Health data for research and AI, under strict conditions.
The European Health Data Space gives patients control of their health data, and opens it for research, innovation and training AI. Access goes through a national body, a permit and a secure environment. It applies in stages from 2027.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Healthcare providers and other holders of health data
- Makers of electronic health record systems
- Researchers and companies that want to use health data, including to train AI
- 25 Mar 2025 In force.
- 26 Mar 2027 General application; countries name their health data access bodies.
- 26 Mar 2029 Secondary use for research and innovation; first patient-data categories exchanged.
- 26 Mar 2031 Further categories, such as images, genomic and clinical-trial data.
A regulated route to data that was hard to reach.
Permits
Users apply to a national health data access body, which can issue a data permit for an allowed purpose.
AI is an allowed purpose
Training, testing and evaluating algorithms, including in medical devices and AI systems, is one of the listed purposes.
Secure environments
Data is used only inside a secure processing environment, anonymised where that is enough.
Clear limits
Advertising and decisions that harm individuals, such as in insurance or employment, are banned. Citizens can opt out.
From requirement to working system.
The organisations ready to use this data will be those that already work in secure, well-documented environments.
- Plan research and AI projects around the permit process
- Build analysis and training pipelines that run in secure environments
- Data quality and documentation that make results reproducible
- Validation that holds up when the data comes from many sources
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation