Time’s Up: Why Small Non-EU Businesses Must Act Now on the EU Data Act

The time for waiting is gone. On September 12, 2025, the European Union’s Data Act began to take effect. For the past few weeks I have been creating articles to help small businesses prepare for what was coming. I wanted to give them a head start before the deadlines arrived. Now that day has passed. The law is here. It does not only apply to large companies. It does not make exceptions for small firms outside of Europe. If you sell connected devices, run a cloud service, or rely on data-driven platforms that reach into the EU market, you are included. The clock has already run out, and there is no space left for delay.

When the GDPR came into force in 2018, many small and mid-sized businesses believed it was only a problem for big technology companies. I saw many of them ignore the changes. Later they faced fines, lost clients, and damage to their reputation. The EU Data Act carries a similar weight, but it is focused on a different problem. GDPR was about the privacy of personal data. The Data Act is about control of the data that devices and platforms generate. The law says the user has that control, not only the company that made the product or service.

For cloud providers outside of Europe, the impact is serious. Customers inside the EU must be able to move their data or their workloads to another provider. They must be able to do so without delay and without paying heavy exit fees. I know many providers who build their revenue model around lock-in. They use hidden systems, proprietary formats, and high data transfer costs to keep customers from leaving. That era is ending in Europe. Providers will now need to be transparent about where data is stored, how it can be moved, and what technical barriers exist.

This change will not stop at Europe’s borders. Once customers in the EU experience true portability and clear contracts, they will begin to demand the same in the United States or in Asia. I have seen it happen before. When new standards are established in one part of the world, the market often adopts them everywhere. That is why non-EU providers cannot treat this as a local issue.

The same pressure applies to manufacturers of connected devices. If you sell a smart car, a wearable device, a farm sensor, or an industrial robot into the EU, you must now allow users direct access to the data those devices create. The law requires that this access be secure and built into the product design. By September 2026, any new device sold in Europe must meet this standard. That means companies outside the EU will need to redesign firmware, cloud dashboards, or even hardware so that data is accessible by default.

Industrial systems face another challenge. European business customers will have the right to request access to the data produced by these machines. The law says this access must be given on fair and reasonable terms. That means charging high subscription fees just to unlock machine data will no longer be possible. I have spoken with smaller providers who depend on this model. They are now being forced to rethink how they charge for services in Europe.

There is also the problem of contracts. Many companies rely on standard agreements filled with one-sided terms. They limit liability, restrict access, or prevent data from being shared. Under the new law these terms are invalid. Non-EU firms who do business in Europe will need to prepare new contracts that can survive legal review.

I know some small companies hope that regulators will focus only on big players. That is a dangerous hope. The Data Act makes no distinction between size or geography. If your products or services touch the EU market, you must comply. The penalties can be severe. Companies can lose access to the European market entirely. They can be drawn into disputes with clients. They can see their brand destroyed when customers learn they cannot control the data they generate.

I also know that compliance takes time and resources. Large firms can assign teams of lawyers and engineers to the problem. Smaller firms cannot. But ignoring the issue is worse. Once competitors demonstrate compliance, customers will abandon those who are unprepared. Being late will look like being careless, and no client wants to depend on a careless partner.

The EU Data Act is no longer a proposal. It is the law. Enforcement has already begun, and new design rules arrive next year. I believe the companies that act now will not only survive but may also find new opportunities. Those that delay will discover that the time they thought they had is gone. In Europe, time’s up.