Data Sovereignty in Manufacturing: What the EU Data Act Requires

Data sovereignty in manufacturing defines who controls, accesses, and shares production data across factory systems, cloud platforms, and partner ecosystems. The EU Data Act took effect on September 12, 2025, creating legal obligations for manufacturers across Europe to provide machine data access to equipment buyers and third parties. At IIoT World Manufacturing & Supply Chain Day 2025, executives from Cybus, Schunk, MaibornWolff, and Schwarz Group discussed what data sovereignty means in practice, how to architect a sovereign factory, and where cybersecurity blind spots put production data at risk.

Why Does Data Sovereignty Matter for Manufacturers?

Data sovereignty addresses a problem most factories face today: nobody is actually in control of their production data. Interconnected but poorly governed systems create a mess where operational data sits in silos, inaccessible to the people and processes that need it.

Peter Sorowka, CEO of Cybus, asked during the panel: “Does my production stop when AWS or Cloudflare has a hiccup?” If the answer is yes, the company has a data sovereignty and operations sovereignty problem it has not yet solved. Cloud sovereignty and data sovereignty are connected but separate: a company can run workloads on a sovereign European cloud and still lack data sovereignty if machine data stays locked inside proprietary vendor systems.

The economic impact goes beyond compliance. Manufacturers cannot optimize operations without full transparency across all machines and data points. Sharing data with partners, suppliers, and customers requires trust in the systems that handle it. Companies remain hesitant because leaked construction plans or proprietary process data, once exposed, cannot be recalled. Every cloud service, every third-party integration, every data-sharing agreement requires manufacturers to weigh what they gain against what they expose.

What Are the Three Dimensions of Data Sovereignty?

Solving this requires clarity on what “sovereignty” actually covers. Manufacturing data sovereignty spans three dimensions: technology, regulation, and organization. Schwarz Group structured a governance framework around these dimensions, spanning IT, OT, IoT, edge, and cloud environments as both an internal model and a benchmark for other companies.

Many companies overlook the infrastructure dimension entirely. They focus on unified namespace and data analytics while neglecting the underlying infrastructure that should allow workloads to move between cloud and on-premises environments without reconfiguration.

What Architecture Does a Sovereign Factory Need?

Once these dimensions are clear, the next challenge is building the systems that enforce them. A sovereign factory data architecture typically consists of three layers: infrastructure, data integration, and semantic contextualization. Each builds on the one below it, and all three must be in place before manufacturers can control how production data flows between machines, cloud platforms, and external partners.

The infrastructure layer provides standardized compute environments from cloud to edge, where workloads deploy identically whether running in the cloud or on-premises. The data integration layer connects machines through a pub/sub mechanism, typically an MQTT broker implementing a unified namespace, standardizing data as close to the source as possible.

The semantic layer is the most difficult to implement because it requires people from every operational unit to define, validate, and take ownership of data points. Schunk has the first two layers in place but is still constructing the semantic layer. This layer demands more effort than most companies anticipate. Open standards and standardized APIs are design requirements across all three layers. Building all three at once requires years and C-level backing, so the panelists recommended starting with use cases that deliver immediate value and letting those drive the architecture forward step by step.

How Does the EU Data Act Change Machine Data Access?

Architecture enables data access, but regulation makes it a legal right. The EU Data Act became enforceable on September 12, 2025, granting machine users the legal right to access and share data generated by connected equipment. Manufacturers can now require that vendors provide access to data generated by their machines. Since September 12, 2026, all new connected products entering the EU market must comply with “Access by Design” requirements.

This legislation resolves a long-standing frustration: manufacturers previously struggled to get data out of machines or had to pay significant amounts for it. The regulation also intersects with the EU AI Act, which governs how AI systems process manufacturing data. Internal compliance departments, however, sometimes create barriers stricter than what the legislation actually demands. The panelists recommended engaging with regulatory bodies rather than defaulting to the most restrictive interpretation.

Why Should Non-EU Manufacturers Care?

Even manufacturers outside EU jurisdiction benefit from sovereign architecture. Data sovereignty is a design principle applicable to any geography, and any manufacturer that wants flexibility in choosing where to process data, which cloud provider to use, and how to share information with partners gains from building it in, regardless of whether the EU Data Act applies directly. Sovereign architecture does not require abandoning global cloud platforms. According to the panelists, Europe already has strong solutions for industrial connectivity, but Databricks, Snowflake, and Azure Fabric still lead in data analytics and AI tooling. A standards-based architecture lets manufacturers use these global platforms for analytics while keeping control of production data closer to the source.

Three universal drivers apply everywhere:

1. Vendor independence. Companies that can switch between cloud providers, move workloads from cloud to edge, or change analytics platforms without service interruption operate with lower risk. Schwarz Group built its entire technology stack on this principle: the ability to walk away from any vendor relationship without consequences or lock-in.
2. Partner trust. Sharing production data with suppliers, customers, or ecosystem partners requires governance structures that define who sees what, for how long, and under what conditions. This applies to manufacturers in every geography.
3. AI readiness. The next generation of industrial software will be AI-native, with conversational interfaces replacing dashboards and MES platforms that plan production more independently. Factories with sovereign, well-governed data infrastructure will adopt these tools faster than those still untangling proprietary vendor silos.

How Does Manufacturing-X Enable Sovereign Data Exchange?

Individual companies can build sovereign architecture internally, but sharing data across company boundaries requires ecosystem-level infrastructure. Manufacturing-X is a German Federal Ministry-funded initiative under the Plattform Industrie 4.0 umbrella that builds on the Gaia-X European cloud framework to establish sovereign, interoperable data ecosystems for industrial value chains.

The initiative includes sector-specific projects: Catena-X for automotive, Factory-X for factory equipment, and Energy Data-X for the energy sector. Each project creates data spaces where companies share information while retaining control over it. The infrastructure uses federated identity management, standardized APIs, and policy-based access controls.

A related European opportunity sits behind this infrastructure. European manufacturers hold deep domain knowledge in production processes and operational optimization. Industrial foundation models trained on this collective knowledge could give European industry a competitive advantage in AI-driven manufacturing, provided the data governance infrastructure is in place to enable secure sharing.

What Cybersecurity Blind Spots Threaten Sovereignty?

None of this architecture delivers value if attackers can bypass it. Basic cybersecurity hygiene remains absent in many factory environments, creating risks that undermine sovereignty efforts regardless of how well the data architecture is designed. Network segmentation is still missing at some sites, and most machines have open network communication ports without encryption or password protection. The attacks do not need to be sophisticated: dropping five USB sticks in a factory parking lot is often enough, because someone will pick one up and plug it in.

Peter Sorowka described the shop floor as “from a cybersecurity point of view, total wild west.” Anyone with network access can control equipment, making a robot turn the wrong way and hurting people or destroying business value. Manufacturers want to connect everything for optimization while keeping systems locked down, a contradiction the industry has yet to resolve. AI-generated malware, deepfake impersonation of executives, and poisoned training data represent emerging attack vectors that grow more dangerous as human-robot interaction becomes tighter on production lines.

This article is based on a panel discussion at IIoT World Manufacturing & Supply Chain Day 2025, featuring Peter Sorowka of Cybus, Marc Jäckle of MaibornWolff, Martin May of Schunk, Aleksandar Hudic of Schwarz Group, and Lara Ludwigs of Cybus as moderator. AI tools were used to help summarize and organize the content. Reviewed and edited by the IIoT World editorial team.

Additional Sources: EU Data Act, Manufacturing-X (Plattform Industrie 4.0), Gaia-X

Sponsored by Cybus