EU Data Act + AI: Luxembourg's 2026 Reset

Quick answer: The EU Data Act (Regulation 2023/2854), applicable since 12 September 2025, is not just an IoT rule — it hits AI in four places: users gain rights over the connected-product data feeding your models, they can compel sharing of that raw data with third parties (including competitors), cloud providers must enable switching with charges falling to zero in January 2027, and unfair data-use clauses imposed on smaller B2B parties become unenforceable. Luxembourg companies should re-read their AI vendor contracts and document their data flows before the next obligation wave lands on 12 September 2026, when the access-by-design duty starts applying to newly placed connected products.

The EU Data Act (Regulation 2023/2854) became applicable on 12 September 2025. By the time you read this, it has been live for over seven months. Most Luxembourg companies — even ones with otherwise mature AI programmes — are still classifying it in their compliance register as "an IoT regulation" or "a connected-products thing" and ignoring its AI implications. That is the wrong mental model, and it gets more expensive every month.

This guide explains where the Data Act actually touches AI in a Luxembourg company in 2026, where it overlaps the AI Act and DORA, and what specific paperwork you need before 12 September 2026 — the date from which Article 3(1), the obligation to design connected products and related services so that the data they generate is directly accessible to the user, applies to products placed on the market after that day (Article 50). The B2B contract-fairness rules of Chapter IV, by contrast, have applied to contracts concluded since 12 September 2025; for indefinite-duration contracts concluded before that date, the unfair-terms test in Article 13 starts biting on 12 September 2027.

Unsure how Data Act readiness applies to your systems? Book a free 30-minute assessment — no sales pitch, just a plain-language read on your exposure.

What the Data Act actually does (the AI-relevant parts)

The Data Act is doing four things at once, and the AI-relevant ones are easy to lose in the IoT-product framing:

1. Data access rights for users of connected products. Anyone using a connected product (industrial sensor, vehicle, building system, even an enterprise SaaS that meets the definition) can demand the data generated by their use of it, in real time, in a usable format. Why this is an AI question: if your AI system is trained on or fed by the data from a connected product or service, the user of that product may have rights over the inputs to your model. You owe a clear statement of what data you ingest, why, and how to extract or delete it.

2. Mandatory data-sharing on request, including with third parties the user nominates. A user can require the data holder to share their data with a third party of their choice — including a competitor. Why this is an AI question: models trained exclusively on data your customers can compel you to share with their next vendor are not the moat you thought they were. The Data Act doesn't force model sharing — it forces raw data sharing — but it changes the strategic calculus on data-as-moat.

3. Switching and interoperability obligations on cloud and edge providers. Cloud providers must enable customer switching with reduced switching charges (which fall to zero in January 2027) and provide functional equivalence. Why this is an AI question: if your AI is hosted in a hyperscaler's managed model service, the Data Act now backs you up when you negotiate egress fees and contractual lock-in, but it also means you owe your customers the same flexibility on data they store with you.

4. B2B contract rebalancing. Unfair terms in B2B data-sharing contracts unilaterally imposed on smaller parties are now unenforceable. Why this is an AI question: the standard "we may use your data to improve our services" clause in a lot of AI vendor contracts is now squarely in scope, especially when imposed on a Luxembourg SME by a much larger US AI vendor. Re-read your AI vendor contracts.

Where the Data Act, the AI Act, and DORA overlap

For Luxembourg companies — particularly the financial firms already deep into the DORA × AI Act sequencing — the Data Act adds a third regulatory lens onto the same underlying systems. The good news is that the overlaps are real and you can build the controls once.

Concern	EU AI Act	EU Data Act	DORA
Data inventory	High-risk AI: data sources catalogue required (obligations from 2 Dec 2027)	Connected-product data catalogue required	ICT register includes data flows
Third-party access	Provider/deployer documentation	User-driven sharing, including competitors	ICT third-party register, exit-tested
Contractual hygiene	AI-Act-aware vendor terms	Data-Act-aware data-sharing terms	DORA-aware ICT contracts
User transparency	Art. 50 notice on AI interaction (since 2 Aug 2026)	Notice on data generated/captured	Indirect (via incident reporting)
Cross-border flow	National market surveillance	EU-wide, with safeguards on non-EU access	EU-wide for ICT TPP

A Luxembourg bank, fund administrator, or insurer that has built a unified ICT-and-AI register for DORA + AI Act now extends the same register with two columns — Data Act in-scope? and user data-access rights triggered? — rather than starting a third workstream from scratch. The discipline is identical to what we recommended for DORA × AI Act sequencing; the third regulation slots into the same operating cadence.

Not sure which obligations are yours? Book a free 30-min call and we'll map Data Act readiness to your systems in one conversation.

The five specific things to fix before September 2026

If you read only one section of this article, this is it. Five concrete to-dos for a Luxembourg company with an AI footprint in mid-2026:

1. Re-read every AI vendor contract for data-use clauses. Specifically: what does the vendor do with your inputs and outputs? Is there a no-training-on-customer-data clause? Is there a data-deletion guarantee on contract termination? Anything imposed unilaterally that lets the vendor reuse your data may now be unenforceable under the Data Act's B2B fairness regime — and that is leverage you should use in the next renewal, not just a defensive shield.

2. Document the data sources flowing into your AI systems. For each AI system in production, list: where the input data comes from (internal systems, customers, connected products, third parties), the legal basis under GDPR, and whether the Data Act gives an external party (a customer, a competitor at the customer's instruction) the right to extract that data. This document also satisfies a chunk of the AI Act's high-risk technical-file obligations.

3. Decide and document your switching posture. If you provide a SaaS or cloud-adjacent service to other Luxembourg businesses, you owe documented switching support and functional-equivalence guidance. From January 2027, you cannot charge switching-out fees. Plan the egress paths now and put them in your customer contracts as a feature, not a concession.

4. Check your data-sharing chain for unintended non-EU access. The Data Act has explicit provisions on third-country access that override what an extra-EU government might demand. If your AI stack passes data to a non-EU sub-processor (most US-headquartered AI vendors do this somewhere in the chain), confirm in writing how the vendor handles non-EU government data requests. This is now a standard CSSF and CNPD question.

5. Update your DPIA and AI risk-assessment templates. Add Data Act sections — connected-product data inputs, third-party sharing rights, switching commitments — to the templates you already use for GDPR and AI Act compliance. The AI Act side of that template got more breathing room in July 2026: the Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk obligations for stand-alone Annex III systems to 2 December 2027, while leaving the Article 50 transparency duties applicable from 2 August 2026. Single-template-three-regulations is a force multiplier; three parallel templates triple the cost.

What this means for AI strategy specifically

Two strategic implications for Luxembourg companies that often go unsaid:

• Data-as-moat narratives are weaker than they look. If your AI advantage depends on customer-generated data that customers can now compel you to share, the moat is more about the integration, the workflow, and the operating model than the raw data itself. Plan the rest of the moat. See why data quality determines 80% of AI outcomes for the workflow-quality side of the argument.
• Cloud lock-in is genuinely shrinking. If you have been holding off on a more ambitious AI deployment because of hyperscaler lock-in fears, the Data Act materially changes the negotiation. Egress costs are falling to zero, functional-equivalence guidance is mandatory, and the Luxembourg-hosted alternatives (LuxConnect, Proximus, on-prem on the private-deployment patterns we use) are more competitive than they were a year ago.

Where 20 More fits in

We deploy AI for Luxembourg companies with the Data Act + AI Act + DORA + GDPR documentation produced as a single workstream, not four. For firms whose AI vendor contracts haven't been reviewed since 2024, we run a 2-week vendor-contract sweep that often pays for itself in the first renegotiated agreement.

If you'd like a frank read on whether your current AI footprint is Data-Act-clean before the September 2026 anniversary, book a free 30-minute consultation. We will walk your contracts and your data inventory and tell you honestly where the gaps are.

Related reading:

• EU AI Act compliance timeline: the Luxembourg checklist
• DORA meets the EU AI Act: Luxembourg financial compliance sequencing
• GDPR-compliant AI for Luxembourg SMEs
• Why data quality determines 80% of AI outcomes
• Private AI deployment for Luxembourg's regulated industries
• AI Knowledge Hub — 20 More Resources