Madrid: The European Health Data Space Regulation began applying on 26 March 2026 with a staggered timetable that pushes the most operationally demanding obligations to March 2029, but the gap between the regulation as enacted law and its working presence across the twenty-seven national systems is wider than its supporters acknowledged when Regulation 2025/327 closed in early 2025. The Commission’s May 2026 consultation on third-country collaboration and on data enrichment under EHDS has produced a snapshot of national readiness that is uneven enough to put the 2029 milestones for primary use exchange and secondary use authorisation under quiet but real pressure.
The regulation rests on a structural distinction between primary use, defined as the exchange of patient-summary, ePrescription and similar categories for direct patient care, and secondary use, defined as access to pseudonymised data for research, public health, policy and innovation purposes. The primary-use architecture relies on MyHealth at EU, the connectivity service that the Commission has co-financed under successive Connecting Europe Facility programmes since 2019, while the secondary-use architecture introduces Health Data Access Bodies in each Member State and a coordinating board that will adjudicate cross-border access requests. The split is sound in principle, but Member States are at very different stages of building the institutions required to give effect to it.
The starkest divergence is institutional rather than technical. Of the twenty-seven Member States, sixteen have designated a Health Data Access Body or named the responsible authority by April 2026, eight more have indicated a preferred institutional vehicle without formal designation, and three remain without any announcement. The eight transition cases generally point toward existing data protection authorities or to research-infrastructure agencies as the host body, but the regulation requires governance arrangements that go beyond what either authority category was designed for, including secure processing environments compliant with the European Data Space framework and decision-making competence over data access requests that may engage commercial and security-sensitive analysis.
Technical readiness is more granular but no less unequal. The Commission’s preliminary indicators on electronic health record adoption show that fourteen Member States operate centralised national systems with summary-care interoperability already aligned to HL7 FHIR profiles, six operate federated systems whose interoperability is partial, and seven operate predominantly regional systems whose alignment with the EHDS technical schema requires sustained adaptation work. Spain falls in the third category, with seventeen autonomous-community systems whose integration into a single national exchange point has been advancing through the Inter-Territorial Council since 2023, but the timetable for full interoperability sits firmly beyond the EHDS 2029 marker.
The cross-border secondary-use challenge is the more politically difficult side of the file. The regulation requires Member States to provide access to pseudonymised health data for purposes including scientific research and the development of medical devices, including those embedding artificial intelligence. The objections are familiar from the GDPR debates of the late 2010s and from the more recent disputes around the Data Act, but they have a sharper edge in the health context. Three Nordic Member States with mature national health data registries have signalled that they expect a robust interpretation of the public-interest exemption that would prevent commercial buyers from sourcing data on terms that undercut domestic research ecosystems. Two southern Member States have raised the inverse concern that overly restrictive cross-border access would entrench a research-capacity divide that the regulation was supposed to mitigate.
The third-country dimension under consultation in May is more constrained than the cross-border one, but it generates equivalent political weight. EHDS allows third-country access subject to adequacy and to safeguards aligned with the GDPR framework, and the consultation asks whether sector-specific adequacy assessments would offer more granular protection than the horizontal mechanism inherited from data protection law. Industry consultees, including pharmaceutical research consortia that already operate inside the European Medicines Agency framework, have argued for a sector adequacy model. Civil society organisations have argued for stricter conditionality. The Commission has signalled that it will not pre-empt the broader review of the adequacy architecture under the GDPR, but the EHDS consultation answers will weigh on how that review is calibrated when it comes back to public discussion in late 2026.
The 2029 milestones are still distant on the calendar, but their operational predecessors arrive earlier. Member States must notify implementing measures by mid-2027 and stand up minimum digital infrastructure by 2028, and the political appetite to begin those projects is narrowest in the three Member States whose institutional designations are still missing. The Commission’s preferred enforcement posture remains co-operative for now, but the European Data Protection Supervisor has begun preparing the analytical foundations for harder enforcement should the milestones slip without credible justification. Whether the soft phase holds will be tested not in 2029 but in the funding cycles and political appointments that Member States set this autumn.
