data-act-iot-kit

EU Data Act Article 4 + 5 reference implementation. Drop-in user-data-access HTTP endpoint for connected products and related services, plus a verbatim-cited compliance manifest that maps every disclosure choice to the specific clause of Regulation (EU) 2023/2854 that authorises it.

Why this exists

From 12 September 2026, new connected products and related services placed on the EU market must be designed so that, by default, product data and related service data are easily and securely accessible to the user, delivered in a structured, commonly used, machine-readable format, and directly accessible to the user wherever technically feasible.

Germany has already designated the Bundesnetzagentur as the supervisor and announced fines of up to 4% of turnover for non-compliance. The audience is firmware engineers and embedded-product teams at EU IoT manufacturers — not lawyers. They need code, not advisories.

Existing offerings are law-firm advisories (Latham, Hogan Lovells, Bird & Bird) and enterprise data-portability suites (BigID, Collibra). The under-€500/mo SMB tier is empty. data-act-iot-kit is the OSS that closes that gap.

What it does

1. Ships a reference HTTP endpoint (/user-data-access) compliant with Art. 4 (user access) and Art. 5 (third-party access on user request).
2. Validates an incoming access request against the user-identity, scope, and consent envelopes the Data Act mandates.
3. Emits a verbatim-cited compliance manifest: every accept/reject/limit decision the endpoint takes is mapped to the specific Article + paragraph of Reg. (EU) 2023/2854.
4. Produces a SHA-256-chained audit log of all access events (Art. 4(13) audit-trail requirement).

pip install data-act-iot-kit

# Start the reference endpoint
data-act-iot serve --port 8080 --config config.yaml

# Generate the conformity manifest for a snapshot of decisions
data-act-iot manifest decisions.jsonl --output COMPLIANCE_MANIFEST.json

# Verify an audit log against its manifest
data-act-iot verify --manifest COMPLIANCE_MANIFEST.json --audit audit.json

Scope

• Regulation (EU) 2023/2854 (Data Act), entered into force 11 January 2024, applicable from 12 September 2025; Art. 3-7 obligations on new products apply from 12 September 2026.
• Articles covered: 3 (general user-access by design), 4 (user rights), 5 (third-party access at user request), 6 (use limits), 7 (scope), 33 (essential requirements interop).
• Out of scope (v0.0.1): inter-operator B2B switching (Art. 23-31, separate Q3 2027 deadline), public-body emergency-access (Art. 14-22).

Limits (what this tool does NOT do)

• Does NOT make your physical product compliant. Hardware-level data-access-by-design is your firmware team's job.
• Does NOT validate your contract templates. Lawyer territory.
• Does NOT replace national supervisor inspections. Audit-grade evidence preflight only.
• Does NOT cover the Free-Flow-of-Non-Personal-Data crossovers when personal data is in scope (GDPR Art. 20 still applies — keep your DPO involved).

Citation

@software{data_act_iot_kit,
  author = {Pereiro Garcia, Cesar},
  title  = {data-act-iot-kit: EU Data Act Art. 4-5 reference implementation},
  year   = {2026},
  url    = {https://github.com/plusultra-tools/data-act-iot-kit},
}

License

MIT.