piece of data and who decides what is shared. This requires data governance roles, access control policies and documented ownership.

"Does my production stop when AWS or Cloudflare has a hiccup?" — Peter Sorowka, CEO of Cybus

The point is that a cloud can be sovereign while machine data remains locked in suppliers' proprietary systems: in that case, the company still has no sovereignty over its own data.

The three-layer architecture

The architecture outlined by the panel consists of:

• Infrastructure: standardised compute from cloud to edge.
• Data integration: machines connected via publish/subscribe, typically with an MQTT broker implementing a unified namespace, standardising data close to the source.
• Semantic contextualisation: the hardest layer, because people in each business unit must define, validate and own their own data.

Schunk, for example, already has the first two layers and is still building the third. Open standards and standardised APIs are needed at every layer. The full journey takes years and requires top management support, which is why the advice is to start with use cases that deliver value immediately.

Manufacturing-X, security and AI

The panel cites Manufacturing-X, a German initiative funded by a federal ministry under Plattform Industrie 4.0 and based on Gaia-X. It includes Catena-X (automotive), Factory-X (plant engineering) and Energy Data-X, with federated identity, standard APIs and policy-based access controls.

On cybersecurity the picture is stark: some plants still lack network segmentation, and most machines have open, unencrypted and unprotected ports. Sorowka described the shop floor as a "total wild west". Emerging risks include AI-generated malware, executive deepfakes and poisoned training data. The panel also expects future industrial software, MES included, to be natively AI-based and to plan production more autonomously; companies with well-governed data will adopt it faster.

What this means for Italian companies

The Data Act applies directly across the EU, so Italian manufacturers too can request access to data from machines and lines. This is a concrete lever in contracts with machine builders and when choosing MES or monitoring platforms. The framework favours vendor-neutral connectivity built on open standards such as MQTT and unified namespace.

Pragmatic first steps:

• include data access clauses in new machine and software purchases;
• map who is responsible for each piece of data;
• check network segmentation and port protection;
• start with a use case that delivers immediate value, such as monitoring a line.

Note: this article is not legal advice, and the text consulted contains no Italy-specific details; for the interpretation of obligations, consult a lawyer. The source text also appeared to be truncated before its conclusion.