On 22 October, independent wind service companies took their complaint public in the Danish press: Vestas, they said, puts turbine data, error codes and control systems behind steep subscriptions. Jørgen Kjærsgaard, CEO of Nordic Wind Technology, described how owners locked out after their service contract ends would feel: “I’d feel like I was being held hostage.” Vestas rejects the claim. Its press office said owners who service their own turbines get the tools and support they need and keep their data after the Vestas contract ends. It added that, for competitive reasons, it does not offer those tools to rival service firms. Siemens Gamesa said it gives customers access to their operational data, within the cybersecurity and safety standards these systems require.
The grievance isn’t new. Back in 2018, Dr Sebastian Hack, counsel at Osborne Clarke, warned that a supplier could encrypt data from their CMS system and request an annual maintenance fee to make it available. A 2021 ONYX Insight report found that only one of the twelve leading condition-monitoring hardware providers gave owners full data access. What has changed is the law.
Data now follows the user
The EU Data Act has applied since 12 September 2025. Any business or consumer using a connected product can now demand the data the manufacturer holds and have it passed to a third party. Wind turbines, PV inverters, heat pumps and chargers all fall in scope. The user can choose who receives that data. That sits awkwardly with the position Green Power Denmark set out this week: that competition and security concerns stop manufacturers sharing data with companies offering competing services.
German owners are organising to test it. Turbit, Energiequelle, Greenwind, SAB WindTeam, BOREAS, Merkur Offshore and others have formed an alliance called “Daten stärken Wind” to push for effective enforcement. The alliance estimates that more than 1.5 million MWh a year is lost in Europe because operators lack the data to catch faults early. That is its own figure, not an independent one. Turbit’s CEO Michael Tegtmeier presented the campaign at an event hosted by the Bundesnetzagentur in September 2026.
Two dates matter for existing fleets. Since 12 September 2026, newly marketed products must offer users direct data access by design. From 12 September 2027, the Act’s unfair-terms rules also reach older contracts that are open-ended or run at least ten years from January 2024. That covers many long-term service agreements. For VPP operators and battery optimisers such as Capalo and Gridle, a legal right to route an asset’s data to an optimiser of the owner’s choosing weakens platform lock-in.
Security now runs on a clock
Germany has already seen what a single point of failure costs. When the KA-SAT satellite network was hit by a cyberattack on 24 February 2022, Enercon lost remote monitoring and control of 5,800 turbines totalling 11 GW. The turbines kept generating, but by 1 April communication was still down at 193 wind farms. Weeks later, Nordex shut down IT systems across several business units after detecting a cyber intrusion on 31 March. In April, an attack on Deutsche Windtechnik knocked out remote control of about 2,000 turbines for roughly a day, according to the company.
Solar carries the same exposure. In May 2025, Reuters reported that US experts had found undocumented communication devices in some Chinese-made inverters. DNV data showed Chinese vendors supplied 78% of inverters installed in Europe in 2023.
The law is catching up. NIS2 puts energy operators under risk-management and reporting duties. Since 11 September 2026, the Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours, including for products already on the market.
The Baltic stress test
The Baltics show why this is a grid question, not only an IT one. On Christmas Day 2024 the Estlink 2 cable between Finland and Estonia was damaged. Investigators found an anchor drag mark linked to the tanker Eagle S, and repairs ran into summer 2025. Lithuania had already acted: in November 2024 it passed a law blocking remote Chinese access to solar, wind and battery installations above 100 kW.
What diligence should now ask
Buyers and lenders should check four things:
- whether the O&M contract grants raw data or only dashboards
- whether the 2027 deadline reopens that contract
- which equipment suppliers in the portfolio have CRA reporting processes
- whether the operator is registered under its national NIS2 law
A turbine with a full data history sells like a car with a stamped service book. One without it is being priced on trust.
