EU Data Act Guidance Rewires SaaS Architecture: Portability APIs Are Now a Regulatory Deliverable

Something quietly extraordinary happened on 6 October 2026. The European Commission released a tranche of guidance clarifying exactly how the EU Data Act applies to SaaS subscriptions, and it reads less like a legal FAQ than a product specification. For engineers, the document is a schema. For founders, it is a deadline.

What the Guidance Actually Says

The October 6 document is precise in a way that earlier Data Act texts were not. Where the regulation's Chapter VI spoke broadly of "switching obligations," the new guidance names data categories, API surface requirements, and contractual disclosure formats. Providers must offer a structured, machine-readable export of all customer-owned data, and the open interfaces enabling that export must be made available at no charge. Think of it as a forced GET /export/all endpoint: documented, versioned, accessible to the destination provider without access to your internal SDKs.

The guidance also hardens the timeline architecture. The two-month notice-period-before-export-delivery is confirmed as a ceiling, not a floor. The subsequent transitional period for completing the switch is capped at thirty calendar days; where that is genuinely technically unfeasible, a provider must notify the customer within fourteen working days and cannot invoke an alternative period exceeding seven months. The guidance draws a hard line on IP exemptions: trade-secret protections cannot be invoked to delay switching, only to mark specific internal data as out of scope. You cannot hide behind a confidentiality clause to hold a customer's own records hostage.

For the data flow itself, the obligation is layered. Input data, records the customer created, is unambiguously exportable. Output data, including AI-generated results derived from customer inputs, is also in scope. Change history, relational identifiers, and attachment metadata are explicitly listed. In pipe-and-filter terms: if data flowed in through the customer's agency, it must be able to flow out through a documented channel.

Article 27: The Engineering Core

The open-interface requirement under Article 27 deserves its own whiteboard session. The Data Act defines an "open interface" as one documented with sufficient precision that a technically competent party can use it without access to internal systems or proprietary SDKs. This is closer to an open specification than open source. The distinction matters: you are not required to publish your codebase, but you are required to publish your auth mechanism, your data-field catalogue with types and encoding, your rate limits, your error semantics, and your retry behaviour. The European Commission is also establishing a central registry of open interface specifications; providers will be required to register their portability API there once the registry process is live. As of mid-2026, sector-specific harmonised format standards for generic SaaS are still in development, but the Commission has already issued Standardisation Mandate M/614 to CEN, CENELEC and ETSI, who accepted it in July 2025.

The functional-equivalence obligation applies differently by service tier. IaaS providers must take all reasonable measures to ensure customers achieve functional equivalence when moving to an alternative. SaaS and PaaS providers are held to the open-interface and machine-readable-format standard instead: compute parity is not the obligation, data portability is. In traffic-system terms, the motorway authority doesn't have to build you the same junction at the destination, but it does have to give you an on-ramp.

The January 2027 Cliff Edge

The switching rules have applied since 12 September 2025. The next milestone is the one that will move commercial decisions: from 12 January 2027, providers may not impose any switching or egress charges on customers for the switching process. Until then, only cost-reduced charges directly linked to switching are permissible. For any SaaS business with data-egress fees embedded in its pricing model, and a great many do, quietly, this represents a revenue-line implosion that needs to be engineered around before Q1 next year.

The business impact is structural. Historically, SaaS contracts used data lock-in to depress churn and boost net-revenue retention. The guidance makes that model a compliance liability. Every enterprise SaaS contract currently in negotiation with an EU-based customer should already contain Article 25 mandatory switching terms: the right to initiate a switch on maximum two months' notice, an exhaustive list of exportable data categories, a retrieval period of at least thirty days post-transition, and guaranteed erasure thereafter. If those terms are not present, the contract is non-compliant today.

Where UK Providers Stand

The UK is outside the EU regulatory perimeter post-Brexit, but the Data Act's territorial scope extends to any provider offering services to customers in the EU, regardless of where the provider is incorporated. A SaaS company based in Manchester or Edinburgh serving a Munich enterprise client is caught. The practical consequence for UK-headquartered providers is that they are simultaneously managing their domestic regulatory environment, including the DSIT AI Risk Management Toolkit published this month for UK public-sector AI deployments, while rebuilding contract templates, export pipelines, and API documentation for EU compliance.

The trademark picture adds a further signal. AIBD analysis of UK IPO data shows just 1,262 Class 42 trademark filings in Q4 2026, a fall of 84.6% against the prior period. Class 42 is the Nice Classification home for SaaS, cloud computing, and AI services; since the Nice 13th Edition came into force on 1 January 2026, it now explicitly includes "Artificial Intelligence as a Service (AIaaS)" as a formal term. A collapse in Class 42 filings of this magnitude, in the same quarter that compliance requirements are sharpening, suggests either that the software sector is consolidating its IP strategy (filing earlier, in bulk, ahead of new classification requirements) or that the registration pipeline is clearing a prior surge. Either way, the signal is worth watching: brand protection in AI services has never been more tightly coupled to the legal architecture of data obligations.

The Engineering Checklist That Follows

For engineers, the October 6 guidance essentially produces a product backlog. Saga Compliance's readiness checklist maps directly to sprint items: update customer contracts with Article 25 exit terms; publish switching procedures and format registrations; build and test a complete export covering input data, output data, and customer-use metadata; expose documented open interfaces for portability; define the operational workflow for two-month notice, thirty-day transition, retrieval, and erasure. Rate-limiting export endpoints is permitted, but the implementation must not make the thirty-day switching window practically unworkable; you cannot throttle your way out of compliance.

Article 27 compliance means treating the export API with the same documentation rigour as your core product API. Not behind a login wall. Not reliant on your internal admin tooling. Publicly accessible, versioned, precise.

Six to Twelve Month Implications

By January 2027, egress fees for switching are gone for EU customers. The providers who will handle that best are the ones who have re-engineered switching as a product experience rather than a legal obligation, turning the forced portability endpoint into a migration-assistance feature that reduces customer anxiety rather than creating it. Expect the next generation of SaaS contract templates to compete on switching transparency the way cloud providers once competed on uptime SLAs. Expect engineering roadmaps to carry "Data Act compliance" as a named epic through Q1 2027. The open-interface registry at the Commission will become, quietly, one of the more consequential pieces of EU digital infrastructure of the decade: the place where portability specifications live, where competitors can inspect your data schema, and where regulators will look first when a switching complaint arrives.