What the EU's Next Big Tech Act Means for Silicon Valley

24 October 2026

The European Union has spent the past several years turning itself into the world's most aggressive tech regulator. The Digital Markets Act forced gatekeepers to open their platforms. The Digital Services Act rewrote the rules for content moderation and platform liability. The AI Act created the first comprehensive legal framework for artificial intelligence. Now Brussels is moving into territory that strikes at something even more fundamental to how Silicon Valley operates: the flow of data itself.

The next major piece of legislation in this pipeline is the Data Act, formally Regulation (EU) 2023/2854. It entered into force in January 2024 and becomes broadly applicable in September 2025. It is not a niche privacy rule or a narrow antitrust tweak. It is a structural intervention into who can access, share, and monetize data generated by connected products and digital services. For American tech companies, it may prove more consequential than the GDPR, because it targets the economic logic of data accumulation rather than just the handling of personal information.

This article breaks down what the Data Act actually does, why it exists, where it will bite hardest for Silicon Valley firms, and how engineering, legal, and product teams should be preparing now rather than after enforcement begins.

The Short Version: What the Data Act Actually Does

The Data Act establishes rules on fair access to and use of data. Its core provisions cover several distinct areas, and it helps to separate them because they hit different parts of a business.

First, it grants users of connected products the right to access data generated by those products and to share that data with third parties of their choosing. If you buy a connected car, a smart thermostat, or an industrial sensor, the manufacturer cannot lock the data inside its own cloud and call it a day. The user gets a right to retrieve it and to direct it elsewhere.

Second, it imposes obligations on data holders to make data available to other businesses under fair, reasonable, and non-discriminatory terms, particularly where those recipients need the data to provide services the user has requested. This is aimed squarely at the practice of hoarding machine-generated data as a competitive moat.

Third, it contains provisions on cloud switching. Customers must be able to move their data and workloads between cloud providers without being held hostage by egress fees, proprietary formats, or contractual lock-in. The regulation sets expectations for switching support and phases out certain switching charges.

Fourth, it creates safeguards against unlawful international government access to non-personal data held in the EU, a provision that directly affects how American cloud providers respond to requests from US authorities.

Fifth, it includes rules on interoperability for data processing services and measures to make data more available for public sector bodies in exceptional circumstances, such as emergencies.

These are separate obligations with separate timelines and separate compliance owners. Treating the Data Act as a single checkbox is one of the most common mistakes companies make. The cloud switching rules, for example, are an infrastructure and contracts problem, while the connected product access rules are a product design and API problem. They require different teams.

Why Brussels Did This

The Data Act did not appear out of nowhere. It sits on a specific diagnosis of the European data economy: Europe produces enormous volumes of industrial and consumer data, but much of it sits trapped inside platforms built by a small number of non-European firms. The European Commission's stated goal is to unlock that data for reuse, drive innovation, and reduce dependency on dominant providers.

There is a coherent logic here. If a manufacturer of connected industrial equipment controls all the telemetry from its machines, independent maintenance providers cannot compete, insurers cannot price risk accurately, and the manufacturer can entrench itself. The Data Act tries to break that dynamic by giving the user, not the manufacturer, control over the data. Whether you agree with the policy or not, the reasoning is internally consistent, and it explains why the rules are drafted the way they are. They are not primarily about privacy. They are about market structure.

This distinction matters for Silicon Valley. Companies that have built their compliance programs around GDPR often assume the Data Act is "GDPR for machine data." It is not. The Data Act is closer to an interoperability and competition statute. A company can be fully GDPR compliant and still violate the Data Act, and vice versa.

Where It Hits Silicon Valley Hardest

Connected Products and the IoT Backbone

Any company selling connected hardware into the EU, or selling software embedded in such hardware, faces the user access and sharing obligations. That includes consumer wearables, smart home devices, connected vehicles, medical devices, and industrial equipment. The obligation is not limited to European firms. It applies to any manufacturer placing such products on the EU market, regardless of where the company is headquartered.

The practical consequence is that product teams need to design for data portability from the start. That means documented data models, accessible APIs, and a clear separation between data the user is entitled to and data that is genuinely proprietary. The temptation will be to interpret "data generated by the product" as narrowly as possible. Regulators have already signaled they will scrutinize that interpretation. Overly narrow readings are a compliance risk, not a smart workaround.

Cloud Providers and the Switching Problem

For hyperscalers, the cloud switching provisions are the sharpest edge. The Data Act requires providers to support customers who want to move to another provider, to provide the necessary information and assistance, and to do so within defined timeframes. It also addresses switching charges, with a phased reduction of certain fees.

This is where the economics get uncomfortable. Egress fees and proprietary services have been a meaningful part of cloud lock-in. Reducing them is not just a pricing change; it changes the competitive dynamics of the entire cloud market. Providers that built their strategy around deep integration and high switching costs will need to rethink how they retain customers. The winners may be providers that compete on service quality and price rather than on the difficulty of leaving.

Data Sharing Between Businesses

The business-to-business data sharing obligations are subtler but potentially broad. Where a data holder is obliged to make data available to a recipient, the terms must be fair, reasonable, and non-discriminatory. This creates room for disputes about what "fair" means, and it means contracts and pricing models for data access will come under scrutiny. Companies that currently treat data access as a bespoke commercial negotiation should expect more standardized expectations and more regulatory attention to terms that look exploitative.

International Government Access

The provisions on international access to non-personal data are a direct response to concerns about foreign surveillance and legal overreach. For US cloud providers, this creates a genuine tension between US legal obligations and EU requirements. The resolution is not obvious and will likely require careful legal structuring, transparency reports, and challenge procedures. Companies should not assume this is a problem for their lawyers alone; it affects architecture, data residency, and customer trust conversations.

Common Misconceptions Worth Correcting

Several myths have taken hold that can lead teams astray.

The first is that the Data Act only applies to personal data. It does not. Much of its focus is on non-personal and mixed datasets. Privacy teams alone cannot own compliance.

The second is that it only affects EU companies. It applies based on market placement and service provision, not headquarters. A US company selling connected devices in the EU is in scope.

The third is that compliance is a one-time project. The obligations are ongoing, and enforcement will evolve. Companies that treat this as a 2025 deadline and then move on will be exposed as regulators clarify expectations.

The fourth is that the Data Act and the DMA are the same thing. They overlap in spirit but differ in mechanism. The DMA targets designated gatekeepers with specific behavioral obligations. The Data Act applies broadly to data holders and service providers. A company can be outside the DMA's gatekeeper list and still be fully subject to the Data Act.

Practical Preparation: What to Do Now

Start with a data mapping exercise that goes beyond personal data. Identify what data your connected products generate, where it lives, who can access it, and under what contractual terms. Most companies discover that their data architecture was never designed with external sharing in mind, and that retrofitting is harder than building it in.

Then separate your compliance workstreams. Assign clear ownership for connected product access, cloud switching, B2B data sharing, and international access. These are different problems with different stakeholders. A single "Data Act program" run by legal alone will miss the engineering and commercial dimensions.

On the product side, invest in documented, stable APIs for user data access. Design for export from day one. Treat data portability as a feature, not a burden. Companies that do this well can turn compliance into a trust differentiator, especially with enterprise customers who are themselves worried about lock-in.

On the cloud side, audit your switching costs honestly. Model what it would cost a customer to leave, including egress, migration effort, and re-architecture. If the answer is "prohibitively expensive," you have a compliance and competitive risk. Reducing friction may hurt short-term retention but builds long-term credibility.

On contracts, review data access terms for fairness and non-discrimination. Standardize where possible. Ad hoc terms that vary wildly between customers are exactly what regulators will probe.

Finally, build a monitoring capability. The Data Act's implementing acts and guidance will continue to shape interpretation. Companies that track regulatory developments and adjust early will avoid the scramble that followed GDPR.

Trade-offs and Nuanced Decisions

Compliance is rarely free, and the Data Act forces real trade-offs. Opening data access can erode competitive advantage. Supporting cloud switching can reduce lock-in revenue. Standardizing contracts can limit pricing flexibility. These are genuine costs, and pretending otherwise is not useful.

The better framing is to ask which forms of lock-in are defensible and which are fragile. Lock-in based on genuine technical superiority and excellent service tends to survive regulatory pressure. Lock-in based on friction, proprietary formats, and punitive exit fees is exactly what the Data Act targets, and it is also increasingly unpopular with enterprise buyers. Companies that shift their moat toward quality and integration depth, rather than exit costs, are likely to fare better both legally and commercially.

There is also a legitimate debate about how broadly to interpret "data generated by a product." A cautious approach reduces regulatory risk but may require sharing more than some firms would like. An aggressive approach preserves more proprietary ground but invites enforcement. The right answer depends on your risk tolerance, your market position, and how visible you are to regulators. There is no universal rule, and companies should make this decision deliberately rather than by default.

What This Means in the Longer Arc

The Data Act is best understood as part of a pattern, not an isolated event. Brussels has decided that the concentration of data and platform power is a policy problem, and it is using regulation to reshape market structure. The DMA, DSA, AI Act, and Data Act are different tools aimed at related goals. Silicon Valley firms should expect more, not less, and should build regulatory adaptability into their operating model.

The companies that will do best are those that stop treating EU regulation as a tax to be minimized and start treating it as a design constraint that shapes product and business strategy. That shift is uncomfortable, but it is also where durable advantage comes from. A company that can offer genuine portability, fair data access, and easy switching builds trust that regulators and enterprise customers both value.

The deadline is close enough that waiting is no longer a strategy. The work is substantial, but it is tractable if teams start now, separate the workstreams, and treat compliance as an engineering and commercial problem rather than a legal formality.