Brussels: The European Health Data Space has moved from legislative abstraction to a compliance calendar, and the first entries on that calendar are now uncomfortably close. The regulation that created the EHDS entered into force in March 2025, but its architects deliberately chose a staggered rollout rather than a single switch. That design is now being tested, because the early milestones land long before the headline functions arrive. Hospitals, clinics and the vendors that supply their electronic record systems are discovering that the law asks for measurable readiness well ahead of the dates most administrators had circled.
The structure of the EHDS rests on two pillars that pull in different directions. The first, often called primary use, is about letting a patient’s records follow them across borders, so that a summary or an electronic prescription issued in one member state can be read and trusted in another. The second, secondary use, allows tightly governed access to anonymised or pseudonymised datasets for research, regulatory decisions, public-health planning and the training of clinical algorithms. Each member state must stand up a Health Data Access Body to vet and approve those secondary requests. The promise is a single, predictable legal route to real-world evidence that today is locked inside fragmented national silos.
What makes the coming period demanding is the gap between ambition and operational capacity. The Commission must still adopt a substantial body of implementing acts that translate broad principles into technical specifications, with the bulk of those rules expected by 2027 and the core cross-border exchange of priority data categories applying around 2029. Yet certification expectations for record systems and interoperability standards begin to bite far earlier. The result is a sequencing problem. Suppliers are being asked to certify against standards whose finer details are not yet fully written, and providers must budget for upgrades without knowing the exact shape of the acts that will govern them.
The unevenness across the Union is the harder truth beneath the timetable. A handful of member states already run mature national health-data infrastructures, with established identifiers, digital prescriptions and consent frameworks. Others are assembling those foundations from a much lower base. A regulation can harmonise legal obligations on paper, but it cannot conjure interoperable systems or trained data-governance staff overnight. The danger is a two-speed health space in which the citizens of better-resourced states enjoy seamless portability while others wait years for the same rights, reproducing precisely the fragmentation the EHDS was meant to close.
For the pharmaceutical and medical-technology sectors, the secondary-use regime is the part worth watching most closely. Access to large, harmonised, real-world datasets could compress the time needed to detect safety signals, design trials and evaluate how treatments perform outside controlled studies. That prospect is genuine, but it depends on Health Data Access Bodies that are adequately funded, consistent in their decisions and quick enough to be useful. If approval processes diverge sharply between capitals, the single space risks becoming a patchwork of national gateways with a shared letterhead. Industry interest is real, yet it will cool fast if the route to data proves slow or unpredictable.
Privacy is the axis on which public trust will turn. The legislation leans on pseudonymisation, purpose limitation and oversight, and the broader debate has increasingly centred on privacy-enhancing techniques that let researchers learn from data without exposing identifiable records. The political reality is that a single high-profile breach or a poorly explained data flow could harden public opinion against the whole project. Citizens are being asked to accept that their most sensitive information can be reused for the common good, and that consent rests on governance they will rarely see in action.
The honest assessment is that the EHDS is neither the privacy catastrophe its loudest critics fear nor the instant research windfall its boosters describe. It is a long institutional build whose success will be decided less by the founding regulation than by the quality of implementation in each member state. The early deadlines matter because they reveal who is ready and who is not, and because they set the tone for the larger obligations still to come. For now the most useful question is not whether the vision is sound, but whether the slowest member states can be helped to keep pace before the gap becomes permanent.




