News 12.10.2026 European Health Data Space enters a new implementation phase: three implementing regulations are now in force

The European Health Data Space has entered a new implementation phase. Three implementing regulations are now in force, setting detailed rules for MyHealth@EU, cross-border identification and authentication, and the description of health datasets for secondary use. For healthcare organisations, the focus is increasingly shifting from understanding the legislation to preparing the capabilities needed to make it work.

European Union | 12 October 2026

The European Health Data Space is moving another step closer to operational reality.

Three Commission implementing regulations adopted in September have now entered into force, establishing important parts of the technical and organisational architecture needed to implement Regulation (EU) 2025/327.

The new rules address three closely connected areas: the operation of MyHealth@EU, the cross-border identification and authentication of patients, health professionals and healthcare providers, and the metadata used to describe datasets for the secondary use of electronic health data.

Their substantive application remains phased over the coming years. Entry into force therefore does not mean that hospitals must comply immediately with every future EHDS requirement.

It does, however, mark an important transition: the implementation architecture is becoming increasingly concrete.

Three regulations, three implementation building blocks

MyHealth@EU: from cross-border ambition to operational infrastructure

Commission Implementing Regulation (EU) 2026/2083 provides detailed rules for MyHealth@EU, the central European infrastructure supporting the cross-border exchange of personal electronic health data.

The Commission will provide central services including reference software for national contact points for digital health, a terminology service, a secure communication network and a central configuration service.

The Regulation also addresses technical specifications, interoperability, cybersecurity, incident management and compliance checks for participation in the infrastructure.

For healthcare organisations, the direct legal responsibilities will depend on national implementation and on how providers connect to their national digital-health infrastructure.

But the operational message is already clear: cross-border interoperability ultimately depends on the quality, structure and reliability of data generated within healthcare organisations.

Identity and authentication become part of interoperability

Commission Implementing Regulation (EU) 2026/2099 addresses a fundamental question for cross-border healthcare: how can one health system trust the identity of a patient, professional or healthcare provider operating through another?

Member States will define national sets of healthcare attributes used to verify individuals in connection with their electronic health records and must notify those sets to the European Commission by 26 March 2028.

The framework also covers the identification and authentication of health professionals and healthcare providers and interacts with the European Digital Identity framework.

For hospital management, this makes identity and access management increasingly important as a clinical-governance issue.

Organisations need to know not only who is accessing information, but also in what professional role, on behalf of which organisation and under which authorisation.

Secondary use begins with knowing what data exists

Commission Implementing Regulation (EU) 2026/2098 defines the minimum metadata elements to be used when health data holders describe datasets for secondary use.

The framework is based on HealthDCAT-AP and aims to make datasets more consistently discoverable and understandable across Europe.

For hospitals, particularly academic and research-intensive organisations, this is more than a technical cataloguing exercise.

It requires organisations to progressively understand:

• what datasets they hold;
• where those datasets are located;
• who is accountable for them;
• how they were generated;
• what their quality and provenance are;
• and under what conditions they may eventually be made available for authorised secondary use.

Entry into force is not the same as full application

The three regulations are now legally in force, but their requirements do not all become operational at the same time.

The timetable provides a transition period, but many of the capabilities involved — interoperability, identity management, structured data, cybersecurity and data governance — require multi-year organisational change.

From a regulatory timetable to a management programme

The significance of these implementing regulations is not that every hospital now faces a new compliance deadline.

It is that the European architecture is becoming sufficiently concrete for organisations to make better decisions today.

Digital investments, EHR contracts, identity-management systems, data-governance arrangements and research infrastructure being designed now may still be in use when major EHDS obligations apply.

Preparing early therefore reduces both regulatory risk and the risk of expensive technological or organisational redesign later.

This article reflects the EHDS implementation position on 12 October 2026 and provides general information, not legal advice. The entry into force of the three implementing regulations does not mean that all EHDS obligations apply immediately to healthcare organisations. Application is phased and should be assessed together with Regulation (EU) 2025/327, applicable national law, GDPR, cybersecurity requirements and subsequent implementing measures.