Obligations due by this deadline
For all in-scope entities
- Art 41 — The Commission shall develop and recommend non-binding model contractual terms on data access and use, including terms on reasonable compensation and the protection of trade secrets.
- Art 41 — The Commission shall develop and recommend non-binding standard contractual clauses for cloud computing contracts to assist parties in drafting and negotiating contracts with fair, reasonable and non-discriminatory contractual rights and obligations.
- Art 40 — Member States shall notify the Commission of the rules and measures on penalties by 12 September 2025 and notify it without delay of any subsequent amendment affecting them.
Checklist — what you need to have done
- Art 41: develop
- Art 40: notify
What should already be in place — audit framing
12 September 2025 is 261 days behind us. The obligations on this page have been in force since then; treat any gap as an audit finding, not a planning question. The expected baseline under Data Act:
- contract revision for data-sharing obligations — should be done already
- real-time access infrastructure — should be done already
If any of these are missing, the right next step is a gap assessment plus a documented remediation plan — not a re-design of the underlying programme.
Related Fontvera pages
- data act article 37 commission
- data act obligations data services
- data act vs data governance act comparison
- data act vs dma comparison
Check your full compliance exposure with the 5-minute Fontvera diagnostic →