--- title: "Art. 36 Data Act: Essential requirements regarding smart contracts for executing data sharing agreements" canonical: "https://dposchool.com/data-act/article/36" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_36" source_note: "Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2023-12-22" language: "en" publisher: "DPO School" --- Art. 36 Data Act · Chapter VIII: INTEROPERABILITY # Article 36 Data Act: Essential requirements regarding smart contracts for executing data sharing agreements Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026. ## Official text ### Article 36(1) **1.** The vendor of an application using smart contracts or, in the absence thereof, the person whose trade, business or profession involves the deployment of smart contracts for others in the context of executing an agreement or part of it, to make data available shall ensure that those smart contracts comply with the following essential requirements of: #### Article 36(1)(a) **(a)** robustness and access control, to ensure that the smart contract has been designed to offer access control mechanisms and a very high degree of robustness to avoid functional errors and to withstand manipulation by third parties; #### Article 36(1)(b) **(b)** safe termination and interruption, to ensure that a mechanism exists to terminate the continued execution of transactions and that the smart contract includes internal functions which can reset or instruct the contract to stop or interrupt the operation, in particular to avoid future accidental executions; #### Article 36(1)(c) **(c)** data archiving and continuity, to ensure, in circumstances in which a smart contract must be terminated or deactivated, there is a possibility to archive the transactional data, smart contract logic and code in order to keep the record of operations performed on the data in the past (auditability); #### Article 36(1)(d) **(d)** access control, to ensure that a smart contract is protected through rigorous access control mechanisms at the governance and smart contract layers; and #### Article 36(1)(e) **(e)** consistency, to ensure consistency with the terms of the data sharing agreement that the smart contract executes. ### Article 36(2) **2.** The vendor of a smart contract or, in the absence thereof, the person whose trade, business or profession involves the deployment of smart contracts for others in the context of executing an agreement or part of it, to make data available shall perform a conformity assessment with a view to fulfilling the essential requirements laid down in paragraph 1 and, on the fulfilment of those requirements, issue an EU declaration of conformity. ### Article 36(3) **3.** By drawing up the EU declaration of conformity, the vendor of an application using smart contracts or, in the absence thereof, the person whose trade, business or profession involves the deployment of smart contracts for others in the context of executing an agreement or part of it, to make data available shall be responsible for compliance with the essential requirements laid down in paragraph 1. ### Article 36(4) **4.** A smart contract that meets the harmonised standards or the relevant parts thereof, the references of which are published in the Official Journal of the European Union, shall be presumed to be in conformity with the essential requirements laid down in paragraph 1 to the extent that those requirements are covered by such harmonised standards or parts thereof. ### Article 36(5) **5.** The Commission shall, pursuant to Article 10 of Regulation (EU) No 1025/2012, request one or more European standardisation organisations to draft harmonised standards that satisfy the essential requirements laid down in paragraph 1 of this Article. ### Article 36(6) **6.** The Commission may, by means of implementing acts, adopt common specifications covering any or all of the essential requirements laid down in paragraph 1 where the following conditions have been fulfilled: #### Article 36(6)(a) **(a)** the Commission has requested, pursuant to Article 10(1) of Regulation (EU) No 1025/2012, one or more European standardisation organisations to draft a harmonised standard that satisfies the essential requirements laid down in paragraph 1 of this Article and: ##### Article 36(6)(a)(i) **(i)** the request has not been accepted; ##### Article 36(6)(a)(ii) **(ii)** the harmonised standards addressing that request are not delivered within the deadline set in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or ##### Article 36(6)(a)(iii) **(iii)** the harmonised standards do not comply with the request; and #### Article 36(6)(b) **(b)** no reference to harmonised standards covering the relevant essential requirements laid down in paragraph 1 of this Article is published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 and no such reference is expected to be published within a reasonable period. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). ### Article 36(7) **7.** Before preparing a draft implementing act referred to in paragraph 6 of this Article, the Commission shall inform the committee referred to in Article 22 of Regulation (EU) No 1025/2012 that it considers that the conditions in paragraph 6 of this Article have been fulfilled. ### Article 36(8) **8.** When preparing the draft implementing act referred to in paragraph 6, the Commission shall take into account the advice of the EDIB and views of other relevant bodies or expert groups and shall duly consult all relevant stakeholders. ### Article 36(9) **9.** The vendor of a smart contract or, in the absence thereof, the person whose trade, business or profession involves the deployment of smart contracts for others in the context of executing an agreement or part of it, to make data available that meet the common specifications established by implementing acts referred to in paragraph 6 or parts thereof shall be presumed to be in conformity with the essential requirements laid down in paragraph 1 to the extent that those requirements are covered by such common specifications or parts thereof. ### Article 36(10) **10.** Where a harmonised standard is adopted by a European standardisation organisation and proposed to the Commission for the purpose of publishing its reference in the Official Journal of the European Union, the Commission shall assess the harmonised standard in accordance with Regulation (EU) No 1025/2012. Where the reference of a harmonised standard is published in the Official Journal of the European Union, the Commission shall repeal the implementing acts referred to in paragraph 6 of this Article, or parts thereof which cover the same essential requirements as those covered by that harmonised standard. ### Article 36(11) **11.** When a Member State considers that a common specification does not entirely satisfy the essential requirements laid down in paragraph 1, it shall inform the Commission thereof by submitting a detailed explanation. The Commission shall assess that detailed explanation and may, if appropriate, amend the implementing act establishing the common specification in question. ## Source Source: Regulation (EU) 2023/2854, OJ L, 2023/2854, 22.12.2023, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 36 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854#art_36) Official Journal text of 22 December 2023, as corrected (OJ L, 2024/90790, 9.12.2024). Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [Data Act Navigator](https://dposchool.com/data-act) / [Chapter VIII](https://dposchool.com/data-act/chapter/8) / Article 36 Previous: [Art. 35 Data Act: Interoperability of data processing services](https://dposchool.com/data-act/article/35) Next: [Art. 37 Data Act: Competent authorities and data coordinators](https://dposchool.com/data-act/article/37) ## For AI agents - Machine-readable index: https://dposchool.com/data-act/llms.txt - JSON API: https://dposchool.com/data-act/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents