Connecting a vaccination machine used to be a specification detail, somewhere near the bottom of the tender document. In the last two years it has become the part of the purchase with legal consequences. Who may read the data the machine generates, who must be able to export it, and what happens to the site’s security perimeter once the machine has a network address are now questions with written answers in European law.
Key takeaways
- Since 12 September 2025 the EU Data Act gives users of connected products a right of access to, and portability of, the data those products generate.
- Antimicrobial use reporting under Regulation (EU) 2019/6 has been mandatory for poultry since 2024; vaccines are not antimicrobials and are not in that scope.
- NIS2 places industrial-scale food production, processing and distribution among important entities, with cybersecurity risk management and incident reporting duties.
- Specify data format, export route and offline operation in the contract, not in the commissioning meeting.
What a connected machine actually produces
Before arguing about platforms, it helps to be concrete about the event stream. An in ovo line running at industrial throughput generates a very large number of discrete operations: full-size Inovoject configurations reach roughly 70,000 eggs per hour depending on setup, and the compact Inovoject m units are rated at 12,000 and 20,000 eggs per hour. Each of those operations involves a two-part tooling cycle, a punch through the shell followed by injection of a preset volume, and each is followed by a disinfection cycle in which fluid is pumped over the needle and punch assembly.
That is what connectivity captures: counts, volumes, cycle times, disinfection confirmations, error codes, consumable changes, and the identity of the operator logged in at the time. None of it is exotic. All of it is evidence, and its evidential value is exactly why the question of who controls it stopped being neutral.
The distinction worth holding onto is between process data, which describes what the machine did, and flock data, which describes what happened to the birds afterwards. Suppliers naturally instrument the first. The second lives in the hatchery and farm records, and joining the two is where the operational value sits, which is a question of how hatchery data is managed and analysed rather than of how the machine is wired. A machine that reports flawlessly on itself and cannot be joined to hatch and seven-day mortality data has produced a maintenance log, not intelligence.
Since September 2025, the data question has a legal default
Regulation (EU) 2023/2854, the Data Act, became applicable on 12 September 2025, and it applies to connected products generally, not to any one sector. Its central move is to establish that the user of a connected product has a right of access to the data that product generates, and a right to have that data shared with a third party of the user’s choosing, including a competing software provider or an advisor.
For a hatchery or an integrator, the practical consequence is that the old default has flipped. It used to be reasonable for a supplier to treat machine telemetry as a proprietary asset and grant a portal view as a commercial favour. The regulation reframes access as an entitlement of the party operating the machine, with the data holder responsible for making it available. Agricultural machinery has been one of the sectors most visibly affected, because the equipment concerned has been generating rich operational data for years under contracts that said very little about it.
Two cautions. First, an entitlement is not an implementation: the format, the interface and the latency still have to be negotiated, and a right exercised through a monthly spreadsheet export is technically satisfied and operationally useless. Second, this is a European instrument, and a group operating outside the EU should confirm the equivalent position in each jurisdiction rather than assume it travels.
What you must report, and what you must not confuse with it
Connected systems tend to arrive wrapped in compliance language, and one confusion recurs often enough to be worth stating plainly. Under Article 57 of Regulation (EU) 2019/6, Member States report data on the sales and use of antimicrobial veterinary medicinal products to the European Medicines Agency, and since 2024 that reporting has covered use in poultry alongside cattle and pigs, with the first submission deadline set for 30 September 2024. Other food-producing species follow from 2027 and companion animals from 2030.
Vaccines are not antimicrobials. A vaccination machine is not the instrument that satisfies Article 57, and no supplier should be allowed to imply otherwise in a sales conversation. What the machine can legitimately support is the separate, and equally real, obligation to trace which batch of which product went into which lot of birds on which date, which sits with the site’s own record-keeping and with the traceability requirements attached to veterinary medicinal products.
| Data stream | Who needs it | What frames the requirement |
|---|---|---|
| Doses delivered, volumes, error codes | Production and quality on site | Data Act right of access to connected product data |
| Vaccine batch to bird lot linkage | Site records, customers, competent authority | Veterinary medicinal product traceability rules |
| Antimicrobial use volumes | National authority, then EMA | Article 57, Regulation (EU) 2019/6 (not vaccines) |
| Machine condition and maintenance events | Engineering, supplier service contract | Contractual, informed by condition monitoring practice |
A network address changes the perimeter
The Internet of Things (IoT) arrived in livestock buildings faster than the security thinking did. Directive (EU) 2022/2555, known as NIS2, had a transposition deadline of 17 October 2024 and brings food production, processing and distribution into scope as important entities, with the usual size filter around 50 employees or 10 million euro turnover, plus discretion for authorities to designate entities they consider critical. Industrial-scale hatcheries and integrators generally sit inside that description; a small independent operation generally does not.
What follows from being in scope is cybersecurity risk management and incident reporting, and, more awkwardly for equipment buyers, accountability that extends to suppliers and their connected platforms. That is the clause worth reading twice. A remote-support tunnel opened by a machine vendor is now part of the site’s risk surface, and the answer “the supplier handles that” is no longer a complete answer.
What belongs in the purchase contract
Everything above collapses into a short list that costs nothing at tender stage and is very expensive to retrofit.
- Raw data, not just dashboards. Name the fields, the granularity and the file format. A dashboard is a rendering; the entitlement is to the underlying record.
- An export route with a defined latency. Continuous or daily, machine readable, and available without a support ticket.
- Retention and deletion. How long the supplier keeps the data, where, and what happens to it when the contract ends.
- Degraded mode. The machine must vaccinate when the link is down, and reconcile its records when the link returns. Transfer day does not wait for a network.
- Remote access rules. Who connects, through what, logged how, and revocable by the site alone.
The cloud layer is not the expertise layer
Marketing narratives around smart livestock management often credit the large technology platforms with driving animal health innovation. It is worth separating the layers. Google, like the other hyperscale providers, supplies hosting, storage and analytics infrastructure that a farm management platform may well run on. The veterinary logic, the injection tolerances and the interpretation of a dosing drift come from equipment manufacturers, veterinarians and the site’s own history. Infrastructure is a commodity in this stack; domain judgement is not.
The same separation is a useful negotiating tool. A supplier proposing a closed platform because “the cloud requires it” is describing a commercial choice, not a technical constraint, and the Data Act now gives the buyer a reason to say so out loud.
Questions raised in specification meetings
What does a connected vaccination machine really add over a manual log?
Completeness and timing. A manual log records what someone remembered at the end of a shift; the machine records every cycle as it happens, including the ones nobody would have written down. The gain is largest on drift, where a slow change in delivered volume shows in the data long before it shows in hatch or seven-day mortality.
Can the data be joined to other farm management systems?
Technically yes, contractually it depends on what was agreed. Wireless links and standard interfaces make the transport straightforward. What blocks integration in practice is field naming, batch identifiers that do not match between systems, and export formats designed to be read rather than processed. Settle identifiers first, transport second.
Do these machines adapt to different species and formats?
Machine ranges are built around defined formats, in ovo lines around egg trays and day-old chick equipment around chick baskets, with adjustable settings inside those formats. Treat any claim of universal species coverage as a specification to verify against the actual configuration quoted, not a general property of connected equipment.
What are the security concerns, concretely?
Two dominate: standing remote-access tunnels left open after commissioning, and unmanaged credentials shared across a site. Both are addressable with ordinary discipline. Under NIS2, an in-scope operator also needs a documented risk management approach and a route for reporting significant incidents.
Is any of this useful on a site that is not connected today?
Yes, as a purchasing position. The next machine will be connected whether or not the site asked for it. Deciding now what the contract must say is cheaper than renegotiating after installation.
Where the data goes next
Machine records only become traceability once they are linked to product batches and bird lots under a documented scheme.
Full traceability for animal vaccines: technologies and regulations
Sources: Regulation (EU) 2023/2854 (Data Act), applicable from 12 September 2025, on access to and portability of data generated by connected products; Regulation (EU) 2019/6 on veterinary medicinal products, Article 57, and the European Medicines Agency Antimicrobial Sales and Use platform, for mandatory reporting of antimicrobial use in poultry, cattle and pigs from 2024 with a first deadline of 30 September 2024, other food-producing species from 2027 and companion animals from 2030; Directive (EU) 2022/2555 (NIS2), transposition deadline 17 October 2024, Annex II scope covering food production, processing and distribution; manufacturer technical documentation for Inovoject and Inovoject m throughput and tooling cycle. Consulted August 2026.
Published previously, fully revised on 14 August 2026. General technical guidance for poultry professionals. It does not replace veterinary advice or legal counsel, and the applicability of each instrument must be verified for the country and the size of the operation concerned.