Definition: EU Data Governance Act
The EU Data Governance Act (Regulation (EU) 2022/868) is the EU regulation that builds the legal infrastructure for voluntary data sharing, setting rules for data intermediation services, data altruism organisations, and reuse of protected public-sector data.
Core characteristics of the EU Data Governance Act
The DGA does not force any company to share data. It creates neutral, trusted infrastructure that makes voluntary sharing practical and safe.
- Notification and supervision regime for data intermediation services like marketplaces and data pools
- Legal status for data altruism organisations collecting data for the public good, unpaid
- Conditions for reusing public-sector data protected by trade secrets, IP, or personal data rules
- The European Data Innovation Board, coordinating national authorities and data spaces
EU Data Governance Act vs. EU Data Act
Mittelstand teams often confuse this with the EU Data Act, but they are separate pillars. The Data Governance Act builds neutral sharing infrastructure; the Data Act grants a right to access data generated by connected products. A manufacturer can be fully Data Act compliant without ever touching a data intermediary.
Importance of the EU Data Governance Act in enterprise AI
AI systems need diverse training data a single company rarely holds alone, and DGA intermediaries offer a route to pooled industry data. The European Commission estimates the measures could add up to 197 billion euros to EU GDP by 2028, relevant for AI compliance planning around shared pools.
Methods and procedures for the EU Data Governance Act
Working with the DGA starts with identifying which track applies: intermediation, altruism, or public-sector reuse.
Registering as or using a data intermediation service
Companies offering data-sharing platforms between businesses must notify the authority before starting and stay structurally neutral.
- Notify the national competent authority (Bundesnetzagentur in Germany) before market entry
- Keep intermediation legally separate from other business lines
- Apply fair, non-discriminatory access conditions
Setting up or contributing to data altruism
Organisations collecting data for research or public-interest purposes can register as data altruism organisations, gaining the common EU logo and consent form.
Requesting reuse of protected public-sector data
Public bodies may grant access to data protected by trade secrets, IP, or GDPR, through single information points that set reuse conditions.
Important KPIs for the EU Data Governance Act
Tracking readiness spans registration and operational transparency.
Compliance operations
- Data intermediation services notified before launch: 100%
- Structural separation from other revenue activities: documented
- Altruism consent forms using the EU standard model: 100%
- Public-sector reuse requests via the single information point: 100%
Strategic exposure
Mittelstand companies exploring shared data pools carry rising exposure as sector data spaces launch; Bitkom’s orientation guide flags notification as a common blind spot.
Data quality and access reliability
Beyond registration, the data governance discipline behind a shared dataset decides whether it can be trusted.
Risk factors and controls for the EU Data Governance Act
Non-compliance risk concentrates around neutrality and unclear organisational roles.
Loss of intermediary neutrality
A data intermediation service that favours its own products, or monetises brokered data beyond a fee, breaches its core DGA obligation.
- Cross-selling brokered data into the provider’s own products
- Preferential terms for affiliated companies
- Undocumented reuse beyond the agreed purpose
Unclear organisational scope
Many Mittelstand companies entering a data space fail to separate the intermediary function from their core business, risking loss of neutral status.
Weak governance over what gets shared
Sharing data without clear internal data contract terms, covering purpose, retention, and withdrawal, creates disputes once AI systems have trained on it.
Practical example
A 95-employee industrial coatings manufacturer in North Rhine-Westphalia wanted to benchmark defect rates through a sector data pool but had no framework for joining safely. Its compliance lead checked the DGA’s rules, confirmed the pool operator was notified, and drafted data contracts. Within four months it was contributing anonymised data and receiving benchmark reports back.
- A documented decision on which DGA track applies to each initiative
- Written data contracts covering purpose, retention, and withdrawal
- Verification that the external data-space operator is registered
- A named internal owner for data-sharing decisions
Current developments and effects
Germany’s enforcement infrastructure took a major step forward in 2026.
The Bundesnetzagentur formally took on DGA duties
In May 2026 the Bundesnetzagentur confirmed it had assumed responsibility for notifying and supervising data intermediation services and registering altruism organisations.
- Fines for notification violations up to 500,000 euros
- Bitkom continues publishing sector guidance
- Authorities coordinate through the European Data Innovation Board
Sectoral data spaces are multiplying
Common European data spaces for manufacturing, mobility, health, and energy are moving from pilot to operational status.
The Data Governance Act and Data Act are converging
As manufacturers share connected-product data under the Data Act and pooled data under the DGA, teams increasingly manage both together.
Conclusion
The EU Data Governance Act is not a data-access law like the Data Act; it is the trust infrastructure that makes voluntary data sharing viable. For Mittelstand companies, the task is to know which DGA track applies, verify any intermediary is notified, and put clear data contracts in place. As data spaces mature, participation increasingly shapes what data is available for enterprise AI.
Frequently Asked Questions
What is the EU Data Governance Act in simple terms?
An EU regulation for voluntary data sharing: how data marketplaces operate, how organisations register to share data for the public good, and how public bodies let others reuse protected data.
How is it different from the EU Data Act?
The Data Governance Act builds voluntary-sharing infrastructure, the first pillar of the EU data strategy. The Data Act, the second pillar, grants access to data from connected products.
Does it apply to a Mittelstand company with under 100 employees?
Yes, if it operates a data intermediation service, registers as a data altruism organisation, or requests public-sector data reuse. Contributing to an already-notified pool carries lighter obligations.
What does compliance cost for a mid-sized company?
Most spend more on legal review of data contracts than on registration itself, typically low tens of thousands of euros.
Is there funding for participating in EU data spaces?
Several German and EU digitalisation programmes offer co-funding for sector data-space pilots, usually accessed through industry associations or the local IHK.
How does this relate to how Superkind builds AI?
Superkind connects AI agents to a company’s own systems rather than external data pools, so most deployments do not need DGA registration unless a company draws on one.
