EU Data Act
A regulation applicable since September 2025 that gives users access to data from their connected devices, eases switching between cloud providers and frames authorities' access, reshuffling data in insurance.
Regulation (EU) 2023/2854 on harmonized rules on fair access to and use of data, the Data Act, has applied for the most part since September 12, 2025. It has several strands. Users of connected products, vehicles, machines, household appliances, can access the data their use generates and have it sent to a third party of their choice, which limits the manufacturer's monopoly over that data. Customers of cloud data processing services can switch providers, switching charges having to disappear by January 2027, and providers must facilitate portability. Unfair contractual terms on data imposed on businesses are deemed not binding. And public bodies may, in cases of exceptional need, obtain data held by businesses. For insurance, the regulation has concrete effects: a motor insurer or an insurer of connected goods can, with the user's consent, access usage data to price or settle a claim without depending on the manufacturer, and reduced cloud provider lock-in lessens a source of concentration that cyber underwriters fear.
Textbook case: a farmer whose connected tractor was damaged asks the manufacturer to send its insurer the operating data for the days before the failure. The manufacturer, which had reserved them for its own network, must comply: the insurer's adjuster establishes the cause of damage without depending on the maker.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.