Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
The EU Data Act became applicable from 12 September 2025, giving any business or consumer user of a “connected product” — smart appliances, wearables, connected machinery, vehicle telematics, IoT sensors and similar internet- or Bluetooth-connected devices — the right to demand access to the data that device generates, including requiring it to be shared with a third party of their choosing. From 12 September 2026, a further design obligation takes effect: connected products and their related services (apps, dashboards, cloud portals) placed on the EU market must be built so that users can access their own product data directly, easily, securely and free of charge, in a structured, commonly used, machine-readable format, without needing to submit a request — wherever this is relevant and technically feasible. The Act applies extraterritorially: any UK manufacturer or service provider placing connected products on the EU market, or serving EU-based users, is in scope regardless of where the business itself is established.
Alongside the connected-product rules, the Data Act also renders certain unfair contract terms in business-to-business data-sharing agreements unenforceable, and introduces new rights making it easier for businesses to switch between cloud and data-processing service providers. For a UK business exporting smart devices, connected equipment, or software tied to physical products into the EU or Northern Ireland, non-compliance risks enforcement by EU member state authorities, contractual disputes with EU distributors and customers, and reputational damage with commercial partners who are themselves required to check their supply chain’s compliance. With the design-by-default obligation landing on 12 September 2026, businesses that only handled ad hoc data-access requests over the past year now need product-level changes in place.
