· ReadyStack
Worked example
Real numbers from this tool, line by line.
6 Data Act gaps turned up in one sample smart-thermostat notice, the page every IoT maker selling in the EU must show a buyer before the sale. If you sell connected thermostats, cameras, wearables or e-bikes in Germany, France or any other member state, this is your page too.
The rule is Regulation (EU) 2023/2854, the Data Act. It has applied since 12 September 2025. Article 3(2) says that before a contract to buy, rent or lease a connected product, the seller must tell the user four things: the type, format and estimated volume of the product data; whether data is generated continuously and in real time; whether it is stored on the device or on a remote server and for how long; and how the user can access, retrieve or erase it, with the technical means, terms of use and quality of service. Article 3(3) adds nine more for the related service, the app or cloud behind the device: what data the data holder receives and how often, the related service data, the holder's own use and third parties, its trading name and address, a quick contact, how to share data with a third party and stop, the right to complain to the Article 37 authority, trade secrets, and contract duration and termination. That is 13 items.
The second date is newer. Article 50 makes Article 3(1) apply to connected products placed on the market after 12 September 2026. Article 3(1) says product data must be accessible by default, free of charge, in a structured, commonly used, machine-readable format.
Penalties? Article 40(4) lets data protection authorities fine infringements of Chapter II up to the GDPR Article 83(5) ceiling where personal data is involved: €20,000,000 or 4% of worldwide annual turnover.
We ran IoT Data Notice Lint on the sample notice in VS Code. It returned 6 findings:
- Article 3(2)(b): nothing about continuous or real-time generation.
- Article 3(3)(g): no word on the right to complain to the competent authority.
- Article 3(3)(h): no statement about trade secrets.
- Article 3(3)(i): no contract duration and no way to terminate.
- Line 13: data "retained as long as necessary", which is not a retention period.
- Line 16: history export "included in Nordlicht Plus at €4.99 per month", a fee on the user's own data.
Each finding has the line, the article and a fix. The clean version of the same page, with the four items added, a 24-month retention period and free CSV or JSON export, returns 0 findings.
A chatbot drafts a notice; it does not diff your page against the 13 items or spot the paid-plan sentence on the export line. The lint checks that each item is stated, not that it is true for your device.
How it works: the extension has 17 rules, 13 for the Article 3(2)-(3) items and 4 quality rules (a fee on data access, vague retention, a volume with no figure, PDF-only export). Put placed_on_market: 2026-10-01 in the front matter and the two Article 3(1) rules are errors; for a model placed on the market before the cut-off they drop to warnings. The same engine runs in a free web page; nothing is uploaded.
Free, with no key: one open file, all 17 rules, every line and fix. The full version sweeps a whole workspace of product notices at once and writes one dated Data Act evidence report. For comparison, a lawyer billed at the DOJ Fitzpatrick Matrix rate for 15 years of practice costs $851/hour (billing year 2026). Run the check first; spend the lawyer's hour on substance.
15 seconds — what it actually does
Questions people ask
What does IoT Data Notice Lint do?
IoT Data Notice Lint reads the Markdown product data notice you show buyers before a sale and checks it against EU Data Act Article 3(2) and 3(3). It flags each of the 13 required items that is missing, plus lines that charge for data export, give no retention period, give no volume figure, or offer only PDF export. Every finding has a line number and a fix.
Who is it for?
Makers of smart thermostats, cameras, wearables, e-bikes, appliances and other connected products sold, rented or leased in the EU, and companies running the related app or cloud service. Product managers, firmware teams and in-house counsel who keep the product page or datasheet in Markdown can check it in VS Code or in the free web page before publishing.
Why not just ask a chatbot or use a free template?
A chatbot or template drafts a data notice but does not diff your page against the 13 items of Article 3(2)-(3) or flag a paid export line. The notice has been owed since 12 September 2025, and products placed on the market after 12 September 2026 must also give data access free of charge under Article 3(1). Fines can reach €20,000,000 or 4% of worldwide annual turnover (Article 40(4)).
What is free and what does the full version add?
Free, with no key: one open file, all 17 rules (13 Article 3 items and 4 quality rules), line numbers and a fix for every gap, in VS Code or the web page. The full version, $29 once with one licence key per person or team seat, sweeps a whole workspace of product notices at once and writes one dated Data Act evidence report.
What would a lawyer cost for the same check?
A lawyer billed at the DOJ Fitzpatrick Matrix rate for 15 years of practice costs $851/hour (billing year 2026). The fine risk is larger: under Article 40(4), data protection authorities may fine up to €20,000,000 or 4% of worldwide annual turnover where personal data is involved (GDPR Article 83(5)). The lint runs the item-by-item check first, so paid review time goes to substance instead of a missing trade-secret line.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. IoT Data Notice Lint: EU Data Act Art. 3 checks the file you open against 17 rules, each naming its legal or official basis, from a rule set dated 2026-09-26, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.