EU Data Act — Event Schemas & Switching Playbook
Regulation (EU) 2023/2854 requires provable data access, B2B sharing, and cloud switching — not just operational logs. This page maps Sigigo evidence events and a practical migration playbook.
Why evidence matters
The EU Data Act forces organizations to move data fairly and prove they did it right: connected-product access, FRAND B2B sharing, cloud switching, and interoperability. Contract PDFs and mutable logs do not survive disputes, trade-secret withhold challenges, or post-migration audits.
Event schemas (data_act.*)
Emit signed, tamper-evident events at decision boundaries. Prefer references (product ID, contract ID, data categories) over raw telemetry in canonical payloads.
| Event type | When to emit | Typical fields |
|---|---|---|
| data_act.access_requested | User or third party requests product/service data | product_id, requester_type, data_categories[], legal_basis |
| data_act.access_granted | Access fulfilled | request_id, scope, delivery_channel, timestamp |
| data_act.access_denied | Request refused with reason | request_id, denial_reason, policy_ref |
| data_act.share_initiated | B2B or third-party share started | share_id, recipient, contract_ref, FRAND_terms_ref |
| data_act.share_completed | Share delivered | share_id, integrity_hash, delivery_proof |
| data_act.share_withheld | Trade secret or serious economic damage | share_id, trade_secret_categories[], safeguards_applied[] |
| data_act.cloud_switch_export | Customer exports portable data + evidence bundle | source_vendor, export_manifest_hash, batch_id |
| data_act.cloud_switch_verified | Post-migration integrity check passed | target_vendor, verification_result, merkle_root |
| data_act.erasure_completed | Vendor erasure after exit | scope, erasure_certificate_ref |
Cloud switching playbook
- Baseline inventory — Document data categories, retention rules, and subprocessors before migration.
- Enable continuous evidence — Instrument access, share, and admin events before switch window so you have a pre-migration history.
- Export with proofs — Generate portable evidence bundles (Merkle roots, signatures, event index) alongside data export — not a CSV alone.
- Verify after migration — Emit
cloud_switch_verifiedafter independent offline verification of bundle integrity on the new vendor. - Close the loop — Record erasure completion at source vendor; retain verification artifacts per sector retention (GDPR + Data Act minimums).
Regulatory timeline
| Date | Milestone |
|---|---|
| Sep 2025 | Core Data Act rules in force |
| Sep 2026 | Connected products must enable data access by design |
| Sep 2027 | Zero switching/egress fees; legacy contract restrictions |
Pair with EU AI Act
Connected products increasingly run AI analytics as a related service. The same Sigigo tenant can emit data_act.* events (who got the data) and ai_act.* events (what the model decided) — one evidence stack, one EU deployment profile on AWS or Azure. EU AI Act Article 12 guide.
Architecture call: map your data-holder or cloud-switch program to evidence events. Get in touch, explore platform integrations, or read our EU regulations blog series.
This guide supports qualification and architecture planning — it is not legal advice. Work with your legal and compliance teams on classification, DPAs, and deployment approvals. See also our Regulatory & Compliance page.