Turn machine telemetry into a Data Act-ready customer API

It applies where the connected product's user is located in the EU at the time of the request, regardless of where the manufacturer is established. An EU-based factory operating a machine built outside the EU can still exercise Chapter II rights against the manufacturer or its EU-established data holder. Track user location, not manufacturing origin, when deciding whether a request is in scope.

No. Chapter II covers product and related-service data generated by use — production counts, runtime, alarms, energy consumption and comparable operational records — not the control software, firmware or source code that produces it. Ladder logic, ML model weights and proprietary control algorithms are not the readily available data the Act targets, though they may separately be protected as trade secrets if a request ever brushes against them.

Only through the Act's structured trade-secret process, not as a blanket refusal. Identify the specific fields that would reveal protected know-how, propose proportionate confidentiality measures for the recipient, and document the decision. A dataset can mix protected and non-protected fields — separate them rather than denying the whole request because one derived metric is sensitive.

They are separate obligations that will often share the same telemetry pipeline. The Machinery Regulation governs safety instructions, including a digital-format option, for machinery placed on the market from 20 January 2027. The Data Act governs who can access the operational data the machine generates once it's running. A machine's connectivity architecture should account for both rather than treating one as a substitute for the other.

The Data Act extends the access right to users, including renters and lessees for the duration of a rental or leasing agreement, not only to the registered owner. A leasing arrangement needs an entitlement model that resolves overlapping claims between the leasing company and the operating business, with a clear end-of-lease handoff so access doesn't silently persist or silently vanish.

Potentially, yes, separately from the Data Act. If the machine or its remote-monitoring component is itself a product with digital elements under the Cyber Resilience Act, exposing a new external API is a security-relevant architecture change that should go through the same vulnerability-handling and secure-development expectations as the rest of the connected product, not be treated as pure data-access plumbing.