The European Health Data Space (EHDS) is moving from framework to build phase, with several implementing regulations already adopted and a further wave of technical rules now in preparation.
Many of these measures focus on the primary-use framework and will be most relevant to healthcare providers, Member States and electronic health record (EHR) system manufacturers. However, others are big news for businesses preparing for their new obligations as health data holders and health data users.
For pharma and medtech businesses, prioritising dataset mapping, access governance and technical readiness will be key, and implementing regulations are providing the tools to kick off EHDS-readiness projects now. GDPR and Data Act readiness-projects have shown that these projects often take longer than the formal deadline suggests. Organisations that leave dataset mapping until 2029 may find themselves exposed to much larger issues around poor data lineage and internal inconsistencies.
- Data catalogues: rules are taking shape
The EHDS introduces a new pathway through which “health data holders” must make “electronic health data” available to “health data users” for permitted secondary-use purposes. These include scientific research, certain development and innovation activities, and the development and training of algorithms, including in medical devices and AI systems.
Many businesses operating in healthcare and life sciences will qualify as “health data holder”, potentially facing access requests from researchers, public bodies and commercial organisations, including competitors.
Before an organisation can respond to access requests, it will need to understand what datasets it holds, who controls them, what they contain and what legal, technical or contractual restrictions apply.
Holders must provide descriptions of the datasets they hold to health data access bodies for inclusion in dataset catalogues. In turn, health data access bodies must make standardised, machine-readable catalogues publicly available, containing information on the source, scope, main characteristics and nature of the datasets. Health data holders must verify at least annually that their dataset descriptions remain accurate and up to date.
What’s new?
Implementing Regulation (EU) 2026/2098 turns these high-level obligations on holders into a more concrete metadata exercise. It specifies the minimum metadata elements for dataset descriptions and requires those elements to be expressed using HealthDCAT-AP, a technical specification for describing health datasets available for secondary use.
The regulation requires 27 minimum metadata elements, including:
- Access rights: whether access is public, restricted or non-public.
- Applicable legislation: EU or national legislation governing the dataset.
- Custodian: the organisation responsible for holding, managing and maintaining the dataset over time.
- Description: a free-text account of the dataset’s content and purpose.
- Personal-data status: whether the dataset contains personal data within Article 4(1) GDPR.
- Number of unique individuals: an estimated number of unique natural persons where the dataset contains personal data and the element is applicable.
- Provenance: the dataset’s origin, source or creation process.
Other required fields address the dataset’s publisher, geographical and temporal coverage, coding systems, health-data category, variables and the process through which the dataset was generated.
The regulation applies from 26 March 2029.
Practical takeaway: start with the data, not the template
Businesses with rich health datasets should consider HealthDCAT-AP mapping well before 2029.
Businesses will need to identify potentially in-scope datasets, map ownership and custodianship, and assess data provenance, coding systems, personal-data content, contractual restrictions and applicable legislation.
GDPR and Data Act readiness projects show that governance takes time. Waiting until 2029 risks discovering fragmented ownership, inconsistent terminology and poor data lineage too late.
- New templates: the operating paperwork for secondary use
The European Commission is inviting feedback on three draft templates via a new consultation, open until 13 November 2026:
- Health data access applications: for applicants seeking access to electronic health data.
- Health data permits: setting out the electronic health data that may be accessed, the permitted purposes and the applicable conditions.
- Health data requests: for applicants seeking a response in anonymised statistical form without access to the underlying electronic health data.
These templates will shape application requirements, access conditions, project documentation and controls. Under Article 70, the European Commission will need to adopt the three templates by 26 March 2027.
Practical takeaway: prepare for both sides of the process
Pharma and medtech businesses may act as both health data holders and users. They may seek third-party data for research and development, while supporting access bodies handling requests for their own datasets.
Legal teams should therefore begin developing internal playbooks covering:
- Responsibility for responding to EHDS access processes;
- How the organisation will support a health data access body;
- Identifying confidential information, trade secrets and intellectual property;
- Assessing data-protection, security and contractual restrictions;
- Reviewing proposed data uses; and
- Coordination of legal, data, medical, security and commercial teams within the applicable timelines.
- What is next for implementation?
Further implementing acts are in preparation:
- European electronic health record exchange format: This will establish the technical specifications for the common European format covering: patient summaries; electronic prescriptions; medical imaging; medical test results; and discharge reports. EHR systems will need to be able to import and export the relevant priority data using the format. For EHR-system manufacturers, this will be central to product architecture and interoperability readiness.
- Common specifications for EHR systems: This will detail the essential requirements for EHR systems. For manufacturers, these specifications will be key to demonstrating conformity with the EHDS requirements.
- Data quality and utility label: This will establish the visual characteristics and technical specifications of the EU data quality and utility label. Datasets collected and processed with EU or national public funding must carry the label, but others may apply the label voluntarily. The label may become an important market signal for researchers and commercial data users assessing whether a dataset is suitable for a proposed project.
- European digital testing environment: This will establish common specifications for the European digital testing environment used to assess EHR systems. Before placing an EHR system on the market, manufacturers will be required to use the relevant European or Member State digital testing environment.
- Secure processing environments: This will specify the technical, security and interoperability requirements for secure processing environments providing access to electronic health data under a data permit.
- What should pharma and medtech do now?
Businesses that hold or seek access to electronic health data should:
- Map potentially in-scope datasets and identify the relevant health data holder.
- Test existing data inventories against the information required for HealthDCAT-AP descriptions.
- Identify ownership and provenance issues, coding inconsistencies, data-quality limitations and contractual restrictions.
- Establish governance for receiving and supporting third-party access requests.
- Develop an applicant-side strategy for using the EHDS to access external health datasets.
- Monitor the March 2027 implementation package, particularly the secondary-use templates, EEHRxF specifications, common specifications for EHR systems and data quality and utility label.
The EHDS will make health datasets easier to find and create a formal route through which eligible users can seek access from holders. Preparing now will help organisations govern the disclosure and use of those data when the EHDS framework goes live.
