startups - legal aspects of new technologies

One of the main new institutions introduced by the EU’s Data Act is the user’s right to access data (including metadata necessary to interpret or use the data) derived from a connected product the person is using or a service related to a connected product.

The data which a user can access may have significant commercial value for the data holder (e.g. the manufacturer of a connected product). Therefore, it may be crucial from the data holder’s perspective to ensure that such data remain undisclosed, or that use of the data be restricted.

The internet of things and related services is one of the key industries affected by the EU’s Data Act. Businesses in this sector may have to make changes to bring their operations into compliance with the new requirements. In this article we examine the key obligations under the Data Act for IoT companies, and their operational implications.

Pre-contractual information obligations

What do these duties involve?

Entities that sell, rent or lease a connected product are required to provide at least the following information before entering into a contract with users:

• What data can be generated by the connected product (type, format, and estimated volume of data)
• Whether the connected product is capable of generating data continuously and in real time
• Whether the connected product is capable of storing data on the device or on a remote server, including, where applicable, the intended duration of data retention
• How the user may access, retrieve or, where relevant, erase the data, including the technical means to do so, as well as their terms of use and quality of service.

The Data Act became applicable on 12 September 2025. What do businesses need to pay attention to under this new EU-wide regulation?

Nature and purpose of the Data Act

The Data Act—Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)—is an EU regulation, and as such applies directly in Poland and all other EU member states. At the national level the Data Act will be supplemented by local regulations, but these will essentially govern only procedural issues (e.g. infringement proceedings), not substantive issues. In other words, substantively the Data Act will govern across the entire EU.

The third post-hackathon interview: After InteliLex and DoxyChain, it’s time for bSure, the team that took third place in the Polish phase of the Global Legal Hackathon.

Justyna Zandberg-Malec: During the hackathon you worked on an application that points out to freelancers contractual provisions that are disadvantageous to them. Where did you get this idea?

Sabina Łobocka: A colleague who wasn’t taking part in the hackathon suggested it to me (and allowed us to use it). He was signing a contract with a residential real estate developer and didn’t entirely understand all the clauses. It took him a long time to check whether any of the clauses were unfavourable to him. That’s why we thought of an application that ordinary people could use to protect against irregularities and negative legal consequences for them.

Last year I proposed that Poland should take a broader approach to the issue of regulatory sandboxes, not merely copying solutions adopted in other countries. Now we see the first steps towards creation of multi-sectoral (not exclusively financial) regulatory sandboxes.

The trend started by the Financial Conduct Authority in the UK of creating regulatory sandboxes for the financial sector has spread around the world, including Poland. Although many voices from major jurisdictions, such as the United States and Germany, are skeptical, this solution undoubtedly has its advantages. Market participants usually rate this concept very highly, even if in reality the sandbox does not deliver immediate regulatory benefits (for example, it does not enable limited operation of regulated activity without a licence, which would be difficult in EU member states due to the harmonised regulatory regime).

An interview with Karol Kłaczyński, Agnieszka Poteralska, Artur Tanona and Maciej Zalewski, members of the team that won first place in the Polish phase of the Global Legal Hackathon.

You won the Polish phase of the Global Legal Hackathon with a solution that you yourselves describe as “a plug-in to Word,” but which has the chance to truly expedite the work of lawyers. What is your concept all about?

Karol Kłaczyński: InteliLex provides quick access to the document database created at the given organisation. In our discussions with lawyers this problem often comes up. The knowledge exists, it has been developed, but searching for it is time-consuming and inefficient. InteliLex helps improve the efficiency of the search.