BRUSSELS—10 July 2026—Who: SaaS vendors and buyers across Europe (and global vendors selling into the EU). What: an operational update on the EU Data Act after five months of market activity. When: July 2026. Where: the EU regulatory perimeter but with global supply-chain effects. Why: procurement, risk, and product teams are converting legal obligations into product features and commercial guardrails — fast. This article explains exactly what teams should have done yesterday and what to prioritize this month.

Why this still matters — and what’s new since February

The Data Act (applicable from 2 February 2026) strengthens user access, portability and limits on contractual lock‑in for data generated by connected products and related services. That objective hasn’t changed. What has changed between February and July 2026 is practical: purchasers now expect demonstrated exports during procurement, engineering teams are shipping machine‑readable egress flows into production, and security teams are treating exports as high‑risk endpoints rather than one-off file dumps.

Think of it as moving from drawing evacuation routes on paper to installing functioning emergency doors and doing weekly fire drills: buyers want the doors to open, and internal auditors want the logs to show the drills happened.

Concrete market signals — what teams are actually shipping

  • Procurement checklist maturity: buyers routinely require an export sample, signed attestation of multi‑tenant isolation, and an itemized egress cost schedule in RFPs.
  • Product rollouts: export APIs with resumable transfers, manifests and checksums are increasingly standard; vendors use S3‑compatible endpoints, Azure SAS tokens or signed HTTPS URLs for delivery.
  • Security hardening: teams mandate short‑lived delegated credentials, strict rate limits, manifest signing via hardware security modules (HSMs), and full audit trails retained for incident investigation.
  • Commercial transparency: basic exit SLAs are now listed on many vendors’ trust pages rather than hidden in MSAs.

Updated technical and contractual patterns that work (July 2026)

From current product work I’ve seen and reviewed, these patterns have become practical defaults:

  • Machine‑readable exports as a product feature: provide event streams in NDJSON/JSONL and rowsets in Parquet or CSV, with accompanying schema files (OpenAPI, Avro, or Protobuf) and sample payloads.
  • API‑driven bulk export: resumable, chunked transfers with a manifest.json listing files, object checksums, record counts and a signed statement of dataset completeness.
  • Delegated, auditable authorization: OAuth 2.0 with explicit scopes (or mutual TLS for high‑risk flows), short token lifetime (minutes to hours), and revocation endpoints; consider DPoP (Proof of Possession) where man‑in‑the‑middle risk is material.
  • Trade‑secret attestation: when withholding diagnostics, supply a signed attestation listing withheld items, a legal basis for withholding, and a technical redaction map so buyers can validate what they received.
  • Exit SLAs and pricing transparency: publish baseline windows (common market practice in July 2026 is 14–60 days for routine exports, with 30–90 days for large or complex migrations) and an itemized professional‑services rate card for bespoke transfers.

Actionable checklist — what your teams should do now

Product & engineering

  • Complete a data‑scope inventory: map device logs, telemetry, derived analytics, storage locations, retention and current export paths. Make this inventory queryable by product, legal and sales.
  • Ship a minimal export flow: a documented API that can produce a machine‑readable sample within 24–72 hours of request; include manifest, checksums and a schema file.
  • Automate tests for isolation: CI tests that generate exports for multiple tenants simultaneously and assert no cross‑tenant leakage.
  • Provide SDKs and examples: include a simple CLI and reference code for common destinations: S3, Azure Blob, Google Cloud Storage, and direct HTTPS pull.

Security & operations

  • Treat exports as an external attack vector: include export endpoints in CI/CD scans, fuzzing and red‑team playbooks.
  • Use ephemeral credentials and HSM signing: sign manifests with HSM‑backed keys and issue short‑lived access credentials; log delegation approvals with tamper‑evident timestamps.
  • Retention for audit trails: retain export logs and attestations for a forensically useful period — industry practice now leans toward 12–24 months depending on sector risk.

Legal & commercial

  • Update MSAs and SOWs: add explicit export, migration assistance and cost transparency clauses; avoid one‑sided restrictions that won't survive procurement review.
  • Publish an exit plan: make it visible on your trust center with downloadable sample exports and a clear contact and escalation path.
  • Define third‑party onboarding: document how you validate authorised third parties, what NDAs or technical controls apply, and the vetting timeline.

Security vs. trade secrets — operational governance

The Data Act permits withholding trade secrets and security‑sensitive outputs, but that protection must be demonstrable. Practical controls gaining traction include redaction maps, signed withholding attestations, and contractual NDAs combined with time‑limited technical access. The rule of thumb: if you must withhold, prove why and show exactly what you withheld.

Impact: who needs to move fastest

IoT‑adjacent SaaS (fleet telematics, energy management, industrial monitoring), observability platforms, and any vendor that aggregates or transforms device data should prioritize exports. Smaller vendors selling into EU enterprises are feeling procurement pressure first: not providing a sample export is increasingly a disqualifier in mid‑market RFPs.

Reactions and practical signals from the market

Across sales cycles I’m tracking, buyers expect demonstrable exports as part of due diligence and push for transparent pricing for egress. Legal teams are inserting migration provisions and sample export acceptance criteria into MSAs. Regulators haven’t shifted enforcement posture dramatically since February, but the European Commission’s earlier signals that supporting material would follow are still being watched closely by compliance teams.

What to watch next (timeline to end‑2026)

  • Through Q3 2026: expect procurement scorecards to make Data Act readiness a pass/fail filter for many mid‑market and enterprise deals.
  • Q4 2026: anticipate industry groups and standard bodies to publish more sample clauses and schema templates — adopt common schemas early to reduce rework.
  • Late‑2026/2027: early commercial disputes over export costs and withheld items will set practical precedents; capture your export audit trail now to support your commercial position.

Who this is for

If you run product, security, legal or procurement at a SaaS company that touches device or operational data, this is urgent. Buyers should require a sample export, clear migration SLAs and an itemized egress cost. Security and ops should treat exports like new regulated endpoints: log, monitor and retain auditable evidence for any decision to withhold data.

FAQ

Do I need to expose raw telemetry if customers ask for it?

No — the Data Act allows legitimate protection of trade secrets and security‑sensitive material. Provide documented, machine‑readable exports of operational data where appropriate, and when withholding is necessary, publish a signed attestation and a redaction map so the customer understands what was withheld and why.

What export formats and delivery mechanisms should I support?

Support NDJSON/JSONL for event streams and Parquet or CSV for tabular datasets; provide schema files (OpenAPI, Avro or Protobuf), manifest/checksum files, and standard delivery options (S3‑compatible endpoints, Azure SAS, Google Cloud Storage, or signed HTTPS URLs).

How long should migration assistance last?

There’s no single rule; market practice in July 2026 ranges from 14 to 90 days depending on dataset size and complexity. Publish baseline windows (e.g., 14 days for routine exports, 30–60 for mid‑sized customers) and an itemized pricing schedule for bespoke migrations.

If exported data contains personal data, what then?

GDPR still applies. Ensure lawfulness, purpose limitation and appropriate safeguards — conduct a Data Protection Impact Assessment (DPIA) where necessary, pseudonymize where possible, and confirm lawful transfer mechanisms for cross‑border exports.

What’s the fastest way to be Data Act ready today?

Inventory your datasets, ship a minimal export API that can produce a signed sample export within 24–72 hours, and publish a simple exit plan on your trust page. Those three moves address most procurement and legal pain points immediately.

— Alex Rivera, Technology Editor