EU Data Act from 12 September 2025: What changes for connected vending machines?

This article was created with AI assistance and checked automatically. A human review before publication is not documented.

The EU Data Act has applied generally since 12 September 2025. For vending operators, that does not mean every connected machine must expose every operational record, or that every operator can automatically send data to any supplier. The rules concern readily available raw and pre-processed data generated by using a connected product or related service, together with relevant metadata. Inferred or derived data and content are outside that category. A person or business that owns, rents, or leases a connected product may have access rights and may ask the data holder to share covered data with a third party of their choice, subject to legal limits and data-protection rules. Data holders must provide access directly or indirectly; the German regulator describes it as free of charge and, where relevant and technically feasible, continuous and in real time. Whether those provisions cover a particular vending machine, telemetry feed, or supplier relationship depends on the facts. Article 3(1)’s product-design duty applies to connected products and related services placed on the market after 12 September 2026.

What does the EU Data Act cover?

The Data Act is an EU regulation establishing rules for access to and use of data. Its general application date is 12 September 2025, although individual provisions have different application dates. For vending businesses, the main point is to identify what data a connected product or related service generates through use, and whether that data is readily available to the data holder.

Chapter II addresses readily available raw and pre-processed data generated through the use of a connected product or related service, including relevant metadata. Raw data is data in its collected form; pre-processed data has undergone processing needed to make it usable, without turning it into an inference about what the data means. The European Commission’s Data Act guidance distinguishes those categories from inferred or derived data and content, which are excluded from this Chapter II category.

That distinction matters when a machine reports information about its operation. A recorded event or measurement may be different in legal character from an analysis that predicts future demand or draws a conclusion from multiple records. The fact that a vending system produces a dashboard or a supplier offers remote monitoring does not, by itself, establish that every displayed item is covered data. The product, the data and how it is generated all matter.

The Act also does not make vending machines a special category with a single, automatic answer. Its general rules may apply to a vending machine if that machine meets the legal definition of a connected product, but the cited official guidance does not determine whether a particular model or telemetry module qualifies. Operators should use the regulation and official guidance to frame the assessment, then check the actual machine and service arrangement.

Who can access data from a connected vending machine?

The Act’s user concept includes people and businesses that own, rent, or lease connected products. That means a vending operator may have relevant rights when it owns a connected machine, and a renter or lessee may also qualify as a user. The precise outcome still depends on whether the particular machine is a connected product, which data is covered, and the contractual and legal context.

For covered product and related-service data, users may access the data and may ask the data holder to share it with a third party of their choice. A vending operator could, for example, want a chosen service provider to receive relevant machine data. That example illustrates the type of request the rules address; it does not establish that a specific telemetry field is covered or that a particular supplier must receive it in every circumstance.

The European Commission’s guidance and the Bundesnetzagentur’s explanation of data access and use both describe access and third-party sharing within the Data Act’s limits. Those limits matter. Rights under the Act do not override applicable data-protection rules, and the Act does not mean that a user can demand any data held by any company simply because a machine is connected.

The roles of the parties also need to be established. The operator, machine supplier, connectivity provider and service provider may be involved in different ways, but their labels alone do not answer who is the user or data holder for a given data set. Review the relevant agreements and identify who controls or holds the covered data before making a request or promising access to a third party.

What must data holders provide?

AI MODIFIED

Data holders must make covered product and related-service data accessible to users, either directly or indirectly. Direct access could mean that the user can retrieve the data through a mechanism made available for that purpose. Indirect access means the data is made accessible through another route. The exact method depends on the product and arrangement; the official summaries do not prescribe one vending-machine interface or a universal export format.

The Bundesnetzagentur describes access as free of charge and, where relevant and technically feasible, continuous and in real time. Those conditions should be read together. Continuous, real-time access is not an unconditional promise for every data item or every machine. Whether it is relevant and technically feasible depends on the case, and the information must first qualify as data covered by the Act.

For operators, it is useful to separate a request for access from assumptions about a vendor’s existing portal. A portal may show selected information without showing all covered data. Conversely, the presence of a paid service contract does not by itself establish what must be provided under the Data Act. The data, the product and related service, the parties’ roles, and the applicable limits all need to be assessed.

A practical request should describe the connected product or service and the data sought, and should state whether access is requested for the user or sharing with a chosen third party. The request should be grounded in the actual machine and contract rather than a generic demand for “all telemetry.” The EU regulation is the primary source for the legal obligations; official guidance helps explain their application but does not resolve every product-specific question.

What should vending operators check now?

Start with the equipment and services actually deployed. Record which machines are connected, what related services are used, and which party provides each service. Then identify the data generated through use and distinguish recorded or pre-processed data from inferences, derived outputs and content. Do not treat a supplier’s description of a feature as a legal determination that the feature’s data is covered.

Next, review contracts with the machine supplier, telemetry provider and other relevant parties. Note who is described as the user, who holds the data, what access routes are available, and how a third-party sharing request would be handled. Check whether existing system access provides the data needed for operations, while keeping that operational question separate from the legal question of which data the Act covers. For a specific machine or data feed, the answer cannot be inferred from the fact that it connects to a network.

The timing of the product-design rule is also distinct from the general application date. Article 3(1) applies to connected products and related services placed on the market after 12 September 2026. It is not the general start date of the whole Act, which is 12 September 2025. Other provisions have their own application dates, so operators should not use the design deadline as a substitute for checking the rules that already apply.

Finally, account for data protection. Data access and sharing under the Data Act remain subject to applicable data-protection law. Before sending machine data to a third party, determine whether personal data is involved and whether the proposed handling is permitted. The official sources establish the general framework, but do not decide whether a given vending model, payment terminal, telemetry module or operator-vendor arrangement falls within it. For those questions, assess the actual product, data and contracts.

Conclusion

Since 12 September 2025, the Data Act’s general rules have applied, including rules that can give users access to covered data from connected products and related services. For vending operators, the key is to establish whether the specific machine meets the connected-product definition, which readily available raw or pre-processed data is involved, and which party holds it. Users who own, rent or lease connected products may also ask for covered data to be shared with a third party of their choice, subject to legal limits.

Access may be direct or indirect. The Bundesnetzagentur describes it as free of charge and, where relevant and technically feasible, continuous and in real time. Those conditions do not settle every technical or contractual question for a particular machine. Article 3(1)’s design obligation has a later date: it applies to connected products and related services placed on the market after 12 September 2026. Data-protection law continues to apply as well.

Operators can make the rules actionable by listing connected machines and services, identifying data flows and contractual roles, and preparing specific access or sharing requests. A model-specific conclusion requires checking the actual device, data and agreements against the regulation.