The EU Data Act Just Threatened Your RPO: How Companies Are Responding

The legal gamble, contract strategies, and auditor chaos no one's talking about publicly

🎧 Want to hear the full conversation? Check our this week’s Gaapsavvy Podcast, where Devon Coombs and I unpack the EU Data Act on Spotify.

Hey there 👋,

A month ago, on Sept 12, 2025 - the EU Data Act went into effect.

This is a law passed by the European Union meant to give users more power to access and move their data—yet it sparked unintended consequences and some real anxiety in the accounting world.

Last Friday, 120+ accounting professionals from leading tech companies got on a call to talk about what they’re actually doing—and more importantly, how moving together through massive legal ambiguity might help shape how courts interpret this law.

Here’s what I learned: The industry is making a coordinated multi-billion dollar bet on a legal interpretation that won’t be validated until someone gets sued. Auditors are 23 percentage points behind legal teams in reaching conclusions. And next quarter’s reporting is going to reveal who didn’t get the memo.

This wasn’t compliance theater. This was 60 companies revealing their evolving positions, their real concerns, and their actual strategies—complete with live polling data showing exactly how divided (and how aligned) everyone actually is.

This is definitely one of those times where you want to stay in the pack.

The good news is—you’re not alone.

Let’s dive in.

💡 Quick benchmark poll — are you in or out of scope? Take the short survey

---

This community and newsletter is brought to you for free by Klarity.ai.

Powering always-On kAIzen, helping accountants bend the cost curve with AI. Join their upcoming Oct 22 AI Workshop or Dec 3rd HH in Palo Alto. Thank you for supporting the Gaapsavvy community!

Interested in sponsoring this newsletter? Message media@gaapsavvy.com

---

🚨 Why Accountants Care: Save the RPO

The EU Data Act isn’t just a data regulation. Chapter VI Article 25 creeps into commercial contracts regulation because it gives customers the right to switch data processing providers with just two months’ notice. And it applies to you if you’re providing IaaS, PaaS, or SaaS services to EU customers—even if you’re a US company with no EU presence. (DLI Piper 2025)

In the accounting world, under ASC 606, if customers have the option to walk away easily, from a contract - it might be considered a ‘termination for convenience’.

That means that three-year contract you just signed, which showed three years of future revenue allocated to the “remaining performance obligation” aka ‘RPO’ - might only show as a two-month contract for reporting purposes in your financial statements under the accounting rules.

The nightmare scenario:

• You sign a $3M, three-year SaaS deal

• You report $3M in RPO to investors

• The Data Act says customer can terminate with 2 months’ notice

• Under ASC 606, your enforceable contract is now effectively 2 months

• Your RPO drops from $3M to $500K 😱

Multiply that across your entire book of business. Now imagine explaining that to your board.

But here’s the twist: There’s a legal argument that you can still charge customers the full remaining contract value even if they terminate early. The question is whether that’s a “proportionate” termination penalty under the Act or whether it’s punitive and unenforceable.

Based on community polling - 53% of companies are betting they can still collect. 37% aren’t sure yet. 10% think they can’t without explicit contract language.

Let’s break down the factors at play.

⚖️ Question 1: Is Your Data Processing Service Actually Legally In Scope?

Let’s start with the threshold question: Does the Act even apply to you?

The Act covers “data processing services” but deliberately left that term vague. When the Act was being written, a senior cabinet member of the commissioner who championed the data act was asked to clarify the meaning of “all data generated during use of the device” and he responded:

“That’s not my concern. This is for the courts to decide.”

Translation: Everyone is guessing. No one has been sued, this hasn’t gone through courts. There is no precedence.

Poll Results: Has your internal legal team concluded whether you are in scope of the EU Data Act?

A massive shift. When polling the community two weeks earlier, 64% were undecided. Legal teams are only now slowing working their way to conclusions—20 months after was written into law, and one month after the effective date.

How is legal concluding on whether data is in or out of scope?

The Emerging Pattern so far …

✅ Multi-tenant SaaS → In scope
✅ Hybrid (cloud console + on-prem agent) → In scope sometimes
❓ Single-tenant SaaS → Gray area (customization arguments might apply)
❌ Pure on-prem → Out of scope … most of the time

Examples of interpretations in ambiguity:

“Legal is pretty much like, for the SaaS piece, we are under the scope. They even said on-prem shouldn’t be, but they are not even 100% sure it’s not part of the scope.”

“Our legal position is not applicable to on-prem, but it’s applicable to SaaS.”

“Our legal team has not concluded on a position yet, but they were considering whether we were not in scope, given that the data we’re collecting is ancillary... and customers have the ability to port their data and export it.”

Only 7% of respondents concluded they’re out of scope. This exceptionally low percentage suggests the Act’s broad language around “data processing services” is capturing nearly everyone.

At the time of polling, only 32%, or about one-third have definitively used external counsel, suggesting many companies are either still in process or relying primarily on internal legal opinions for this unprecedented legislation.

External Counsel Correlation: Companies that used external counsel are more likely to have reached conclusions (14 in-scope vs. 4 not concluded). External legal expertise is appearing to drive consensus - and might be the hook that gets the audit world comfortable.

---

💰 Question 2: What’s a “Proportionate” Termination Penalty?

This is where the rubber meets the road. Can you charge customers the full remaining contract value if they terminate early under the Data Act? If so, this would be considered ‘substantive termination penalty’, the term of the contract stays the stated term, and RPO stays intact. (KPMG Question B140)

The “Proportionality” Legal Gamble:

The Act states termination penalties must be “proportionate” but doesn’t define the term. Two week prior, one large SaaS company shared that in legal discussions with the EU Task force, a termination penalty equaling the full remaining contract value could be considered acceptable as proportionate to the consequences.

Today - the 53% majority is making a business case: multi-year deals with upfront discounting justify full contract value collection.

Poll: Are you considering that fees are due in full upon early termination of the contract?

Key Distinction: The EU Data act makes a clear distinction between Termination penalties (consequence of breaking contract) vs. switching fees (barrier to competition). Whereas switching fees must be removed from contracts by January 2027, ‘proportionate termination penalties’ continue to be allowed. (EU Data Act paragraph 89)

Companies argue they’re the former, not the latter.

Here’s what’s being said:

“All fees are due and payable through the end of contract until a judge says otherwise. That’s where we’re landing.”

“We’re adopting the interpretation that’s most favorable to us... It works the same way as why we would not want to provide termination for convenience generally, given that we’re selling multi-year deals at a competitive price with upfront discounting.”

And again, there is no legal precedence today to tell us otherwise. Until someone gets sued under the EU Data Act, and it makes it through the courts - no one really knows.

📝 Question 3: Should You Update Contract Language?

Okay, you’ve decided you’re in scope. You’ve decided remainder-of-contract is proportionate. Now what?

Do you update contracts? Which ones? What language?

Poll: Are you making changes to contract terms?

The dominant strategy is clear: don’t poke the bear.

55% aren’t making changes yet, avoiding the risk of opening negotiations with existing customers. Any contract term updates are focused on new contracts - with only 5% attempting to amend existing agreements.

This approach is supported by EU Commission FAQ 42b, which suggests the Act may only apply prospectively (to new contracts), not to existing agreements. However, there’s debate about whether this applies only to data-related clauses or extends to commercial obligations.

“Legal is not changing the MSA yet, and we are standing behind the terms in our contracts that state that obligations are non-cancellable and nonrefundable, but adding language go forward.”

Expected contract term changes to protect the substantive termination penalty determination consisted of subtle wording changes that acknowledge the EU data act like “this termination fee represents a reasonable estimate of damages”’ or clarification that the penalty is not a switching fee.

Collectability Concern: Even if still legally enforceable, should you increase bad debt reserves? No historical data exists yet to evaluate this - yet.

📊 Question 4: What Should You Do for your Quarter Financials?

Here’s where legal theory becomes financial reporting reality.

And here’s the scary part: 60% of auditors haven’t even started discussions yet.

Poll: Has your auditor provided perspective?

Compare that to legal teams:

• 60% of legal teams have concluded

• Only 37% of auditors have engaged

That’s a 23-percentage-point gap. Auditors are waiting for the legal community to conclude.

And rightly so.

The pattern: Auditors want legal representation letters to support RPO treatment. They’re not making independent determinations—they’re validating legal positions. In some cases, there are even requiring external counsel to weigh in.

One company revealed what their Big Four Partners auditor actually said:

“Their conclusion will be a combination of legal opinion plus benchmarking with what other companies are doing.”

Translation: The 60% who haven’t engaged auditors will follow what the 40% early movers decide. This creates self-reinforcing consensus.

🎯 The Bottom Line: This Is Risk Assessment, Not Revenue Recognition (Yet)

Here’s what I really think after analyzing all this data:

The EU Data Act might be more of an ASC 450 (Contingencies) issue than an ASC 606 (Revenue Recognition) issue.

At the end of the day, determining whether a contract exists under ASC 606 depends on legal enforceability. And confidence in legal enforceability really comes from legal precedent - something no one has.

So before chopping off your RPO, pause and ask yourself: Is there enough evidence to say it’s probable our contracts are no longer legally enforceable?

I don’t think we have that data today.

What you probably need:

• Legal representation letters supporting your RPO treatment

• Risk disclosure language (not footnote adjustments)

• Monitoring plan for termination requests over the next 2-4 quarters

What you probably don’t need (yet):

• Massive RPO write-downs

• Panicked contract amendments

• Revenue policy changes

---

📊 Help Us Build Better Benchmarking Data

The polling data in this newsletter came from 60 companies in a live forum. But auditors explicitly said they need “legal opinion plus benchmarking with what other companies are doing.”

We need more data points.

I’m running a broader survey to capture industry positions across 200+ companies. Your anonymous responses will:

• Provide the benchmarking data auditors are requesting

• Help you see where your positions sit relative to peers

• Inform follow-up analysis as this situation evolves

---

TAKE THE 5-MINUTE SURVEY

Survey closes October 25. Results will be published early November.

📅 Upcoming Events & Community Sessions

• Oct 20-30th (times various): Numeric First AI Accounting 2 week sprint with me and Sowmya as guest lecturers (Register here - almost full)

• Oct 22 9am PT: Zuora Podcast: Finance Leaders Unfiltered (Register here)

• Oct 22 10am PT: Klarity AI Workshop: Be 15x more productive (Register here)

• Dec 3 5:30 PT: Klarity Happy Hour in Palo Alto: An evening with peers focused on operational excellence, sharing how leading teams are driving AI-enabled cost ratios, and making their orgs AI-Native over bites & drinks. (Join Waitlist here)

  Want to list your event here and support this newsletter? Message media@gaapsavvy.com

---

Thanks for being part of this community. Hit reply if you’re dealing with this too - I’d love to hear your approach.

Something I missed? Or have an additional resources? Please let us know and contribute to the collective wisdom. This piece is an output of the generosity of knowledge sharing on this fast evolving topic.

Oh - and don’t forget to check out the podcast and Devon’s newsletter!

---

Disclaimer

The information shared in this newsletter comes from real lived experiences of our community accounting professionals - and is intended for learning purposes only. Polling data reveal industry “leans” in an “it depends” world. Every company’s situation is unique - always check with your lawyers, auditors and accounting team before implementing new approaches. Use these insights as starting points for your own research and discussions.