EU Data Act: What U.S. Connected-Product Makers Need to Know
The manufacturer-as-data-holder view: what counts as a connected product, the access-by-design duty, and the engineering work it triggers.
Is your product in scope? What will your engineers have to build, and by when? This guide answers those questions in plain terms, then walks your team through the work one step at a time.

The manufacturer-as-data-holder view: what counts as a connected product, the access-by-design duty, and the engineering work it triggers.
A reference architecture for signing, distribution, device verification, A/B install, rollback and reporting, with industrial constraints.
Charter, roles, intake, triage and severity, and how they tie to the Cyber Resilience Act’s reporting clock.
An evaluation framework, not a list: engagement models, capability checks, questions to ask and red flags.
Featured comparison
An evaluation framework with engagement models, capability checks, questions to ask and red flags. No rankings.
Read the buyer’s guide →Sep 11, 2026
Cyber Resilience Act reporting obligations (Art. 14)
Regulation (EU) 2024/2847 · EUR-LexJan 20, 2027
Machinery Regulation applies
Regulation (EU) 2023/1230 · EUR-LexDec 11, 2027
Cyber Resilience Act main obligations apply
Regulation (EU) 2024/2847 · EUR-LexAbout 12 questions on your update mechanism, signing, rollback and vulnerability workflow. Results show on screen, with no email needed.
Start the assessment →Weighted criteria you fill in to compare engineering partners side by side. Web and XLSX versions.
Open the scorecard →Get new guides, tools and rule-date changes for U.S. product teams selling in Europe, once a month.
Newsletter signups aren’t open yet.
About the newsletter →