EU Data Act and the AI implications: training, inference, cloud switching

The Data Act is structured into eleven chapters. Chapter II (Articles 3-7) creates a right for users of connected products to access the data those products generate and to share it with third parties of their choice. Chapter III (Article 8) imposes fairness obligations on data-sharing arrangements. Chapter IV restricts unfair contractual terms in B2B data contracts. Chapter V (Articles 14-22) creates a public-sector data access regime in cases of exceptional need. Chapter VI (Articles 23-31) imposes cloud and edge switching obligations on data-processing service providers. Chapter VII restricts international government access to non-personal data held in the EU. Chapter VIII covers interoperability standards. The remaining chapters cover smart contracts, enforcement and final provisions [1].

For AI, the headline impacts are concentrated in Chapters II, IV, V and VI. Training data sourced from connected products in the EU is now subject to user-driven access rights and third-party-sharing obligations. B2B data licensing for AI training cannot include unfair terms as defined in Article 13. The B2G regime opens limited public-sector access to AI training datasets in defined exceptional circumstances. The cloud-switching regime forces hyperscale and other data-processing providers (including hosted AI inference services) to enable functional equivalence and data portability when customers switch providers.

The European Commission's Q&A on the Data Act and the European Data Innovation Board's emerging guidance flesh out the operative interpretation. National enforcement authorities began publishing supervisory expectations in late 2025.

Article 4 grants the user of a connected product access to "readily available data" generated by the product. Article 5 grants the user the right to require the data holder to make that data available to a third party of the user's choice. The "data holder" is typically the manufacturer or the entity that owns or controls the data generated by the product. The third party can be an AI vendor, an application developer or any other recipient the user designates.

For AI training data programmes, this changes the supply side. An AI vendor that previously had to negotiate exclusive bilateral deals with manufacturers to access fleet data (vehicles, industrial equipment, smart-building telemetry) can now, where the user designates the AI vendor as the recipient, receive the data directly. The data holder must comply within a reasonable period and on FRAND-like terms. Data sharing for the purposes of competing with the data holder's own product is restricted (Article 4(10) and Article 5(10)), but training a downstream AI service that does not compete with the connected product itself is not prohibited.

The practical effect: AI vendors should structure their commercial onboarding to make it easy for end-users to designate them as the third-party recipient. Manufacturers must build the technical interfaces and processes to handle Article 4 / 5 requests at scale. Both sides should document the criteria for "readily available data" and the FRAND terms applied [2].

Article 13 prohibits unfair contractual terms unilaterally imposed on a smaller party in a B2B data-sharing arrangement. Terms that exclude or limit liability for gross negligence, that allow unilateral access or use of the other party's data without notice, that let the imposing party determine compliance unilaterally, or that exclude termination rights without proportionate notice are deemed unfair as a matter of law. The Commission has published a model contractual term annex to support compliance.

For AI training data licensing, this matters in two directions. AI vendors licensing training data from smaller data holders cannot impose terms that, for example, grant unlimited reuse rights without the data holder's continuing oversight, or exclude liability for misuse of sensitive datasets. Conversely, AI vendors that are the smaller party (a startup licensing data from a large platform) gain a baseline of protection against unfair contractual practice. National courts can declare individual clauses void where they conflict with Article 13 [3].

Article 8 (general principles for data sharing) and the Article 9 compensation framework apply alongside Article 13. Compensation must be reasonable and may not be set so as to discourage exercise of the data-access rights.

Chapter VI imposes obligations on providers of data-processing services - explicitly defined to include IaaS, PaaS, SaaS and edge services. Hosted AI inference services, AI development platforms and managed AI infrastructure all fall in. The headline obligations are: (a) remove commercial, technical, contractual and organisational obstacles to switching; (b) reduce egress charges progressively to zero by January 2027; (c) maintain functional equivalence after switching for IaaS and equivalent services; (d) cooperate in good faith with the destination provider during the switching process; (e) make available a switching interface and the contractual right to retrieve all the customer's exportable data.

For AI customers, the practical effect is that hosted AI services are no longer locked-in by economic friction. Customers can move training data, fine-tuned model artefacts (where exportable), inference traffic and operational telemetry to alternative providers without facing prohibitive egress fees. The switching obligations explicitly cover dependencies on proprietary APIs, which historically have been the strongest lock-in mechanism for hosted AI inference. Providers are not forced to expose their proprietary training algorithms or model weights, but they are required to make customer data and customer-configured artefacts portable.

The compliance deadline structure is staged: switching obligations have applied since 12 September 2025, full elimination of egress charges is required by 12 January 2027 (Article 29). Providers have been adjusting commercial terms and technical interfaces through 2025 to comply.

The Data Act is horizontal: it applies regardless of whether the data is personal or non-personal. GDPR continues to apply where the data is personal data, and where the two regimes intersect, GDPR rights and protections apply on top. The Data Governance Act (Regulation 2022/868), in force since 2023, governs voluntary data-sharing intermediaries, data altruism and public-sector data reuse; the Data Act adds the mandatory access rights for IoT-generated data and the cloud-switching framework on top of the DGA's voluntary architecture.

For the EU AI Act, the connection is on training data. AI Act Article 10 imposes data-governance obligations on high-risk AI systems including data quality, bias examination and provenance documentation. Where training data is sourced under Data Act Articles 4-5, the AI provider must document the lineage from the data-holder through the user and into the training pipeline. AI Act Article 53 (general-purpose AI model providers) imposes a public summary of training data used; Data Act sourcing must be traceable in that summary at the level of detail the AI Office's template requires.

The Cyber Resilience Act and NIS2 layer additional obligations on the systems that generate, transmit and process the data. Mature AI training programmes treat the four regimes as one integrated data-supply governance programme rather than four parallel ones.

Impetora's TRACE methodology was built around AI systems that depend on auditable, contractually clean data supply, and the Data Act tightens exactly those expectations. Trust covers the contractual layer including Article 13-compliant data licensing, Articles 4-5 third-party recipient onboarding flows, and cloud-switching exit plans for hosted AI services. Readiness covers the data and workflow audit that becomes the input to the data-governance documentation required under both AI Act Article 10 and Data Act Articles 4-5 sourcing. Architecture covers production-grade design with portability hooks, clean data-lineage instrumentation and switching readiness baked in. Citations and Evidence covers the audit trail that supervisors and customers exercise.

The practical path for a Data Act-aware AI engagement: scope the data supply chain explicitly (which data is IoT-sourced, who is the data holder, who is the user, who is the third-party recipient), structure licensing contracts against the Article 13 fairness baseline, build the cloud-portability artefacts (model formats, data exports, switching runbooks) as part of the architecture rather than as an afterthought, and integrate the Data Act sourcing documentation into the AI Act technical documentation pack.