Let’s talk about the tractor that knows more about your farm than you do.
Picture a farmer just outside Klerksdorp. He runs a combine that logs yield metre by metre, a pump that reports its own pressure and hours, and a bakkie with a telematics box bolted under the dash. Between those three machines, something has quietly assembled a fairly complete picture of his operation — soil behaviour, diesel burn, machine wear, the exact yield curve of every land he farms. He can see some of it inside the dealer’s app. He cannot take any of it out.
And he’s not a man with a grudge against technology. He just wants his own harvest numbers in his own spreadsheet before he walks into the bank, because the man across that desk is going to ask him to prove something about his farm and the only people holding the proof are the people who sold him the machines.
Now walk away from that dam wall and go to Brussels, because a law has been doing this work for a year now, and it’s the template everyone else is going to copy.
On 12 September 2025, the EU’s Data Act became applicable. Regulation 2023/2854. It is the first serious attempt by a major economy to say something blunt out loud: if you buy a connected product, the data that product generates through your use of it is yours to access, and yours to share with whoever you choose — a mechanic, an insurer, an agronomist, a rival dealer, whoever.
And two days ago, on 12 September 2026, the second half of that promise kicked in: connected products placed on the market from that date have to be designed so the user’s access exists by default. Not granted as a favour. Not unlocked after a support ticket and a phone call to a regional manager. Built in.
That is a real shift and I’ll say so plainly. For the first time in a serious jurisdiction, the default assumption flipped. The machine arrives owing you something.
Here’s what people are missing, and it’s the whole episode.
A right you cannot physically exercise is not a right. It’s a request with better paperwork.
Because the same law has a door in it. Manufacturers can withhold data where they can argue trade secrets, or where release would compromise security. Maybe that door is genuinely narrow on paper. But think about who is standing at it. The person deciding how your request gets handled is employed by the party whose commercial interest is to slow you down. They choose the format. They choose the API. They choose whether it’s a clean file or a PDF of a screenshot. And a right that arrives as a PDF of a screenshot is a right that exists for lawyers and not for farmers.
Then there’s the deeper thing, the part that should bother anyone who’s spent time inside a platform business. Data rights are always downstream of architecture. You can’t legislate a format into existence after the fact. So the honest engineering question is never “are you allowed to access your data.” It’s “was the thing built so access was the path of least resistance, or the exception.”
Which is why the second half of that law matters more than the first. The same package bans switching charges on cloud contracts, phased in so that new deals lost them immediately and older contracts lose them by early 2027. Same package puts safeguards around non-EU government demands for data held by European cloud providers.
Read those two together and you see what the Europeans understood. Lock-in is not about your files sitting in someone’s bucket. It’s about the exit being expensive enough that you stop looking for one.
So let me drag this back to the bakkie and the combine, and to everyone building something.
If you sell software today and your customer’s data only exists in a readable, useful form inside your product, understand what you’ve actually built. Not a moat. A hostage. Hostages get regulated, then copied by someone with a worse product and a better export button, then abandoned when the customer finally gets tired of asking.
The version that ages well is the boring one. The format that lives with the user. The export that takes one click and produces something a human can read without you in the room. The log that a farmer can hand to his bank, his vet, his diesel supplier, or his brother-in-law, without asking anyone’s permission first.
I’ve watched this pattern long enough to know which way it cuts. The companies that hoard the context get the short-term advantage and the long-term audit. The ones that hand it back get the trust, and the trust is the thing that actually compounds — slowly, in the years when the numbers look bad and nobody is watching.
Here’s the South African part, because I’m not going to pretend Brussels is the whole story. We have POPIA. We have a right to ask what a company holds about you. What we do not have is a right to walk into the dealership and demand the raw feed from the machine you paid for and now depend on. Around here the data stays where it was generated, and the person who farms the land is the last one in the chain to see it. That gap is not a paperwork problem. It’s negotiating position, and it costs money every single season.
So the principle worth holding onto after this year of the Data Act is smaller and harder than it sounds.
Ownership that stops at the metal is not ownership. If the machine knows something about your life and you can’t get it out, the machine is reporting to someone else about you.
And that will keep being true whether the law shows up on time or not. Because the fix was never going to be the right to file a request with the people who already have you.
It’s being able to walk out with your own file in your hand.