DataWarrant

1. One-liner

Answers a customer’s Data Act demand for machine data in days, without handing over your trade secrets.

2. Trend signal — why now?

The EU Data Act (Regulation 2023/2854) has been live since 12 September 2025. Users of connected products — anyone operating a machine — now have a statutory right to the data that machine produces. On 12 September 2026, three weeks from today, the second shoe drops: every connected product newly placed on the EU market must be designed so data is directly accessible by default, in a structured, machine-readable format (Wilson Sonsini).

Nobody is ready. Bitkom surveyed 605 German companies with 20+ employees in weeks 10–16 of 2025: 1% had fully implemented the requirements, 4% partially, 10% had just begun, 30% hadn’t started, and 52% believed they weren’t affected at all (Silicon Saxony / Bitkom). That last number is the interesting one — half the market thinks this isn’t their problem.

Enforcement is no longer theoretical. Germany named the Bundesnetzagentur as enforcement authority, with fines to €500,000 per violation under the Data-Act-Durchführungsgesetz (MyBusinessFuture, 09.04.2026). The first cross-border complaint has already been lodged — a Finnish company complaining that a Swedish data holder refused to provide data free of charge, which Traficom forwarded to the Swedish authority (Hannes Snellman).

And here’s the tell that mid-size builders are genuinely caught: the VDMA’s October 2025 Digital Omnibus position paper formally asks the EU to extend the Article 7 SME exemption to medium-sized enterprises and small mid-caps — relief they do not currently have. The same paper states plainly that the Data Act “does not meet the needs of the industry and has created a high level of legal uncertainty and bureaucracy for industrial companies” (VDMA position paper, Oct 2025).

VDMA legal counsel Salome Peters, quoted the day the Act went live: “Unternehmen sehen bei sämtlichen Pflichten des Data Acts einen hohen Herausforderungsgrad” — companies see a high challenge level across every single Data Act obligation (produktion.de, 12.09.2025).

Provenance:
  - Signal 1 (Demand): Bitkom survey of 605 German companies — 1% fully implemented the Data Act, 30% not started, 52% believe they are not affected — https://silicon-saxony.de/en/bitkom-100-days-before-the-data-act-hardly-any-companies-are-prepared/ — 2025-05-20
  - Signal 2 (Feasibility/Regulatory): Article 3 access-by-design binds products placed on the market from 12 Sept 2026; Article 7 exempts only micro and small enterprises, so medium-sized builders are fully in scope — https://data-act-law.eu/article/7/ — observed 2026-08-24
  - Signal 3 (Economic): Bundesnetzagentur enforcement with €500k per-violation fines; first cross-border complaint already filed via Traficom; VDMA formally lobbying to extend the SME exemption to medium-sized firms — https://www.vdma.eu/documents/d/group-34568/vdma-position-paper-digital-omnibus-october-2025 — 2025-10-01
  Category: Regulatory arbitrage

3. The opportunity

The market has read this deadline as an engineering problem. It is mostly a paperwork and decision problem, and that’s the part nobody sells.

The engineering half is genuinely well-served. OPC UA gateway vendors — Softing, HMS, Kepware, Moxa, Beckhoff — already translate Siemens S7, Modbus, PROFINET and a hundred proprietary protocols into a standard interface, and VDMA explicitly recommends OPC UA as the Data Act interface. If your problem is “bits can’t get off the machine,” you can buy that today.

That is not most builders’ problem. Their problem is the set of questions that comes after a customer emails asking for their data:

• Which of the 4,000 tags coming off this machine are “readily available product data” I’m obliged to hand over, and which are enriched/derived data I’m allowed to keep?
• Which tags encode a trade secret — my control loop tuning, my recipe parameters — and what’s my substantiated basis for withholding them?
• If I withhold, I’m required to notify the national competent authority. Did anyone do that? Where’s the record?
• What do I put on the pre-contractual information sheet for this machine model — data type, format, volume, whether it’s real-time, where it’s stored, how it’s accessed and erased?
• We ship 40 machine variants. Do I answer this 40 times, by hand, forever?

Today those questions get answered by a €150k–€250k consulting engagement or a law firm hourly, and then the answers rot in a SharePoint folder the moment the product changes. The Data Act is not a one-time project — it’s a standing obligation that fires every time a customer asks, and every answer has to be consistent with the last one, because inconsistency is exactly what a Bundesnetzagentur investigation feeds on.

The incumbent to disrupt isn’t a software vendor. It’s the law firm’s hourly rate and the consultant’s slide deck. A focused tool turns a recurring six-figure advisory dependency into a €600/month system of record that a technical product manager can run themselves.

4. Target market

Primary customer: Head of Product / Technical Compliance Lead / Head of Digitalisation at a medium-sized EU machine builder — 50 to 500 employees, €10M–€150M revenue — in Germany, Italy, Austria, Switzerland (for EU-placed products), Netherlands, Sweden. Firms building packaging machinery, injection moulding, machine tools, food processing lines, printing presses, textile machinery. The classic Mittelstand Maschinenbauer with a connected product, a service contract business, and no in-house data-protection lawyer.

Why this size exactly: Article 7 exempts micro and small enterprises — under 50 staff and under €10M turnover — from Chapter II entirely, plus a one-year grace for firms newly qualifying as medium-sized. Below 50 people, the tool has no legal hook. Above ~500, they have a legal department, a Manufacturing-X program, and they’ve already bought the consultants. The obligation-without-capacity band is 50–500 employees, which is precisely the segment VDMA is lobbying to get exempted — and hasn’t.

Why they buy, in their words: VDMA’s own position paper says the definition of “data holder” is “unclear and circular,” and that companies must decide “on a case-by-case basis” which GDPR legal basis permits disclosure — “which in practice leads to considerable additional effort.” Salome Peters (VDMA): “Unternehmen sehen bei sämtlichen Pflichten des Data Acts einen hohen Herausforderungsgrad.” Hartmut Rauen (VDMA), on the trade secret exposure: “Geschäftsgeheimnisse sind nur so gut geschützt, wie der Schutz im schwächsten Glied” — trade secrets are only as well protected as the weakest link. Trade publication produktion.de frames the commercial injury bluntly: business models where data access was previously chargeable must now be free to the user.

Rough TAM reasoning: Germany has 6,500+ mechanical and plant engineering companies, predominantly medium-sized, generating ~€230B annually (deutschland.de); Destatis counts ~16,000 businesses in machinery and equipment manufacturing broadly. VDMA alone has ~3,500 mostly-Mittelstand members. Be conservative: assume only the connected-product subset in the 50–500 band across DACH + Italy + Benelux + Nordics is reachable — call it 4,000–8,000 firms. At €7,200/year that’s a €29M–€58M addressable line. I only need 1% of it.

Why now for them: 12 September 2026 is three weeks out, and it bites on products placed on the market after that date — meaning every new machine model and every new variant. The first customer to send a formal Article 4 request with a lawyer cc’d converts this from “someday” to “this week.”

5. Product sketch (MVP)

• Data inventory per machine model — import your tag list / OPC UA node set / PLC variable export, and get every signal auto-classified into must disclose (readily available product data), may withhold (trade secret, with a drafted justification), or out of scope (enriched/derived).
• Trade-secret shield — for each withheld tag, a substantiated written basis referencing the “serious economic damage” test, plus the confidentiality measures to propose to the user. This is the artifact that survives a challenge.
• Request desk — log an incoming customer data request, track the “without undue delay” clock, generate the response pack, and record what was released versus withheld.
• Authority notification generator — when you withhold on trade-secret or security grounds, produce the notification the Data Act requires you to file with the national competent authority (Bundesnetzagentur and equivalents), and keep the filing record.
• Pre-contractual information sheet — auto-generate the Article 3(2) disclosure per machine model (data type, format, volume, real-time or not, storage, access, erasure), as a QR-linked web page you can put on the datasheet and in the quote.
• Variant propagation — classify once for a base model, inherit down 40 variants, flag only the deltas that need a human decision.
• Change alerts — a firmware release adds 60 new tags; the register flags them as unclassified before the machine ships.
• Audit export — a dated, versioned dossier showing every classification decision, who approved it, and when. In German and English.

6. AI angle — what’s load-bearing

The load-bearing task is classifying thousands of cryptic industrial tag names into legal categories, and drafting the justification prose for each withholding decision.

Real tag lists look like SPS_Ext_TmpZone3_Ist, Rzp_Param_07, MotDrv_KpTune, OEE_Calc_Shift. A lawyer reading that list cannot tell you which one is a trade secret. A controls engineer can, but they’re not going to sit through 4,000 rows, and they have no idea what “readily available data” means as a legal term. AI closes exactly that gap: it reads the naming conventions, the OPC UA node hierarchy, the units and datatypes, and the German/English abbreviations, and proposes a classification with a rationale a human then approves or overrides.

Strip the AI out and this becomes a spreadsheet template — which is precisely what the consultancies already deliver, and precisely why their output rots. The classification has to be re-runnable on every firmware change for the register to stay true, and re-running it by hand costs more than the fine.

Second load-bearing use: drafting the trade-secret justification and the authority notification in the register’s own voice, consistent across every decision. Consistency is the legal asset — one contradictory justification undermines all the others.

The AI proposes; the engineer approves. No classification reaches a customer without a named human sign-off, and that sign-off is what the audit export records.

7. Localization angle

Germany-first, then Italy. This is not a global play dressed in EU clothes — the wedge is jurisdiction-specific.

• Language: the register must work in German. Tag names, machine documentation, the customer’s request email, and the Bundesnetzagentur notification are all German. An English-only tool is unsellable to a Swabian machine builder.
• Authority-specific artifacts: the notification format and the competent authority differ per member state — Bundesnetzagentur in Germany, Traficom in Finland, and so on. Shipping the correct per-country notification is real, boring, defensible work.
• Channel: VDMA is the distribution artery. It publishes the FAQ, the Quick Guide, the “Regulatory Cockpit,” and runs the SM4RTENANCE project. German industrial buyers trust association-endorsed tooling in a way they do not trust a Product Hunt launch.
• Standard: VDMA recommends OPC UA (IEC 62541) with its 60+ Companion Specifications as the Data Act interface. Speaking that vocabulary natively is table stakes for credibility.

Italy second: large packaging and food-machinery base, same size band, same lack of in-house counsel.

8. Business model — path to $1M–$5M ARR

• Pricing: €500/month entry (up to 5 machine models), €1,200/month standard (up to 25 models), €2,500/month for multi-brand groups. Annual prepay, which is how this buyer prefers to purchase anyway.
• ACV: ~€7,200 realistic blended average.
• Why that price holds: the alternative quote on their desk is a €150k–€250k consultant-led compliance engagement, and the downside is a €500k per-violation fine. €7,200/year is a rounding error against either. It also sits below the threshold that would force a formal procurement process at a 200-person firm — a departmental budget line, not a board decision.
• Rough math to $1M ARR: ~130 customers × €7,200 = €936k ($1.0M). One hundred and thirty firms out of a 4,000–8,000 firm reachable base. That’s a sales problem, not a market-size problem.
• Rough math to $5M ARR: ~650 customers, which realistically means Germany + Italy + Benelux + Nordics, plus moving upmarket into the 500–1,500 employee band where seat counts and model counts both rise. Alternatively ~350 customers at a €14k ACV after adding the modules below.
• Expansion path: priced on machine models, so ACV grows mechanically as they release products. Then: (1) the cloud-switching module for the 12 January 2027 egress-fee ban, which hits the same firms’ SaaS contracts; (2) a data-recipient seat for their service partners; (3) contract clause review for the pre-contractual and B2B fairness terms Osborne Clarke notes existing contracts “will rarely satisfy.”

9. Go-to-market wedge — first 100 customers

1. The VDMA-adjacent list, worked by hand. VDMA has ~3,500 mostly-Mittelstand members and publishes member directories by product group. Pull the 800 firms in connected-machinery categories (packaging, plastics, machine tools, food processing) in the 50–500 employee band. For each, identify the Head of Digitalisation or Technical Compliance on LinkedIn. Send a German-language email containing their actual exposure: “Your XYZ-3000 is on the market after 12 September. Here are the 6 questions a customer’s Article 4 request will ask, and where we think your answers are missing.” Not a demo request — a diagnostic. Expect 8–12% reply to a specific, named-product diagnostic; 100 conversations, 15–20 pilots.

2. Free “Article 4 Readiness Check” as the lead magnet. Upload a tag list or OPC UA node set, get back a free classification of the first 200 tags plus a count of how many look like undisclosed trade-secret exposure. This is the whole demo, it’s self-serve, and it produces a number that scares the right person. Seed it in the VDMA Regulatory Cockpit orbit, German industrial press (produktion.de, industrieanzeiger, Computer&AUTOMATION — all of whom are actively publishing Data Act explainers and need practitioner content), and LinkedIn where German compliance discourse actually happens.

3. Partner with the OPC UA gateway vendors. Softing, HMS, Kepware and the system integrators sell the pipe and get asked “does this make us Data Act compliant?” — to which the honest answer is no, it moves bits, it doesn’t decide what you’re allowed to send. Be the referral answer. Co-marketing with 3–4 integrators reaches hundreds of exactly-right accounts without paying CAC.

4. Ride the enforcement news cycle. The first Bundesnetzagentur action against a named machine builder will be covered by every German industrial trade title. Have the teardown written, the readiness check live, and the ad budget ready the week it lands.

5. Trade fairs, chosen surgically. Hannover Messe and interpack put this buyer in one hall. Not a booth — walk the floor with the readiness check on a laptop and run it live on prospects’ published machine specs.

10. Build complexity — justification

Medium. No novel research required. Tag-list ingestion (CSV, OPC UA node sets, common PLC exports) is well-trodden parsing; classification is an LLM task with a domain-specific rubric and human approval; document generation is templating. Standard web stack, off-the-shelf model APIs.

The genuine work is threefold: encoding the legal rubric correctly enough that a lawyer will sign off on it, building the per-member-state notification variants, and getting German-language output to a quality a Mittelstand compliance lead will send to a regulator without editing. Budget 14–18 weeks to a sellable v1 for two people, one of whom must have real industrial-automation literacy. Add a fractional EU data-law counsel on retainer — that’s not optional, it’s the product.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Compliance tooling; sells help meeting an obligation, doesn’t evade it. No regulatory approval needed to launch.
Ethical — no harm / dark patterns	✅	One caution: the trade-secret module must not become a “how to withhold everything” machine. Product stance is defensible-and-substantiated, not maximal refusal.
Market exists (evidence above)	✅	Bitkom 1%-implemented, VDMA lobbying for exemption, live enforcement, €500k fines.
1–5 person team can build this	✅	Two builders + fractional counsel.
Launchable with <$50K / ₹40L	✅	Legal retainer is the main line item; ~€25–35k to a sellable v1.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	15/20	Real, dated, fined obligation with authority enforcement live. Held back from 17+ because for many builders the pain is still anticipated rather than felt — until a customer actually sends a request, it competes with shipping machines. The 52% who think they’re unaffected are not in pain yet.
Demand evidence	15	12/15	Strong: Bitkom n=605 hard numbers, VDMA position paper, named enforcement authority, first complaint filed. Docked because I found no verbatim buyer saying “I would pay for this” — the voice I have is trade associations and law firms, who are talking their own book.
Build feasibility	15	11/15	Off-the-shelf stack, but 14–18 weeks and requires industrial-automation literacy plus paid legal input. Not a 6-week solo build.
Distribution clarity	15	12/15	Named list (VDMA member directory), named channel, a lead magnet that self-qualifies, and integrator partners. Docked because German Mittelstand cold-email response rates are unproven for me and this buyer is famously slow to answer strangers.
Revenue mechanics	15	12/15	€7,200 ACV against a €150k+ consulting alternative and €500k fines is easy to defend, and 130 customers to $1M is credible. Docked on churn risk — see kill criteria.
Time to first revenue	10	7/10	14–18 week build, then a Mittelstand purchase cycle of 6–12 weeks. First euro realistically 5–7 months out. Deadline urgency helps; German procurement caution doesn’t.
Defensibility	10	5/10	The honest weak spot. The legal rubric is copyable, and a well-funded GRC vendor or a VDMA-blessed consortium tool could take this. Real moat only accrues as customers’ registers fill with approved classification history they won’t re-key. Execution and speed, not structure.
Total	100	74/100

13. Qualitative modifiers

Founder-fit tags

domain-expertise-required · sales-heavy

This needs someone who can hold a credible conversation about OPC UA node sets and Article 4, in German. A pure SaaS generalist will get found out in the first customer call. It is also sales-heavy: a directory, outbound in German, and trade fairs — not a self-serve motion.

Key assumptions to validate

1. Assumption: Medium-sized builders believe the obligation applies to them and are not banking on the Digital Omnibus extending the SME exemption to cover them. How to test: 25 structured calls with Heads of Digitalisation at 50–500 employee VDMA-member firms; ask directly whether they expect to be exempted. If most say “we’re waiting for Brussels to fix it,” urgency collapses and this becomes a VALIDATE.
2. Assumption: AI classification of real industrial tag lists reaches ≥80% agreement with an expert controls engineer’s judgement. How to test: get 5 real tag exports under NDA, classify blind, have the customer’s own engineer mark it up. Below ~70% the human review burden eats the value.
3. Assumption: They’ll pay €500–1,200/month for a compliance register rather than absorbing it into an existing consultant relationship. How to test: price probe in the same 25 calls with a signed LOI or prepay ask, not a verbal “sounds useful.”
4. Assumption: Customer data requests actually materialise in volume. How to test: ask every prospect how many Article 4 requests they’ve received since 12 Sept 2025. If the honest answer is zero across 25 firms, the pain stays theoretical through 2027.
5. Assumption: The register stays sticky rather than being a one-off setup purchase. How to test: track whether pilot customers re-run classification after a firmware release without being prompted.

Risk flags

1. Regulatory risk — cuts both ways, and this is the big one. VDMA is actively lobbying via the Digital Omnibus to extend the Article 7 exemption to medium-sized enterprises and small mid-caps. If Brussels grants it, my entire target segment is exempted and the product’s legal hook disappears overnight. This is a live legislative process, not a hypothetical. Watch the Digital Omnibus text continuously. The partial hedge: the pre-contractual disclosure and cloud-switching modules survive, and non-exempt firms above the band remain.
2. One-time-project risk. If buyers treat Data Act readiness as a project rather than a standing obligation, they’ll classify once, export the dossier, and cancel. The register only recurs if firmware changes force re-classification. Product must make the change-detection loop the centre of gravity, not the initial import.
3. Platform/standards dependency. If VDMA or Manufacturing-X ships a free, association-endorsed Data Act toolkit — plausible, given they already publish the Quick Guide and Regulatory Cockpit — the wedge narrows hard. Better to partner into that ecosystem early than to be positioned against it.
4. Advisory-incumbent response. EY and peers already market Data Act advisory services. They own the relationships. They’re slow and expensive at this price point, but they can bundle a mediocre tool into an existing engagement for free.
5. Enforcement softness. German reporting suggests the authority intends to lead with guidance rather than sanctions in the early months. A long grace period with no visible enforcement action pushes buying decisions right.

14. Structured verdict

Score:                  74/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       German-speaking technical founder with industrial automation
                        background (OPC UA / PLC literacy), paired with a fractional
                        EU data-law counsel. Sales-led, not product-led.
Time to revenue:        5–7 months (14–18 week build + Mittelstand purchase cycle)
Capital to launch:      €25–35K (~₹25–33L) — legal retainer is the main line item
Top 3 assumptions to validate first:
  1. Medium-sized builders accept they are in scope and are not waiting on the
     Digital Omnibus to exempt them — 25 structured calls, ask the question directly
  2. AI tag classification hits ≥80% agreement with a controls engineer —
     blind test on 5 real tag exports under NDA
  3. Article 4 requests are actually arriving — ask 25 firms for their count
     since 12 Sept 2025; zero across the board means the pain is still theoretical
Kill criteria:
  - Abandon if the Digital Omnibus extends the Article 7 exemption to medium-sized
    enterprises and small mid-caps (VDMA's explicit ask) — the legal hook dies
  - Abandon if fewer than 5 of 25 qualified firms report having received or expecting
    a customer data request within 12 months
  - Abandon if AI classification agreement with expert engineers stays below 70%
    after two prompt/rubric iterations — human review cost exceeds the price point
  - Abandon if VDMA or Manufacturing-X ships a free equivalent register before v1

15. Next step — 1-week validation sprint

• Day 1–2: Build the target list. Pull VDMA member directories for packaging, plastics, machine tools and food processing; filter to 50–500 employees; identify the Head of Digitalisation / Technical Compliance at 120 firms. In parallel, read the current Digital Omnibus draft text and get a written read from an EU data lawyer on whether the medium-sized exemption is likely to land — this single question can kill the idea before I write a line of code, so it goes first.
• Day 3–4: Send 120 German-language diagnostic emails naming a specific machine model and the six questions an Article 4 request will ask. Simultaneously, get 5 real tag exports under NDA from friendly contacts and run a blind classification against a controls engineer’s markup.
• Day 5: Decide.

Falsifiable go/no-go: proceed only if (a) counsel assesses the medium-sized exemption as unlikely to be granted in the Omnibus, and (b) ≥10 of 120 emails produce a booked call, and (c) ≥3 of those firms confirm they have already received or concretely expect a customer data request, and (d) blind classification agreement is ≥75%. Fail any one of the four and this drops to VALIDATE and waits for the Omnibus text to settle.