Tallinn: Europe’s health data rulebook is moving from statute to plumbing, and the next hard date falls on 26 March 2027, when the European Commission must adopt the implementing acts that turn the European Health Data Space Regulation into something hospitals and software vendors can actually build against.

Estonia has run a national digital record for two decades, which makes it a useful yardstick. Most member states have nothing comparable. The regulation asks all 27 to reach a common standard on roughly the same timetable, and the distance between the starting points is the story of this file.

The framework entered into force in March 2025 and applies in stages. The Commission adopted the first implementing act in April 2026, setting up the EHDS Board that steers the rollout. Governments were supposed to designate a national digital health authority before that, and health providers and record vendors face certification duties for interoperability and security.

March 2027 brings the technical core. The Commission must publish detailed specifications for the European electronic health record exchange format, along with templates for data access applications, permits and requests, requirements for secure processing environments, dataset descriptions and the data quality label that researchers will rely on when they judge whether a national dataset is worth requesting.

Then comes the deadline that patients will notice. By March 2029, patient summaries and electronic prescriptions must move across all 27 countries through MyHealth at EU, so a traveller falling ill in Lisbon can be treated on records held in Riga.

Commission officials have spent 2026 telling capitals not to wait. Commissioner Olivér Várhelyi hosted an implementation dialogue on the regulation in June, where officials discussed both delivery and possible simplification. The message was blunt: a government that begins work only when the implementing acts land in March 2027 will not be ready two years later.

Money remains the weak point. National implementation means new authorities, certification regimes, secure processing environments and record systems rebuilt to a common format. Health ministries are competing for that funding against waiting lists and workforce shortages, and several will need EU4Health or Digital Europe support to close the gap.

The preparatory scaffolding is also temporary. The TEHDAS2 joint action, which brings together 29 countries to develop governance and infrastructure blueprints, runs only until December 2026. When it ends, the countries that have not absorbed its output lose the easiest route to good practice.

Lawyers add a further complication. The regulation sits awkwardly beside the General Data Protection Regulation, and national interpretations of what secondary use of health data permits still diverge. The Parliament’s legislative file on the regulation records how carefully co-legislators handled opt-outs, and those choices now devolve to 27 different supervisory cultures.

The risk is not open defiance. It is a soft failure in which the deadlines pass, a handful of countries connect properly, and the promised single space for health data becomes a two-speed network with the same names on the fast side every time.

The next twelve months decide it. Watch which governments budget for their digital health authority in the 2027 national accounts, because that line item, not the Brussels calendar, tells you who will make March 2029.