On Sunday 11 October 2026, EU ambassadors were due to vote on the Council's position on the Digital Omnibus, the package meant to simplify the GDPR and the EU Data Act. The text was not even discussed. Four days earlier, Germany and France had already forced a delay. The sticking point is the same in both meetings: how well the Data Act protects trade secrets when manufacturers must share the data their products generate.
That sounds like a fight between diplomats, but it lands on the desks of engineering and product teams. Since 12 September 2026, connected products placed on the EU market must be designed so that users can access the data they generate. That data can say a lot about how a machine is built, tuned and controlled. Once it leaves the company, the only thing standing between it and a competitor is a contract and a set of protective measures.
The open question in Brussels is how easily a manufacturer may say no. The Data Act today allows a refusal only in exceptional cases. The Commission wants to make refusal easier. Germany wants something stronger: no sharing of trade secrets without an explicit agreement. Here is what is on the table and what to do while the rules are still moving.
TL;DR: the Data Act trade secrets fight in one paragraph
The EU Council has still not agreed its negotiating mandate on the Digital Omnibus. Coreper postponed the vote on 7 October 2026 under pressure from Germany and France, and on 11 October the text was not discussed at all. Berlin wants trade-secret-protected data to be shared only with an "explicit agreement" between data holder and user. The Irish compromise would instead let data holders refuse access when they can show a high risk of unlawful use or disclosure, in particular by entities in third countries with weak protection. Nothing has changed in law yet: today's Data Act still applies. Whatever the final text says, a refusal or a confidentiality claim will only work if you can show what your trade secrets are, how you protect them and who accessed them.
What happened in the Council in October?
The Digital Omnibus was proposed by the European Commission on 19 November 2025. It bundles changes to several digital laws, mainly the GDPR, the cookie rules and the Data Act. Before the Council can negotiate with the European Parliament, the member states' ambassadors in Coreper must adopt a common position, called a mandate.
The Irish presidency, which chairs the Council until the end of 2026, updated its compromise text after a preparatory meeting on 25 September and sent it to Coreper for a decision on Wednesday 7 October. That day the ambassadors only discussed it. According to Agence Europe, the vote was postponed under joint pressure from Berlin and Paris, and the report was blunt about why: "The protection of trade secrets is central to the two capitals' reservations." Both governments consider the Data Act's provisions on the issue insufficient.
A new vote was planned for Sunday 11 October. It did not happen. Agence Europe reported on 13 October that the text was neither discussed nor voted on, that Germany still has reservations about the trade secret provisions, and that the presidency may hold further consultations with national delegations. No new date has been announced.
What does the Data Act say about trade secrets today?
The Data Act has applied since 12 September 2025. It gives users of connected products, from industrial machines to smart devices, a right to access the data those products and related services generate, and to share it with third parties such as repair shops or service providers. Since 12 September 2026, new products must also be designed so that this data is accessible by default.
Trade secrets are not wiped out by these rights, but they are not a free pass either. The data holder can require the user, or the third party, to agree technical and organisational measures that keep the information confidential, and can suspend sharing if those measures are not respected. Refusing access outright is much harder. The current text allows it only case by case, in exceptional circumstances, where the data holder can show that disclosure is highly likely to cause serious economic damage despite those measures. The refusal must be explained in writing without undue delay and notified to the national competent authority, and the user can complain.
For engineering companies, the important detail is scope. The Data Act covers data generated by the use of a product, such as sensor readings, usage logs and operating states. It does not hand over CAD models or drawings. But machine data can reveal a lot about design choices, control logic and process parameters, which is why many manufacturers see it as a back door to their know-how. Our guide to the legal framework for trade secret protection of CAD designs explains why that know-how is often protected only as a trade secret, not by a patent.
What would the Digital Omnibus change?
The Commission's proposal loosens the refusal test. According to an analysis by Greenberg Traurig, it removes the "exceptional circumstances" condition, lowers the bar from "highly likely" to "likely" serious economic damage, and turns the factors for judging that damage into examples rather than fixed criteria. It also adds a new ground: a data holder may refuse when there is a high risk that the data will be unlawfully acquired, used or disclosed by entities in third countries, or under third-country control, that do not offer equivalent protection.
The Irish compromise keeps that direction and adds detail. It strengthens what is often called the Data Act's handbrake and asks the Commission to publish guidelines on how to assess serious economic damage, how to judge whether trade secret protection can actually be enforced in a third country, and which categories of sensitive data in critical sectors could cause serious harm. Germany's position goes further. Berlin wants data protected as a trade secret to be shared only on the basis of an explicit agreement between the data holder and the user.
Why do Germany and France care so much?
Both countries have large manufacturing bases: machinery, automotive, aerospace, energy and industrial equipment. These are exactly the sectors where connected products produce rich operating data, and where a competitor, including one outside the EU, could learn a lot from it. Agence Europe described Germany as among the member states most concerned with strengthening trade secret protection.
The tension is real on both sides. The Data Act was written to stop manufacturers from locking customers into their own repair and service networks. A wide refusal right could bring that lock-in back, while a narrow one exposes years of engineering work. The Council has to find a line between these views before it can even start talks with the Parliament.
Know which files and data are your crown jewels. CADChain gives engineering teams blockchain proof of ownership and file-level access control for CAD files across CAD systems, so you can show what is yours and who opened it.
👉 See how CADChain protects design IP
What does this mean for deep-tech founders and engineering teams?
Whatever the Council decides, every version on the table has one thing in common: the data holder has to prove something. Today it must show that serious economic damage is highly likely. Under the Commission and Irish texts, it must show that damage is likely or that there is a high risk of misuse abroad. Even Germany's explicit agreement model only works if you can point to which data is a trade secret in the first place.
Under the EU Trade Secrets Directive, information only counts as a trade secret if the owner has taken reasonable steps to keep it secret. Courts look at evidence: access rules, confidentiality agreements, labelling, logs. A company that cannot show who had access to a design, when, and under which terms will struggle to claim protection, whether in a Data Act dispute or in a theft case. We have seen this play out in court this month, in the Apple v. OpenAI trade secrets case, where forensic images of devices became central.
There is also a supply chain angle. The new third-country ground focuses on where data could end up. Engineering teams that share models and drawings with suppliers abroad already face the same question. Geographic restrictions in CAD DRM and view, edit, print and export permission levels give a practical answer: decide in advance which files may be opened where, and by whom.
Is a contract enough to protect shared data?
Every version of the rules leans on agreements: confidentiality measures today, explicit agreements in the German model. Contracts matter, but they only work after the fact. They let you sue once data has leaked, not stop the leak. Our article on why NDAs are not enough for CAD protection explains the gap, and the $116.9 million Joby trade secret verdict shows how much depends on evidence of what was shared and when.
The stronger pattern is to combine contracts with controls that travel with the data. For design files, that means encryption and access rules attached to each file, the ability to revoke CAD file access after sharing, and tamper-proof audit trails that record every open. For machine data, it means knowing which data streams reveal design or process know-how, and treating them with the same care.
What should manufacturers do now?
- Map your trade secrets. List the designs, process parameters, control logic and data streams that you treat as confidential. Our trade secrets guide for deep tech startups shows how to build that register.
- Check what your products share. For each connected product, list the data a user could request under the Data Act and mark where it could reveal design or process know-how.
- Prepare confidentiality measures. Draft standard technical and organisational measures for data requests, so you can offer them quickly instead of refusing.
- Document reasonable steps. Keep evidence of access rules, labels, agreements and logs. See audit trail requirements for IP litigation for what courts expect.
- Know where data goes. Record which suppliers, partners and users sit outside the EU, and which jurisdictions you would rate as high risk. This is the core of the proposed third-country test.
- Protect design files at the file level. Encrypt sensitive CAD files, set permissions per file and keep proof of ownership that does not depend on a single platform. Our guide to legal proof of CAD file ownership explains which records hold up.
These steps are useful under every version of the text, and most of them also help with the EU Cyber Resilience Act, whose reporting obligations started in September 2026. If you depend on a big PLM vendor, our look at the Schneider Electric PTC acquisition covers Data Act switching rights from the other side: getting your data out.
How does this fit the bigger picture?
This week our sister sites looked at the same question from other angles: who controls design data, and who may use it to train AI.
- Open geometry for AI. Nvidia released an open-source B-rep CAD kernel that makes exact CAD geometry easier for AI tools to read. Read what the Nvidia USD BRep kernel means for SOLIDWORKS users and the ownership of their designs on solidboris.com.
- AI needs trusted data. Autodesk's 2027 State of Design & Make report found that 75% of companies plan to spend more on AI, but only 40% are close to their AI goals. Our sister site explains what the report means for Inventor and Vault data.
- Who owns AI-edited models? Meshy launched AI editing of 3D models. Blended BORIS looks at what Meshy's terms say about owning and training on your 3D models and how artists keep proof of authorship.
Conclusion
The Digital Omnibus was supposed to make EU digital law simpler. On trade secrets, it has instead exposed a deep split: users and service companies want data to flow, while Germany, France and many manufacturers want a firmer right to say no. Until the Council agrees a mandate and the Parliament has its say, the current Data Act applies, with its narrow, exceptional-circumstances refusal.
The practical lesson does not depend on how the fight ends. Every version of the rules rewards companies that know what their trade secrets are, protect them with real controls, and can prove who accessed what and when. Build that evidence now, and you will be ready for a narrow handbrake, a broad one or an explicit-agreement model.
Make your design IP provable, not just confidential. CADChain adds file-level access control, access logs and blockchain proof of ownership to CAD files, across CAD systems.
👉 See how CADChain works
FAQ: EU Data Act trade secrets and the Digital Omnibus
Why did the Council vote fail in October 2026?
Coreper postponed its vote on 7 October 2026 under pressure from Germany and France, whose reservations centre on trade secret protection in the Data Act. On 11 October the text was not discussed or voted on, and no new date has been set.
Can a manufacturer refuse to share data to protect trade secrets today?
Only in exceptional circumstances, case by case, if it can show that serious economic damage is highly likely despite agreed confidentiality measures. The refusal must be explained in writing and notified to the national competent authority.
What would change under the Irish compromise?
Data holders could refuse access when they show a high risk of unlawful use or disclosure by entities under the jurisdiction of third countries with insufficient protection. The Commission would publish guidelines on assessing serious economic damage and third-country risk.
What does Germany want?
Germany wants data protected by a trade secret to be shared only on the basis of an explicit agreement between the data holder and the user seeking access.
Does the Data Act force companies to share CAD files?
No. It covers data generated by the use of connected products and related services, not design files as such. But product data can reveal design and process know-how, which is why trade secret protection matters.
When will the new rules apply?
That is not known. The Council first needs a mandate, then negotiations with the European Parliament, then formal adoption. Until then, the current Data Act applies.
