The EU Data Act in plain words: what it changes for cloud and AI

Most people who run IT in Europe have heard of the GDPR and, by now, the AI Act. Far fewer have read the EU Data Act, which is a shame, because it quietly rewires two things that matter a lot when you buy AI: how easily you can leave a cloud provider, and what happens to your data when a foreign government comes asking.

The Data Act, formally Regulation (EU) 2023/2854, has applied across the Union since 12 September 2025. The European Commission's own summary frames it as a law about "fairness in the data economy." That is true but a bit abstract. Let me pull out the parts that touch anyone running software.

Leaving a cloud provider is supposed to get easier, and cheaper

If you have ever tried to move a few terabytes out of a hyperscaler, you know the drill. The data is easy to put in and strangely expensive to take out. Those egress fees were never really about the cost of bandwidth. They were a fence.

Chapter VI of the Data Act (Articles 23 to 31) goes after that fence directly. Providers have to remove the commercial, technical and contractual obstacles that stop you switching to a different provider, moving to your own on-premises infrastructure, or running several providers at once. And Article 29 sets a clock on the fees themselves: switching charges are being reduced during a transition period and must be gone entirely from 12 January 2027, as legal analyses from firms like Greenberg Traurig spell out. After that date, moving your data out is supposed to cost you nothing.

Read that again with a procurement hat on. The EU has decided that lock-in through exit fees is a problem worth legislating away. If a regulator thinks the switching cost is the issue, the cleanest answer is the arrangement where there is no provider to switch away from in the first place.

The part about foreign governments

Article 32 is the one that does not get enough attention. It requires providers of cloud and edge services to put in place technical, legal and organisational measures to prevent unlawful access by third-country governments to non-personal data held in the EU, where that access would clash with EU or member-state law.

Note the careful wording: non-personal data. Personal data transfers are still governed by Chapter V of the GDPR, which is a separate conversation. But the fact that the EU felt it needed a dedicated article about foreign state access to ordinary business data tells you how real the concern has become. The worry has a name in most people's minds, the US CLOUD Act, and the Data Act is the Union writing a partial answer to it into law.

What this means if you are adding AI

Here is where it gets concrete for anyone rolling out an assistant or a document-search tool. Every prompt, every uploaded file, every retrieved passage is data leaving your control the moment it hits a cloud model's API. The Data Act does not ban that. It just keeps chipping away at the assumption that your data naturally lives in someone else's data centre.

If you run the model locally, the whole question of switching costs, egress fees and third-country access stops applying to your AI workload. Not because you found a clever contractual workaround, but because the data never became someone else's problem to begin with.

None of this is legal advice, and the Data Act interacts with the GDPR, the Data Governance Act and sector rules in ways your counsel should map for your situation. But the direction of travel is not subtle. Europe is legislating for a world where you can pick up your data and walk. Running AI on your own hardware is simply the shortest version of that walk.