A forgotten provision in a European law regulating smart devices and cloud platforms goes into effect Friday, catching many US companies by surprise and threatening long-standing business models.
The European Union’s Data Act aims to expand data protection and access rights to non-personal information generated by Internet of Things devices like smart vacuums and coffee machines.
But the act also imposes new requirements on a range of cloud-related service providers like photo storage platforms and Software as a Service (SaaS) companies. To address unfair competition concerns in the European cloud market, the law requires such providers to make it easier for customers to switch platforms—regardless of contractual agreements—and to take their data with them.
The act’s broad scope creates legal, contractual, and technical challenges, publicly traded technology companies have warned in regulatory filings.
Electric vehicle manufacturer Cenntro Inc. in April said the act’s data access provisions would require a shift in the company’s “data management systems, contractual agreements, and security protocols.” SaaS provider Sprinklr Inc., entertainment technology company Xperi Inc., and business software provider Intapp Inc. also pointed to the act as an area of risk in filings with the US Securities and Exchange Commission, indicating it could impact their contractual arrangements.
Xperi and Cenntro didn’t reply to requests for comment. Sprinklr declined to comment.
The new requirements place an additional burden on subscription-based businesses—common among cloud-related providers—by impacting their ability to relay accurate revenue predictions to investors, technology attorneys said, spilling compliance concerns outside the legal department and into accounting teams.
“They’ve expressed that it’s going to be a change to their entire business model and they will really have to flip things upside down,” said Anna Hjortlund, Denmark-based associate at Bird & Bird, who has been advising global companies on compliance with the act.
Regulating Data
The EU Data Act seeks to give individual and enterprise customers in the bloc more control over their data. Companies building certain connected or smart devices will have to design and offer products that let users easily access information generated about them without “undue delay.”
Most of the act’s provisions, like making data readily and easily available to users, go into force on Friday, with some design and unfair contractual terms rules enforceable by EU officials in 2026 and 2027. Enforcement, including imposing financial penalties, is left up to individual EU member states.
The act is “a lot more complex than if you compare it to General Data Protection Regulation,” EU’s flagship privacy law, said Linzi Penman, head of DLA Piper’s Technology sector group in the UK. She added, “You’ve got sort of 10 questions before you get to a final verdict as to whether you’re in or out of scope, your product is in or out of scope, and what you have to do with your data.”
The law requires companies to revisit many of their contracts to ensure they reflect requirements to make data available to users and that contractual arrangements are fair, reasonable, and transparent.
Transforming data sharing from a choice to a legal obligation will create “unprecedented operational complexity and compliance risk,” said Heather Kuhn, senior privacy counsel at data governance software provider BigID.
“That exercise of trying to go through every contract that you have as a company is where the nightmare lies,” Kuhn said. She added, “How do I take that risk-based approach to say, ‘Okay, how am I making sure that I’m prioritizing the sensitive data the most, the biggest contracts—whatever it is—the most, because I want to honor the spirit of the law. But I also have 24 hours in the day.’”
Financial Fallout
The act’s framework also may challenge how companies measure their expected income.
The EU’s requirement for contracts that allow customers to switch providers with no more than two months’ notice conflicts with a common commercial business model SaaS companies use to lock down subscriptions and secure reliable annual recurring revenue, or ARR, Bird & Bird’s Hjortlund said.
If it becomes harder to measure the revenue providers expect to receive from recurring contracts, it could be increasingly difficult for companies to have predictable ARR. This forward-looking metric isn’t captured by US accounting rules, but publicly traded firms use it in their earnings release announcements to communicate growth to investors.
How providers may recover some of that money may in part depend on the fees they’ll be able to charge customers seeking to terminate their contracts.
Unlike many other data protection laws, the act requires in-house technical, legal, and financial teams to work together to manage their businesses’ vulnerability to contract terminations.
“Normally, as a lawyer, I’m just having conversations on the other side with clients of the legal department, and I see on the Data Act, we got the accountants joining the conversation,” said Patrick Van Eecke, Brussels-based partner at Cooley LLP.
The impact on providers depends on individual circumstances. Businesses worried about losing customers to rivals with similar offerings could be especially exposed to financial hits, Hjortlund said.
“We also don’t know that many companies that have actually implemented this already,” she said, adding, “Companies are definitely on a little bit of stand-by right now.”
To contact the reporters on this story:
To contact the editors responsible for this story: