GAIA-X. Manufacturing-X. Catena-X. The EU Data Act. Anyone who still thinks these terms are academic concepts with no practical relevance in 2026 will be in for an unpleasant surprise over the next 24 months. The European data industry is on the move - and it is moving faster than most manufacturing companies realize.
The real question is not: 'What is GAIA-X? The real question is: "What does it mean for my company - and what do I have to do now?" While large corporations are running Catena-X pilots and forming Manufacturing-X consortia, medium-sized production companies are faced with the question: Am I affected? When? Where do I start?
This article answers these questions. Without buzzword bingo. With concrete classifications for manufacturing and production companies in the DACH region.
|
THE MOST IMPORTANT FACTS IN BRIEF
|
|
BRIEFLY SUMMARIZED
|
A data room is an infrastructure that enables companies to share data with other participants - on the condition that they retain sovereignty over their data. That sounds simple. The difference to previous data exchange models is fundamental.
Previously, if company A wanted to pass on its production data to company B, it exported a file via email or API. Once handed over, A no longer had any control over what B did with it. In the data room: A defines who can access which data and under what conditions. The data remains in A's infrastructure. B gets access - but not an uncontrolled copy.
|
Sep. 2025 EU Data Act in force EUR-Lex Regulation (EU) 2023/2854 |
700+ GAIA-X members worldwide GAIA-X AISBL, status 2025 |
200+ Catena-X participants Catena-X e.V., as of 2025 |
2027 Manufacturing-X broad rollout Industry 4.0 platform |
Firstly, regulatory pressure: the EU Data Act creates legal data sharing obligations for manufacturers of networked products for the first time - in force since September 2025. Secondly, market pressure: OEMs in the automotive industry and major customers in the process industry require their suppliers to be able to connect to data rooms as a condition for supplier qualification. Thirdly, technological maturity: GAIA-X-compliant connectors and data room protocols will be ready for production in 2025.
The combination of these three drivers makes the difference between 'academically interesting' and 'need for action'. For medium-sized production companies in the DACH region, the transition from the latter is already underway.
|
2021 GAIA-X founded Initiative France/Germany |
2022 IDSA Standard v1 First open connector standard |
2023 Catena-X live First productive data room |
2024 Cofinity-X launch Managed service for SMEs |
Sep. 2025 EU Data Act Data sharing obligations in force |
2026/27 Mfg-X rollout Manufacturing-X broad rollout |
The most common misunderstanding first: GAIA-X is not a cloud platform, software or a product that you can buy or subscribe to. GAIA-X is a European initiative to create a common set of rules for trustworthy data infrastructures.
Specifically, GAIA-X defines standards, certification requirements and technical protocols that ensure that data rooms and cloud services in Europe are operated according to uniform sovereignty and interoperability rules. Anyone who operates a GAIA-X-compliant infrastructure meets these standards.
|
LEVEL 4 Governance & standards |
GAIA-X AISBL & Labeling Set of rules, certification and compliance requirements for all GAIA-X-compliant services. Basis for trust between participants. |
|
LEVEL 3 Data room infrastructure |
IDSA / Eclipse DSP / EDC Technical protocols for data space connectors (Eclipse Dataspace Connector), identity management and access negotiation between participants. |
|
LEVEL 2 Industrial data rooms |
Catena-X - Manufacturing-X - Cofinity-X Industry-specific data spaces based on GAIA-X. Each data room has its own governance, data objects and conditions of participation. |
|
LEVEL 1 Enterprise applications |
Use cases & business apps Concrete use cases: Traceability, CO₂ footprint, predictive maintenance, quality data sharing along the supply chain. |
|
WHAT GAIA-X IS NOT - THE MOST COMMON MISCONCEPTIONS GAIA-X is not a European AWS or Azure - it is not a cloud platform that you can book. GAIA-X is not a finished product - it is an ongoing initiative with sub-projects that are increasingly ready for production. GAIA-X is not optional for OEM suppliers - Catena-X participation is set as a supplier requirement by automotive OEMs. GAIA-X is not just for IT departments - the question of "What data do we share with whom?" is a management decision. ✓ GAIA-X is the set of rules on which Catena-X, Manufacturing-X and other industrial data rooms are built. |
GAIA-X is based on several industry-specific data rooms that are directly relevant for manufacturing companies in Germany.
|
CX Productiov from 2024 |
AUTOMOTIVE / SUPPLIERS Catena-X Automotive Network |
|
Goal: Standardized data exchange along the automotive supply chain - from OEM to Tier-n. Focus: Traceability, CO₂ footprint, quality data, product passport. Participants: BMW, Mercedes-Benz, VW, BASF, Bosch, Continental, SAP + 200 others |
|
|
What data is shared
|
Relevance for production companies Very high. OEMs set Catena-X as a supplier requirement. Tier 1 pressure on Tier 2 and Tier 3 growing 2026/27. |
|
MFG-X PILOTS 2025-26 |
DISCRETE MANUFACTURING & PROCESS INDUSTRY
Manufacturing-X |
|
Goal: Cross-industry data room for mechanical engineering, electrical industry and process automation. Focus: machine data, operational monitoring, maintenance optimization. Participants: VDMA, ZVEI, Industry 4.0 platform, BMWi consortium |
|
|
What data is shared
|
Relevance for production companies High for machine manufacturers and plant operators. Pilot operation 2025, broad rollout from 2027. |
|
CFX OPERATIONAL FROM 2024 |
SUPPLY CHAIN / MULTI-INDUSTRY
|
|
Goal:Joint operator model for Catena-X and other data rooms. Onboarding, identity management and marketplace as a managed service for SMEs. Participants: BMW, Mercedes-Benz, VW, ZF, Bosch + other OEMs as founding partners |
|
|
What data is shared
|
Relevance for production companies Medium to high. Recommended entry path for SMEs without their own GAIA-X infrastructure. |
The EU Data Act has been in force since September 12, 2025. It is the most stringent instrument of European data law since the GDPR and creates legal data sharing obligations for the first time - not only data protection rules, but also third-party data claims to data that companies generate.
Anyone who manufactures or markets connected products or machines is obliged to provide the users of these products with access to the data generated. This does not just apply to consumer products - it applies to industrial machines, IoT-enabled production systems, smart tools, vehicles and medical devices.
Specifically, if a production system generates sensor data and the operator wants to access this data - including via a third-party provider for maintenance services - they have a legal right to do so. The machine manufacturer can no longer block this right with proprietary data silos.
|
Machine manufacturers (IoT / networked devices) |
Plant operators (production & manufacturing) |
Third-party providers (maintenance, analytics) |
|---|---|---|
|
Core obligations from entry into force:
|
Core obligations from entry into force:
|
Core obligations from entry into force:
|
|
From: September 12, 2025 Sanction: up to 4% global annual turnover |
From: September 12, 2025 Sanction: no direct fines (law enforcement) |
From: September 12, 2025 Sanction: up to 2% worldwide annual turnover |
|
WHAT THE EU DATA ACT DOES NOT REGULATE - IMPORTANT DISTINCTIONS The Data Act does not apply to purely internal process data without user reference - production data that does not concern a networked end product is not subject to the data sharing obligation. The Data Act does not apply retroactively to products that were placed on the market before September 2025 - but new products and significant updates from this date are covered The Data Act does not replace the GDPR - both apply in parallel. The Data Act creates data sharing obligations, the GDPR defines protection obligations for personal data. The Data Act contains SME exemptions: Companies with less than 50 employees and a turnover of €10 million are exempt from certain data sharing obligations - but not from customer claims. |
Not every production company is affected to the same extent. The following check helps to classify your own situation. The more yes answers, the more urgent the need for action.
|
Question |
Yes |
No |
Your option for action |
|---|---|---|---|
|
Do you supply to automotive OEMs or Tier 1 suppliers? |
● Now |
○ Monitor |
Catena-X connection as a supplier condition likely |
|
Do you build or sell connected machines / IoT devices? |
● Now |
○ Check |
EU Data Act Data access obligations active since Sep. 2025 |
|
Do suppliers have data about your production? |
● Request it |
○ Monitor |
Data Act gives you the right to this data |
|
Is your energy demand over 100 kW industrial? |
● Relevant |
○ Monitor |
GX4FE Data room relevant for energy optimization |
|
Can your historical production data be retrieved in a structured way? |
Good |
● Catching up |
No data room connection possible without a database |
|
Are legacy systems only running for archive access? |
● Dependent |
○ Stable |
Legacy lock blocks data room readiness directly |
|
More than 50 employees and > € 10 million turnover? |
Affected |
SME exceptions |
Below these thresholds: Check Data Act SME exemptions |
|
Is CO₂ reporting a customer or regulatory requirement? |
● Now |
○ Monitor |
Catena-X PCF (Product Carbon Footprint) becomes mandatory |
1-2 ● responses → observation phase, no acute pressure to act.
3-5 ● responses → Strategic preparation recommended,
Check database. 6-8 ●-Answers → High pressure to act, define data room readiness as a project.
The question is not if, but when data rooms will become business-critical for your company. If you don't clean up your database today, you won't have time in two years' time.
-Korbinian Hermann Managing Director, CSP Intelligence GmbH
Before a company joins a data room, it must fulfill a basic requirement that a surprising number of companies do not meet: It must know what data it has, where it is located and how it can retrieve it in a structured way. That sounds trivial. It is not.
In practice, production data is spread across ERP, MES, quality systems and legacy databases - sometimes in discontinued systems, sometimes in proprietary formats, sometimes only accessible via IT tickets. A data room connection requires the opposite: structured, machine-readable, retrievable data in a format that a data room connector can process.
|
Prerequisite |
Why necessary |
Typical current status |
What to do |
|---|---|---|---|
|
Structured data management |
Connectors need machine-readable data |
Distributed across ERP, MES, legacy in different formats |
Create data catalog, harmonize structure |
|
Manufacturer-independent format |
Data rooms use open standards (JSON-LD, BAMM) |
Data locked in proprietary manufacturer formats |
Migration to open formats, extract legacy data |
|
Data governance |
Who is allowed to share which data with whom? |
No documented sharing policy in place |
Define data ownership, document policy |
|
Technical connector |
Eclipse Dataspace Connector (EDC) or equivalent |
No connector available |
Implement EDC or use Cofinity-X Managed Service |
|
Digital identity |
Certified identity for dataspace participation |
No GAIA-X compliant identity |
Register with GAIA-X-Lab or Cofinity-X |
|
Historical data retrievable |
Data rooms also require backward traceability |
Archive data in legacy systems without self-service |
Implement archive solution with self-service access |
The good news: You don't have to become a GAIA-X member today. The bad news is that the homework that will enable data room participation later will take time. Those who start now will have a head start in two years' time. Those who wait will catch up under time pressure.
Every data room connection starts with a functioning database. CHRONOS archives production data, legacy system data and quality data in an audit-proof, manufacturer-independent and structured manner - creating the basis that data rooms and the EU Data Act require.