EU Data Act: Use Cases and Applications

The EU Data Act has applied in full since 12 September 2025. Its core use cases are built on four pillars – data sharing for connected products, switching between cloud computing services, B2B/B2C (business-to-business/business-to-consumer) data exchange, and emergency access to data by public sector bodies – covering all relevant economic activity in the EU market, while clearly defining exemptions and special rules.

Download the EU Data Act at: https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng

Because the EU Data Act’s use cases involve a huge range of products across all industries, this article focuses on devices made by medical equipment manufacturers. 

1. Overview of the core use cases

The use cases of the EU Data Act can be grouped into five core areas, covering data exchange needs in every scenario from personal consumption to business operations and from everyday use to emergency response. The chart below summarises the EU Data Act scenario categories, core applicable situations and key compliance points:

2. Use cases in practice

3. Assessing whether a medical device manufacturer’s devices are subject to EU Data Act requirements

Many medical device manufacturers ask us about exporting products to EU countries and want to know whether their devices fall within the scope of the EU Data Act. The decision table below helps companies reach a quick answer:

4. Core compliance points for medical device manufacturers

Once companies understand the regulatory requirements, what they most urgently want to know is how to comply in practice:

5. Special compliance considerations for medical devices (coordination between the MDR and the Data Act)

Medical devices have some special requirements that companies need to consider:

12 September 2025 is the date of full application. Some Chinese medical device manufacturers have already taken action, for example:

1. Launching systems to handle data access requests;

2. Publishing transparency statements;

3. Responding to third-party data-sharing requests. However, many companies are still unfamiliar with what to do, and EVERBIZ Consulting is happy to provide professional services. Companies can also check where they stand on Data Act compliance using the self-assessment checklist below:

• Applicability assessment completed, confirming that the EU Data Act applies

• Transparency statement meeting medical sector requirements prepared □ Process for handling data access requests established (30-day response) 

• Cloud service contracts revised to include standardised switching clauses 

• Existing contracts reviewed and unfair data restriction clauses removed 

• Response mechanism for public sector data access requests established 

• Data Act compliance integrated into the MDR quality management system

• Development of access-by-design functions planned (for new devices) 

• Staff compliance training carried out, especially for customer service and technical teams 

• Compliance audit and update mechanism established to track regulatory changes 

Most Chinese medical device manufacturers are small and micro enterprises. By tailoring Data Act compliance work to the characteristics of their own devices, they can meet the requirements while leaving out clauses that do not apply to their devices – clauses that could otherwise create a considerable workload.