European Health Data Space Regulation Applies From March 2027, With Phases to 2035

Regulation (EU) 2025/327 establishes the European Health Data Space (EHDS). It was published in the Official Journal of the European Union on 5 March 2025 and entered into force twenty days later. Sources differ by one day on the entry-into-force date: EUR-Lex data reproduced by EU Monitor give 25 March 2025, while some Commission and law firm material gives 26 March 2025.

The regulation has two main strands. The first, primary use, concerns the use of electronic health data for the delivery of care. It gives individuals rights to access their electronic health data and to have priority categories of data exchanged across member states, and it sets requirements for electronic health record (EHR) systems. The second, secondary use, creates a framework under which health data can be reused for research, innovation, policy-making and similar purposes, through health data access bodies in each member state that issue data permits.

For life-sciences companies, researchers and medical writers, the secondary-use framework is the part most likely to affect day-to-day work, because it will set the conditions under which electronic health data held in the EU can be requested and analysed.

The regulation applies in stages. The general date of application is 26 March 2027. Secondary sources report that this is also the deadline by which the Commission is to adopt key implementing acts setting technical specifications and operating rules; that deadline should be confirmed against the regulation’s text.

From 26 March 2029, according to several law firm and sector summaries, the rules on access and cross-border exchange apply to the first priority categories, patient summaries and ePrescriptions and eDispensations, and most of the secondary-use rules start to apply. A&O Shearman notes that the chapter on secondary use applies only from 26 March 2029.

From 26 March 2031, the same summaries report that the rules extend to medical images and imaging reports, laboratory results and hospital discharge reports, together with the remaining secondary-use categories. EU Monitor’s key-dates table also lists 26 March 2035, which secondary sources associate with third countries and international organisations being able to apply to join the HealthData@EU infrastructure.

One commentary gives 26 March 2028 for certain obligations of EHR system manufacturers. That date was not found in other sources reviewed and should be treated as unconfirmed.

Sector summaries also differ in how they describe the data categories attached to the 2029 and 2031 milestones. Because the regulation is directly applicable law, the authoritative statement of each date is the transitional and final provisions of the regulation itself, and organisations should base compliance plans on that text rather than on summaries, including this one.

Member states are responsible for setting up the national bodies that run the system, including the health data access bodies that issue data permits for secondary use, and for connecting to the cross-border infrastructure. Healthcare providers are affected by the rights of individuals to access their electronic health data and by the exchange of priority data categories, starting with patient summaries and ePrescriptions. Manufacturers of EHR systems are subject to requirements set by the regulation, which A&O Shearman’s analysis describes in detail.

On the secondary-use side, organisations that hold electronic health data may have obligations to make it available through the health data access bodies, and organisations that want to reuse it, including pharmaceutical and medical technology companies and academic researchers, will apply to those bodies for data permits. Law firm commentary written for industry has addressed what the regulation means for companies in both positions. The detailed conditions, including what a permit application must contain, will depend on the regulation’s text and on the implementing acts.

Organisations that expect to use EU health data for research or regulatory purposes should follow the designation of health data access bodies in the member states where they work, and the Commission implementing acts that will set technical specifications and operating rules. Those that hold health data should assess whether they fall within the data holder obligations.

Because most secondary-use rules apply from March 2029, there is time to prepare, but the implementing acts due around the 2027 application date will determine the practical requirements. Teams should treat dates reported by commentators with care, check them against the Official Journal text, and plan around the confirmed milestones of 26 March 2027, 2029 and 2031.