TLDR<\/strong> The EU Data Act (officially Regulation (EU) 2023\/2854) is European Commission legislation designed to ensure that data \u2014 especially data generated by IoT devices, cloud services and industrial systems \u2014 can be used fairly and in a user-centric way.<\/p>\n The regulation was published in the Official Journal in December 2023, entered into force in January 2024, and its transition period ends on September 12, 2025. In practice, 2026 is the first year when requirements are fully enforceable.<\/p>\n Who does the law apply to?<\/strong><\/p>\n What does the law actually require?<\/strong><\/p>\n Three core requirements for SMEs:<\/p>\n Source: European Commission, Data Act implementation documentation: digital-strategy.ec.europa.eu<\/a><\/p>\n Having reviewed system setups with hundreds of SMEs, these three problems come up repeatedly:<\/p>\n A typical SaaS contract includes a clause saying data will be exported upon termination “within a reasonable time” or “upon request.” What does this mean in practice? Often: 30\u201390 days, a \u20ac500\u2013\u20ac2,000 export fee, and data delivered in a format a competitor can’t easily read.<\/p>\n The Data Act changes this situation. Data export must be possible in real-time or within an agreed reasonable timeframe, at reasonable cost, and in a machine-readable standard format (JSON, CSV, XML).<\/p>\n What to do<\/strong>: Review current SaaS contracts for data export clauses. Ask your vendor directly: “In what format can I get my data out, and at what cost?”<\/p>\n GDPR forced companies to think about data location earlier. The Data Act reinforces this requirement further. Specifically: is your company’s data on a server outside the EU?<\/p>\n This is not a theoretical concern. Many international SaaS services store data on US servers by default unless an EU location is specifically requested or an additional fee is paid. The Schrems II ruling and its implications remain relevant \u2014 EU\u2013US data transfers still require appropriate safeguards.<\/p>\n What to do<\/strong>: Find out the physical location of data for every SaaS service you use. Search the terms of service for “data residency” or “data location.” If unclear, ask the vendor directly and in writing.<\/p>\n In many systems, “data export” means downloading PDF reports or Excel spreadsheets that have lost their structure. That doesn’t fulfill the Data Act’s intent.<\/p>\n Machine-readable data means data can be fed into another system automatically without manual re-entry. JSON or CSV from the customer registry, project data, invoices. Not PDF clippings.<\/p>\n What to do<\/strong>: Ask your vendor for a technical list of available export formats. If the answer mentions only PDF or reports \u2014 that’s incomplete portability.<\/p>\n The Data Act sets four practical requirements that are worth checking before purchasing a system or renewing contracts:<\/p>\n The system must be able to export all relevant data (customers, transactions, contracts, projects) in machine-readable format. Best case: an API from which data can be fetched automatically.<\/p>\n The Data Act doesn’t ban all fees, but “excessive” fees may be seen as anti-competitive. In practice: the fee must be proportionate to the actual delivery cost.<\/p>\n Contracts cannot include clauses that practically prevent a system switch or make it unreasonably expensive. For example: “3-year notice period + 12-month data export freeze” would be problematic.<\/p>\n Switching between cloud providers must be possible within a reasonable timeframe and at reasonable cost. This particularly applies to IaaS\/PaaS level, but it also flows through to SaaS services.<\/p>\n An honest assessment of commonly used systems in the Finnish SME market. Note: the situation changes constantly as vendors update their products. Always verify the current state with your vendor.<\/p>\n Good Data Act readiness:<\/strong> Room for improvement:<\/strong> Resappi<\/strong>: Data exportable in JSON\/CSV format from all modules, all data on EU servers (Hetzner, Frankfurt), API documentation openly available. Data Act requirements have been built into the system architecture from the start.<\/p>\n Do these five things before 2026:<\/p>\n 1. Inventory the systems you use<\/strong> 2. Check data location for each system<\/strong> 3. Test data export in practice<\/strong> 4. Read the contract clauses on data<\/strong> 5. Ask vendors for a written response<\/strong> The EU Data Act isn’t bureaucracy for its own sake. It’s a response to a real problem: companies have handed control over their own data to external providers who have an incentive to keep customers locked into their system.<\/p>\n The law’s purpose is to return data ownership to you. Use it: choose systems that support data portability, not systems that restrict it.<\/p>\n See how Resappi meets Data Act requirements<\/a> \u2014 or book a 15-minute assessment call<\/a> to discuss your situation.<\/p>\n Sources<\/strong> Related articles<\/strong> <\/p>\n","protected":false},"excerpt":{"rendered":" EU Data Act enforcement begins in 2026. What does it mean for your SME’s system choices? Three common mistakes and an action checklist for business owners.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"rank_math_title":"EU Data Act 2026: What SME owners must know when choosing systems","rank_math_description":"EU Data Act enforcement begins in 2026. What does it mean for your SME's system choices? Three common mistakes and an action checklist for business owners.","rank_math_focus_keyword":"EU Data Act SME","rank_math_robots":"","rank_math_canonical_url":"","footnotes":""},"categories":[35],"tags":[123,126,129,59],"class_list":["post-224","post","type-post","status-publish","format-standard","hentry","category-revops-en","tag-data-privacy-en","tag-eu-data-act-en","tag-regulation-en","tag-sme-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/posts\/224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/comments?post=224"}],"version-history":[{"count":1,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/posts\/224\/revisions"}],"predecessor-version":[{"id":234,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/posts\/224\/revisions\/234"}],"wp:attachment":[{"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/media?parent=224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/categories?post=224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/resappi.com\/blog\/wp-json\/wp\/v2\/tags?post=224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n– EU Data Act entered into force January 11, 2024; the transition period ends September 12, 2025 \u2014 enforcement starts 2026
\n– The law applies to all companies producing, collecting or processing data in the EU \u2014 including SMEs
\n– Core requirement: users and companies must be able to export their data in machine-readable format
\n– Three common mistakes: vendor lock-in contracts, binary export structures, not knowing where your cloud data lives
\n– Resappi supports Data Act requirements: data exportable in JSON\/CSV, all data on EU servers<\/p>\n
\nEU Data Act in brief \u2014 what it is, when it applies to you<\/h2>\n
\n
\n
\nThe three most common SME mistakes in Data Act readiness<\/h2>\n
Mistake 1: Vendor lock-in contracts that nobody read<\/h3>\n
Mistake 2: Not knowing where your data actually lives<\/h3>\n
Mistake 3: “Export” means PDF, not raw data<\/h3>\n
\nWhat Data Act requires from the systems you use<\/h2>\n
1. Data export function in standard format<\/h3>\n
2. No excessive export fees<\/h3>\n
3. Contract terms support switching<\/h3>\n
4. Cloud provider switching<\/h3>\n
\nExamples: which systems are ready and which aren’t?<\/h2>\n
\n– Procountor: API-based data export, JSON\/CSV formats available, EU data location (Finland)
\n– HubSpot: comprehensive export functions, EU data location available, clear APIs
\n– Google Workspace: EU data location selectable, Takeout function is comprehensive<\/p>\n
\n– Many traditional ERP solutions: export often only PDF or Excel, API support limited or subject to additional fees
\n– Finnish ERP systems vary \u2014 some have invested in API development, others haven’t<\/p>\n
\nAction checklist for SME owners<\/h2>\n
\nList all SaaS services and software. Where does your company’s critical data live? Customers, contracts, financial data, projects.<\/p>\n
\nEU or non-EU? If non-EU, are Standard Contractual Clauses (SCC) or another compliant mechanism in place?<\/p>\n
\nDownload your customer registry from a system. What format is the data in? Can it be opened and read programmatically? Is all relevant data included?<\/p>\n
\nSearch for: “data portability,” “data export,” “termination data,” “migration.” Note any fees or time delays.<\/p>\n
\n“How have you addressed Data Act requirements in your product?” A good vendor answers directly. A vague answer is itself informative.<\/p>\n
\nSummary: your data is your business asset<\/h2>\n
\n
\n– European Commission, EU Data Act: digital-strategy.ec.europa.eu<\/a>
\n– EUR-Lex, Regulation (EU) 2023\/2854: eur-lex.europa.eu<\/a>
\n– European Data Protection Board: edpb.europa.eu<\/a><\/p>\n
\n– ERP comparison 2026 \u2014 what to demand from a system<\/a>
\n– Procountor + CRM integration and data management fundamentals<\/a><\/p>\n