Access by Design

A quiet assumption has held for decades in how operations run: the party that builds the system controls the data inside it. This month, in one of the world's largest markets, that assumption stops being the default. A new access-by-design requirement says connected products have to be built so the people who use them can actually reach the data those products generate — by design, not by request. Strip away the legal framing and it's a familiar idea: data shouldn't be trapped. That's the connective-layer thesis, arriving with a compliance date attached.

What "access by design" actually asks for

The requirement taking effect this month applies to newly placed connected products and their related services, and the principle behind it is plain: the data a product generates should be reachable by the user easily and without cost, in a form that other systems can use. Alongside it sit companion expectations around portability and switching — you shouldn't have to stay with one provider simply because that's the only way to get at your own information. The sectors in scope are exactly the document- and machine-heavy ones: manufacturing, healthcare and medical devices, connected equipment, financial terminals, agritech. Different products, one shared demand — that data not be locked behind the system that happened to create it.

Lock-in was never a feature — it was a side effect

For years, data lived where it was created, and the only way out was through the vendor's terms. That usually isn't malice. It's what happens when a system is built to serve one party well: the data model, the export formats, the integration points all bend toward that party's needs, and everyone downstream inherits the friction. The cost lands on the people who need the data to act — the partner waiting on a status, the auditor reconstructing a timeline, the operator who just wants their own numbers in their own tools. Regulators are now naming that side effect and requiring it be designed out from the start.

Why this is the connective-layer thesis in disguise

The whole reason a connective layer exists is that facts trapped in one party's system can't reach the others who depend on them. "Access by design" says data must be reachable and portable — but reachable to whom, and how it travels across a company line, is precisely the problem a connective layer is built to solve. Making one product's data exportable is a checkbox. Making the facts move between the parties in an operation — so the reachable data actually arrives where a decision gets made — is a capability. The rule sets the floor; connectivity is what turns compliance into something operationally useful.

Access without giving up your system of record

Here's the trap to avoid: portability does not mean dumping your archive into someone else's central pool. That just relocates lock-in and asks everyone to trust a new owner with their books. Veritas by ATG takes the opposite approach. It's a connective layer, not a replacement — each party keeps its own system of record, and the layer moves the facts about those records between the parties who need them: status, milestones, document references, shared identifiers. Data stops being trapped, and no one has to surrender control to free it. That's how you honor the spirit of an access-by-design rule — data isn't stuck — without recreating the very problem the rule was written to end.

The same shape, wherever the rule reaches

This pattern doesn't belong to any one jurisdiction or vertical. A manufacturer's connected equipment, a clinic's device readings, a contractor's field systems, an insurer's claim records — each generates data in one place that several parties need, and each faces the same rising expectation, soon a requirement, that the data not be walled off. The geography of a specific rule will keep expanding; the operating reality is already everywhere. Building for reachable, portable data now isn't about satisfying one market's deadline. It's about being ready for the direction every document-heavy industry is already moving.

Build for reachable data, not compliant data

Compliance treats access as a feature to bolt on at the edge. The stronger move is to treat reachable, portable data as the architecture: find where your data is trapped today, build the connections that free it, and connect the parties so the facts move on their own. That arc — consult, build, connect — is how a requirement becomes an advantage instead of a scramble. Regulation is catching up to something operators have felt for a long time: data that can't move is data you don't really own. Designing for movement is how you take it back.