European Health Data Space: A Governance Readiness Roadmap for Life Sciences and HealthTech

What pharmaceutical companies, healthcare organisations and digital-health innovators should do now to prepare for the EHDS Regulation.

*Regulatory position checked: 15 October 2026 · Jurisdiction: European Union*

Executive overview

The European Health Data Space (EHDS) is reshaping how electronic health data is accessed, exchanged and reused across the European Union. For pharmaceutical companies, life-sciences organisations, healthcare providers and HealthTech businesses, the implications extend beyond technical interoperability. They involve data governance, regulatory accountability, research practices, information security, individual rights and the evidence needed to demonstrate compliance.

Regulation (EU) 2025/327 entered into force on 26 March 2025. Its requirements are being introduced in stages, with important governance arrangements applying from March 2027 and major operational obligations beginning in March 2029 and March 2031.

Organisations should use the transition period to establish which requirements apply to them, identify affected data and systems, clarify responsibilities and create a proportionate implementation roadmap.

The immediate priority is not to redesign every health-data system. It is to understand the organisation's regulatory position and establish a defensible plan for readiness.

What is the European Health Data Space?

The EHDS establishes an EU framework for accessing and using electronic health data, with common rules, governance arrangements and supporting infrastructure.

It has three closely connected dimensions.

These requirements affect different organisations in different ways.

A hospital operating electronic patient records, a pharmaceutical company sponsoring research and a software supplier developing EHR technology will not necessarily have the same responsibilities.

Determining the organisation's actual role is therefore the first governance decision.

EHDS implementation timeline: the dates that matter

The EHDS is already in force, but its operational requirements have staggered application dates.

The detailed obligations depend on the relevant articles, data categories, organisational roles and any applicable national arrangements.

A 2029 deadline should not be treated as permission to defer all EHDS preparation until 2029. Some governance arrangements begin earlier, while complex technology and operating-model changes may require substantial lead time.

Organisations should monitor the European Commission's implementing and delegated acts as technical requirements are finalised.

Who needs to prepare?

Pharmaceutical and life-sciences organisations

Pharmaceutical businesses may encounter EHDS requirements through clinical research, real-world evidence, patient registries, pharmacovigilance-related data, research partnerships and international operating structures.

Potential responsibilities depend on whether a particular group entity qualifies as a health data holder, seeks access to data as a health data user, or performs other activities within scope.

A multinational group should not assume that every subsidiary has identical obligations.

Healthcare providers and research organisations

Hospitals, care providers, research institutions and relevant data-holding organisations may need to prepare for enhanced electronic health-data access arrangements, data cataloguing, access requests and interoperable systems.

The extent of their obligations depends on their activities, the data they hold and applicable national implementation arrangements.

HealthTech and EHR technology providers

Manufacturers and other relevant operators of in-scope EHR systems face requirements relating to interoperability, logging and conformity.

Developers of medical devices, high-risk AI systems or wellness applications should assess EHDS applicability alongside their other regulatory obligations, particularly where interoperability with EHR systems is claimed.

Not every digital-health product is automatically an EHR system. Product classification and the applicable requirements need to be established before a compliance programme is defined.

International organisations

The EHDS also matters strategically to businesses headquartered outside the EU.

For example, a UK- or US-headquartered pharmaceutical group with an EU establishment acting as a relevant health data holder may have responsibilities under the Regulation.

Conversely, an organisation's non-EU headquarters or involvement in an EU clinical trial does not, by itself, establish that every non-EU group company is directly subject to all EHDS obligations.

The correct assessment should distinguish legal entities, establishments, controller responsibilities, datasets and the relevant EHDS provisions.

---

1. Establish applicability and accountability

Before investing in technology or preparing new compliance documentation, establish which parts of the EHDS apply to the organisation.

Review:

• Relevant legal entities and EU establishments.
• Health-data processing activities.
• Controller, joint-controller and processor relationships.
• Potential health data holder and health data user roles.
• In-scope EHR systems and digital-health products.
• Relevant exemptions and national rules.
• Applicable implementation dates.

The resulting assessment should distinguish confirmed obligations from those requiring further legal, technical or regulatory clarification.

Recommended evidence: An EHDS applicability matrix identifying entities, activities, roles, obligations, owners and target dates.

2. Build a reliable inventory of electronic health data

An organisation cannot govern health-data access effectively if it does not understand what data it holds, where it originates, who controls it or how it is used.

Relevant data may include electronic health records, research datasets, disease registries, certain clinical-study information, genomics, medical-device data and other categories specified in the Regulation.

Not every organisation will hold every category, and different data categories enter the EHDS framework at different stages.

For each relevant dataset, establish its purpose, accountable owner, legal-entity responsibility, sources, sensitivity, location, quality, access arrangements and retention requirements.

Organisations that qualify as health data holders should also prepare for applicable dataset-description requirements and engagement with the relevant health data access bodies.

Recommended evidence: A governed electronic health-data inventory, data-flow maps, ownership records and dataset-description readiness register.

3. Integrate EHDS requirements with existing privacy governance

The EHDS complements the EU GDPR; it does not replace it.

Existing obligations concerning lawful processing, transparency, data minimisation, security, accountability and individual rights remain central to the governance of personal health data.

The EHDS introduces additional requirements and specific legal mechanisms within its scope.

For organisations operating internationally, readiness therefore involves more than adding an EHDS section to an existing privacy policy.

Review the relationship between EHDS activities and:

• Records of processing activities.
• Data protection impact assessments.
• Controller and processor responsibilities.
• Data-sharing arrangements.
• Individual rights and transparency.
• Security and access controls.
• International data transfers.
• Documented governance decisions.

An existing DPIA may provide useful evidence, but it should not automatically be assumed to address every new EHDS requirement.

Recommended evidence: A privacy-governance gap assessment with documented actions, responsibilities and decision records.

4. Prepare for controlled secondary use of health data

Secondary use is particularly relevant to pharmaceutical research, real-world evidence and digital-health innovation.

Under the EHDS, eligible organisations may seek access to relevant electronic health data for permitted purposes through regulated access arrangements.

The framework also establishes obligations for relevant health data holders and responsibilities for health data access bodies.

However, secondary use is not unrestricted access to patient information.

Processing must be consistent with the applicable authorisation and safeguards. Relevant requirements include purpose limitation, data minimisation, secure processing arrangements and protections against inappropriate disclosure or re-identification.

The Regulation prohibits specified uses, including certain detrimental decisions about individuals, advertising-related uses and other activities outside its permitted framework.

It also establishes an individual right to opt out of secondary use, subject to defined conditions and limited Member State mechanisms for particular public-interest purposes.

Organisations should assess how they will manage:

• Data-access applications and permits.
• Permitted purposes and prohibited uses.
• Dataset descriptions and data quality.
• Pseudonymisation and anonymisation.
• Secure processing environments.
• Applicable opt-out requirements.
• Research accountability and publication safeguards.
• Protection of intellectual property and trade secrets.

Recommended evidence: A secondary-use governance framework, including permitted-purpose assessments, access-request records, security requirements and accountable approvals.

5. Assess EHR interoperability and technology assurance

For relevant technology providers and healthcare organisations, EHDS readiness requires understanding the relationship between existing systems and the Regulation's technical requirements.

The EHDS introduces common specifications for certain harmonised EHR software components, including interoperability and logging.

Those requirements must be assessed against the organisation's actual systems and product classifications.

A HealthTech supplier should therefore establish which products are affected, what their current capabilities are, where technical gaps exist and who is accountable for remediation.

Where applicable, the assessment should also consider how EHDS requirements interact with medical-device legislation, AI regulation, cybersecurity requirements and other relevant product obligations.

EHDS readiness does not automatically establish conformity with those other frameworks.

Recommended evidence: A technology applicability and interoperability gap assessment, with documented technical dependencies, supplier responsibilities and verification activities.

6. Strengthen third-party and cross-border governance

Health-data ecosystems often involve hospitals, research sponsors, contract research organisations, cloud suppliers, technology developers and international group companies.

EHDS implementation may therefore expose weaknesses in existing contractual arrangements, information flows and accountability.

Organisations should review whether responsibilities are sufficiently clear across participating parties.

Priority considerations include:

• Which organisation controls each relevant dataset.
• Who is responsible for providing information to competent bodies.
• How access requests and changes are managed.
• Whether contractual terms align with actual data flows.
• How security and confidentiality are maintained.
• Which international transfer mechanisms remain relevant.
• How supplier and subcontractor assurance is evidenced.

The EHDS does not remove the need to assess international transfers under applicable data-protection law.

Recommended evidence: A third-party responsibility matrix, reviewed data-sharing arrangements, transfer assessments where applicable and a consolidated supplier-assurance record.

7. Establish continuous assurance and executive oversight

EHDS readiness should not end when an organisation has completed an initial gap assessment.

As implementing acts, national arrangements and technical requirements develop, organisations will need to maintain their compliance position.

A proportionate assurance programme should give leadership visibility of:

• Confirmed regulatory obligations.
• Upcoming implementation milestones.
• Material governance gaps.
• Technology and supplier dependencies.
• Outstanding DPIAs and assessments.
• Decisions requiring executive approval.
• Remediation progress.
• Residual risks and supporting evidence.

The objective is to enable informed decisions and demonstrate how the organisation has progressed from regulatory interpretation to accountable implementation.

Recommended evidence: An EHDS assurance dashboard, obligations register, remediation plan and periodic executive report.

---

What should organisations do in the next 90 days?

For organisations that have not yet begun structured preparation, a focused 90-day exercise can establish the foundation without prematurely committing to a large transformation programme.

This is an illustrative planning model, not a statutory implementation timetable. The actual programme should reflect organisational complexity, regulatory exposure and existing capability.

Five questions every board or executive sponsor should ask

1. Applicability: Which group entities, datasets, systems and activities are actually within the EHDS regulatory perimeter?
2. Accountability: Who owns EHDS readiness, and how are privacy, research, clinical, technology and supplier responsibilities coordinated?
3. Evidence: Can the organisation demonstrate reliable oversight of electronic health-data holdings, access arrangements and material risks?
4. Dependencies: Which implementation requirements depend on regulatory specifications, technology suppliers, partners or Member State arrangements?
5. Assurance: What will leadership receive to demonstrate readiness before each relevant application deadline?

If these questions cannot be answered reliably, the immediate need is likely to be a structured governance assessment rather than a technology-led implementation programme.

---

Frequently asked questions

Is the European Health Data Space already law?

Yes. Regulation (EU) 2025/327 entered into force on 26 March 2025. Its application is phased, with important provisions applying from 2027 and major operational obligations in 2029 and 2031, depending on the subject matter.

Does the EHDS replace the GDPR?

No. The EHDS establishes additional and complementary rules concerning electronic health data. The GDPR remains fundamental to the lawful and accountable processing of personal data.

Can pharmaceutical companies use EHDS data for commercial research?

Private-sector organisations can potentially qualify as health data users for permitted scientific research and innovation activities. However, access is subject to the Regulation's conditions, authorisation procedures and safeguards. Not every proposed commercial use is permitted.

Does the EHDS require all pharmaceutical clinical trial data to be shared?

No blanket conclusion should be drawn. The Regulation specifies relevant categories and conditions for secondary use. Clinical-trial and clinical-investigation data require particular attention to scope, applicable timing, the status of the study, confidentiality and other regulatory obligations.

Does the EHDS apply to UK-headquartered organisations?

It may be relevant where the organisation has EU establishments, activities or data responsibilities within the Regulation's scope. A group-level applicability assessment should examine the relevant entities and processing arrangements. UK headquarters alone does not establish the full legal position.

Is an existing GDPR compliance programme sufficient?

Not necessarily. A mature GDPR programme provides a useful foundation, but EHDS obligations concerning specific data-access arrangements, health-data roles, interoperable systems and secondary-use governance may require additional assessment and controls.

---

How IG-Smart can support EHDS governance readiness

EHDS preparation brings together privacy, information governance, technology, third-party risk and regulatory assurance.

IG-Smart supports regulated organisations in assessing requirements, clarifying accountability, developing governance arrangements and establishing the evidence needed for informed decisions.

Relevant capabilities include:

• Governance and regulatory readiness assessments: Identifying applicable requirements, responsibilities, material gaps and implementation priorities.
• Privacy and data-sharing governance: Supporting DPIAs, information-flow assessments, documented responsibilities and relevant transfer arrangements.
• Third-party and technology assurance: Reviewing supplier obligations, governance dependencies and relevant control evidence.
• Managed governance and continuing assurance: Establishing proportionate oversight, remediation tracking and executive reporting.

Engagements can be defined around a specific readiness assessment or a broader governance programme, depending on the organisation's circumstances. Specialist technical conformity assessments, clinical-safety responsibilities or jurisdiction-specific legal opinions should be scoped separately where required.

Explore our Life Sciences & Pharmaceuticals, HealthTech Governance & Clinical Assurance and International Data Transfer Assurance capabilities.

Preparing for the European Health Data Space?

If your organisation needs to establish which EHDS requirements apply, assess its existing governance arrangements or build an evidence-led readiness roadmap, IG-Smart can help define a proportionate starting point.

**Talk to a Senior Practitioner →**

---

Regulatory sources and further reading

This article draws on authoritative EU sources, including:

1. Regulation (EU) 2025/327 — European Health Data Space, official legislative text
2. European Commission — European Health Data Space Regulation and implementation milestones
3. European Commission — Frequently Asked Questions on the EHDS, updated 26 March 2026
4. EUR-Lex — European Health Data Space legislative summary

*Editorial note: This guidance reflects the regulatory position checked on 15 October 2026. EHDS implementing acts, national arrangements and technical specifications should be reviewed as they develop. The applicability and legal consequences of particular requirements depend on the organisation's activities and circumstances. This article provides general governance guidance, not a determination of any organisation's legal obligations.*