Sign in

EHDS

Regulation (EU) 2025/327 on the European Health Data Space — European Parliament / Council

Also known as: European Health Data Space, Regulation (EU) 2025/327

Official site Official change log Subscribe to EHDS (RSS)

Current version
Regulation (EU) 2025/327
Published 11 February 2025. source
Status
In force
Next deadline
in 137 days
The Regulation applies in general; Member States must have notified their penalty rules (Article 99) source
Who must comply
Manufacturers of electronic health record (EHR) systems, healthcare providers, holders and users of electronic health data, and the Member State bodies that run primary and secondary use of that data. source
How it is assessed
EHR system manufacturers self-assess their harmonised software components, issue an EU declaration of conformity and affix the CE marking. source
Written by
Adopted by the European Parliament and the Council. National digital health authorities oversee primary use, health data access bodies decide on secondary use and can fine, and market surveillance authorities check EHR systems. source
Enforced by
Health data access bodies can fine data holders and users up to EUR 20 million or 4%; other penalties are set by Member States. source
Last change

Rules for sharing electronic health data across the EU, with security and logging duties for every system that handles it.

Recent changes

  1. Low
    Commission Implementing Regulation (EU) 2026/2099 establishes cross-border health data authentication…

    Commission Implementing Regulation (EU) 2026/2099 has been published on 21 September 2026, establishing an interoperable cross-border identification and authentication mechanism for natural persons, health professionals and …

    New document

  2. Low
    EU introduces interoperable cross-border identification mechanism for health data exchange

    The Commission Implementing Regulation (EU) 2026/2099 establishes technical requirements for an interoperable identification and authentication mechanism enabling cross-border health data exchange under the European Health Data …

    New document Effective 2026-10-12

  3. Low
    Commission Implementing Regulation (EU) 2026/2083 on MyHealth@EU enters into force

    Commission Implementing Regulation (EU) 2026/2083 on MyHealth@EU was adopted on 18 September 2026. The regulation enters into force on 11 October 2026 and establishes implementing rules …

    New document Effective 2026-10-11

  4. High
    Commission specifies minimum metadata elements for secondary-use health dataset descriptions under EHDS

    The European Commission has adopted Implementing Regulation (EU) 2026/2098, laying down the minimum metadata elements and their characteristics that health data holders must provide when describing …

    New document Effective 2026-10-11 Action required

That is the last 90 days. Sign in to read further back.

Key dates

Add these dates to your calendar
  1. in 137 days The Regulation applies in general; Member States must have notified their penalty rules (Article 99)
  2. in 868 days Primary-use rules apply to patient summaries, e-prescriptions and e-dispensations and the EHR systems for them; secondary use (Chapter IV) applies
  3. in 1598 days Primary-use rules apply to medical images, laboratory results and discharge reports and the EHR systems for them; Chapter III applies to EHR systems put into service
  4. in 3059 days Article 75(5) on secondary use starts to apply
  5. Commission adopts Implementing Regulation (EU) 2026/2099 on cross-border identification and authentication for MyHealth@EU
  6. Commission adopts Implementing Regulation (EU) 2026/2083 on MyHealth@EU
  7. Commission adopts Implementing Regulation (EU) 2026/771 establishing the European Health Data Space Board
  8. The EHDS Regulation enters into force

Version history

  1. Regulation (EU) 2025/327 Major versionCurrent

    The European Health Data Space Regulation, published in the Official Journal on 5 March 2025; it also amends Directive 2011/24/EU and the Cyber Resilience Act. source

    More
    • It entered into force on 25 March 2025 and applies in stages from 26 March 2027.

Who it applies to

The EHDS sets rules for EHR systems sold in the EU and for primary and secondary use of electronic health data.

EHR systems
EHR systems must include two mandatory harmonised software components: a European interoperability component and a European logging component (Articles 1(2)(b) and 25). source
People's rights
People get rights to access their personal electronic health data, restrict access, see who accessed it, and opt out of primary use where a Member State allows it (Articles 3, 8, 9 and 10). source
Priority data
Patient summaries, e-prescriptions, e-dispensations, medical imaging, laboratory results and discharge reports (Article 14(1)). source
Secondary use
Health data holders must make data available to health data access bodies, which issue data permits to users for permitted purposes (Articles 53, 60 and 68). source
Other device rules
It is without prejudice to the medical device, in vitro diagnostic and AI regulations for systems that interact with EHR systems (Article 1(5)). source

How compliance is assessed

EHR system manufacturers self-assess their harmonised software components, issue an EU declaration of conformity and affix the CE marking.

Self-assessment
A mandatory conformity self-assessment scheme applies to the harmonised software components of EHR systems (recital 39). source
Declaration and marking
The EU declaration of conformity states that the essential requirements of Annex II are met (Article 39), and the CE marking indicates conformity. source
Manufacturers
Manufacturers ensure the components conform to Annex II and the common specifications (Article 30). source
Cyber Resilience Act
EHR systems that are also products with digital elements show CRA conformity through the EHDS procedure (new CRA Article 32(5a), from 26 March 2027). source source

Enforcement and penalties

Health data access bodies can fine data holders and users up to EUR 20 million or 4%; other penalties are set by Member States.

Up to EUR 10 million or 2%

Health data holders or users breaching their duties under Article 60 and Article 61(1), (5) and (6); for an undertaking, 2% of worldwide annual turnover if higher (Article 64(4)). source

Up to EUR 20 million or 4%

Health data users that process data beyond their permit, extract personal data from the secure processing environment, or re-identify people (Article 64(5)). source

National penalties
Member States lay down penalties for other infringements, in particular those not covered by the fines of Articles 63 and 64, and notify them by 26 March 2027 (Article 99). source

Documents

  1. Law text Regulation (EU) 2025/327 (European Health Data Space)
  2. Law text Implementing Regulation (EU) 2026/771 - European Health Data Space Board
  3. Law text Implementing Regulation (EU) 2026/2083 - MyHealth@EU
  4. Law text Implementing Regulation (EU) 2026/2099 - cross-border identification and authentication
  5. Guidance European Health Data Space Regulation (Commission page)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to EHDS (RSS)