EHDS articles and annexes
This page lists the articles of Regulation (EU) 2025/327 by chapter and gives the text of Annexes II to IV: Annex II sets the essential requirements for the harmonised software components of EHR systems, Annex III the content of the technical documentation and Annex IV the content of the EU declaration of conformity. Annex I, the priority categories, is covered in each category page of the guide. The text of the annexes is the English original, shown for information only.
Informational copy of the Regulation text. It is not legal advice; the authentic text is the one published in the Official Journal of the European Union. Regulation (EU) 2025/327 on EUR-Lex
Articles 105
Number and title of each article, grouped by chapter. The full text is in the Regulation on EUR-Lex.
Chapter I General provisions 2
Chapter II Primary use 22
| Article | Title | Section |
|---|---|---|
| 3 | Right of natural persons to access their personal electronic health data | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 4 | Electronic health data access services for natural persons and their representatives | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 5 | Right of natural persons to insert information in their own EHR | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 6 | Right of natural persons to rectification | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 7 | Right to data portability for natural persons | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 8 | Right to restrict access | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 9 | Right to obtain information on accessing data | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 10 | Right of natural persons to opt out in primary use | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 11 | Access by health professionals to personal electronic health data | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 12 | Health professional access services | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 13 | Registration of personal electronic health data | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 14 | Priority categories of personal electronic health data for primary use | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 15 | European electronic health record exchange format | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 16 | Identification management | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 17 | Requirements for technical implementation | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 18 | Compensation for making personal electronic health data available | Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions |
| 19 | Digital health authorities | Governance for primary use |
| 20 | Reporting by digital health authorities | Governance for primary use |
| 21 | Right to lodge a complaint with a digital health authority | Governance for primary use |
| 22 | Relationship with supervisory authorities under Regulation (EU) 2016/679 | Governance for primary use |
| 23 | MyHealth@EU | Cross-border infrastructure for primary use of personal electronic health data |
| 24 | Supplementary cross-border digital health services and infrastructures | Cross-border infrastructure for primary use of personal electronic health data |
Chapter III Ehr systems and wellness applications 25
| Article | Title | Section |
|---|---|---|
| 25 | Harmonised software components of EHR systems | Scope and general provisions for EHR systems |
| 26 | Placing on the market and putting into service | Scope and general provisions for EHR systems |
| 27 | Relation to Union law governing medical devices, in vitro diagnostic medical devices and AI systems | Scope and general provisions for EHR systems |
| 28 | Claims | Scope and general provisions for EHR systems |
| 29 | Procurement, reimbursement and financing | Scope and general provisions for EHR systems |
| 30 | Obligations of manufacturers of EHR systems | Obligations of economic operators with regard to EHR systems |
| 31 | Authorised representatives | Obligations of economic operators with regard to EHR systems |
| 32 | Obligations of importers | Obligations of economic operators with regard to EHR systems |
| 33 | Obligations of distributors | Obligations of economic operators with regard to EHR systems |
| 34 | Cases in which obligations of manufacturers of an EHR system apply to other entities or individuals | Obligations of economic operators with regard to EHR systems |
| 35 | Identification of economic operators | Obligations of economic operators with regard to EHR systems |
| 36 | Common specifications | Conformity of the harmonised software components of EHR systems |
| 37 | Technical documentation | Conformity of the harmonised software components of EHR systems |
| 38 | Information sheet accompanying the EHR system | Conformity of the harmonised software components of EHR systems |
| 39 | EU declaration of conformity | Conformity of the harmonised software components of EHR systems |
| 40 | European digital testing environment | Conformity of the harmonised software components of EHR systems |
| 41 | CE marking of conformity | Conformity of the harmonised software components of EHR systems |
| 42 | National requirements and reporting to the Commission | Conformity of the harmonised software components of EHR systems |
| 43 | Market surveillance authorities | Market surveillance of EHR systems |
| 44 | Handling of risks posed by EHR systems and of serious incidents | Market surveillance of EHR systems |
| 45 | Handling of non-compliance | Market surveillance of EHR systems |
| 46 | Union safeguard procedure | Market surveillance of EHR systems |
| 47 | Labelling of wellness applications | Other provisions on interoperability |
| 48 | Interoperability of wellness applications with EHR systems | Other provisions on interoperability |
| 49 | EU database for registration of EHR systems and wellness applications | Registration of EHR systems and wellness applications |
Chapter IV Secondary use 32
| Article | Title | Section |
|---|---|---|
| 50 | Applicability to health data holders | General conditions with regard to secondary use |
| 51 | Minimum categories of electronic health data for secondary use | General conditions with regard to secondary use |
| 52 | Intellectual property rights and trade secrets | General conditions with regard to secondary use |
| 53 | Purposes for which electronic health data can be processed for secondary use | General conditions with regard to secondary use |
| 54 | Prohibited secondary use | General conditions with regard to secondary use |
| 55 | Health data access bodies | Governance and mechanisms for secondary use |
| 56 | Union health data access service | Governance and mechanisms for secondary use |
| 57 | Tasks of health data access bodies | Governance and mechanisms for secondary use |
| 58 | Obligations of health data access bodies towards natural persons | Governance and mechanisms for secondary use |
| 59 | Reporting by health data access bodies | Governance and mechanisms for secondary use |
| 60 | Duties of health data holders | Governance and mechanisms for secondary use |
| 61 | Duties of health data users | Governance and mechanisms for secondary use |
| 62 | Fees | Governance and mechanisms for secondary use |
| 63 | Enforcement by health data access bodies | Governance and mechanisms for secondary use |
| 64 | General conditions for the imposition of administrative fines by health data access bodies | Governance and mechanisms for secondary use |
| 65 | Relationship with supervisory authorities under Regulation (EU) 2016/679 | Governance and mechanisms for secondary use |
| 66 | Data minimisation and purpose limitation | Access to electronic health data for secondary use |
| 67 | Health data access applications | Access to electronic health data for secondary use |
| 68 | Data permit | Access to electronic health data for secondary use |
| 69 | Health data request | Access to electronic health data for secondary use |
| 70 | Templates to support access to electronic health data for secondary use | Access to electronic health data for secondary use |
| 71 | Right to opt out from the processing of personal electronic health data for secondary use | Access to electronic health data for secondary use |
| 72 | Simplified procedure for access to electronic health data from a trusted health data holder | Access to electronic health data for secondary use |
| 73 | Secure processing environment | Access to electronic health data for secondary use |
| 74 | Controllership | Access to electronic health data for secondary use |
| 75 | HealthData@EU | Cross-border infrastructure for secondary use |
| 76 | Access to cross-border registries or databases of electronic health data for secondary use | Cross-border infrastructure for secondary use |
| 77 | Dataset description and dataset catalogue | Health data quality and utility for secondary use |
| 78 | Data quality and utility label | Health data quality and utility for secondary use |
| 79 | EU dataset catalogue | Health data quality and utility for secondary use |
| 80 | Minimum specifications for datasets of high impact | Health data quality and utility for secondary use |
| 81 | Right to lodge a complaint with a health data access body | Complaints |
Chapter V Additional actions 10
| Article | Title |
|---|---|
| 82 | Capacity building |
| 83 | Training programmes and information for health professionals |
| 84 | Digital health literacy and digital health access |
| 85 | Additional requirements for public procurement and Union funding |
| 86 | Storage of personal electronic health data for primary use |
| 87 | Storage of personal electronic health data by health data access bodies and secure processing environments |
| 88 | Third-country transfer of non-personal electronic data |
| 89 | International governmental access to non-personal electronic health data |
| 90 | Additional conditions for transfer of personal electronic health data to a third country or an international organisation |
| 91 | Health data access applications and health data requests from third countries |
Chapter VI European governance and coordination 5
| Article | Title |
|---|---|
| 92 | European Health Data Space Board |
| 93 | Stakeholder forum |
| 94 | Tasks of the EHDS Board |
| 95 | Steering groups for MyHealth@EU and HealthData@EU |
| 96 | Roles and responsibilities of the Commission regarding the functioning of the EHDS |
Chapter VII Delegation of powers and committee procedure 2
Chapter VIII Miscellaneous 6
| Article | Title |
|---|---|
| 99 | Penalties |
| 100 | Right to receive compensation |
| 101 | Representation of a natural person |
| 102 | Evaluation, review and progress report |
| 103 | Amendment to Directive 2011/24/EU |
| 104 | Amendment to Regulation (EU) 2024/2847 |
Chapter IX Deferred application, transitional and final provisions 1
| Article | Title |
|---|---|
| 105 | Entry into force and application |
Annex II Essential requirements for the harmonised software components of EHR systems and for products for which interoperability with EHR systems has been claimed 14
The essential requirements laid down in this Annex shall apply mutatis mutandis to medical devices, in vitro diagnostic medical devices, AI systems and wellness applications claiming interoperability with EHR systems.
| 1.1 | The harmonised software components of an EHR system shall achieve the performance intended by its manufacturer and shall be designed and manufactured in such a way that, during normal conditions of use, they are suitable for their intended purpose and their use does not put at risk patient safety. |
| 1.2 | The harmonised software components of the EHR system shall be designed and developed in such a way that the EHR system can be supplied and installed, taking into account the instructions and information provided by the manufacturer, without adversely affecting its characteristics and performance during its intended use. |
| 1.3 | An EHR system shall be designed and developed in such a way that its interoperability, safety and security features uphold the rights of natural persons, in line with the intended purpose of the EHR system, as set out in Chapter II. |
| 1.4 | The harmonised software components of an EHR system that is intended to be operated together with other products, including medical devices, shall be designed and manufactured in such a way that interoperability and compatibility are reliable and secure, and personal electronic health data can be shared between the device and the EHR system in relation to those harmonised software components of an EHR system. |
| 2.1 | Where an EHR system is designed to store or intermediate personal electronic health data, it shall provide an interface enabling access to the personal electronic health data processed by it in the European electronic health record exchange format, by means of the European interoperability software component for EHR systems. |
| 2.2 | Where an EHR system is designed to store or intermediate personal electronic health data, it shall be able to receive personal electronic health data in the European electronic health record exchange format, by means of the European interoperability software component for EHR systems. |
| 2.3 | Where an EHR system is designed to provide access to personal electronic health data, it shall be able to receive personal electronic health data in the European electronic health record exchange format, by means of the European interoperability software component for EHR systems. |
| 2.4 | An EHR system that includes a functionality for entering structured personal electronic health data shall enable the entry of data with sufficient granularity to enable the provision of the entered personal electronic health data in the European electronic health record exchange format. |
| 2.5 | The harmonised software components of an EHR system shall not include features that prohibit, restrict or place an undue burden on authorised access, personal electronic health data sharing or use of personal electronic health data for permitted purposes. |
| 2.6 | The harmonised software components of an EHR system shall not include features that prohibit, restrict or place an undue burden on authorised exporting of personal electronic health data for the reasons of replacing the EHR system by another product. |
| 3.1 | An EHR system designed to be used by health professionals shall provide reliable mechanisms for the identification and authentication of health professionals. |
| 3.2 | The European logging software component of an EHR system designed to enable access by healthcare providers or other individuals to personal electronic health data shall provide sufficient logging mechanisms that record at least the following information on every access event or group of events:(a) identification of the healthcare provider or other individuals having accessed the personal electronic health data;(b) identification of the specific natural person or persons having accessed the personal electronic health data;(c) the categories of data accessed;(d) the time and date of access;(e) the origin or origins of data. |
| 3.3 | The harmonised software components of an EHR system shall include tools or mechanisms to review and analyse the log data, or it shall support the connection and use of external software for the same purposes. |
| 3.4 | The harmonised software components of an EHR system that store personal electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data. |
Annex III Technical documentation 6
The technical documentation referred to in Article 37 shall contain at least the following information, as applicable to the harmonised software components of an EHR system in the relevant EHR system:
| 1 | A detailed description of the EHR system including:(a) its intended purpose, and the date and version of the EHR system;(b) the categories of personal electronic health data that the EHR system has been designed to process;(c) how the EHR system interacts or can be used to interact with hardware or software that is not part of the EHR system itself;(d) the versions of relevant software or firmware and any requirement related to version update;(e) the description of all forms in which the EHR system is placed on the market or put into service;(f) the description of hardware on which the EHR system is intended to run;(g) a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing, including, where appropriate, labelled pictorial representations (e.g. diagrams and drawings), clearly indicating key parts or software components and including sufficient explanation to understand the drawings and diagrams;(h) the technical specifications, such as features, dimensions and performance attributes, of the EHR system and any variants or configurations and accessories that would typically appear in the product specification made available to the user, for example in brochures, catalogues and similar publications, including a detailed description of the data structures, storage and input/output of data;(i) a description of any change made to the system throughout its lifecycle;(j) the instructions for use for the user and, where applicable, installation instructions. |
| 2 | A detailed description of the system in place to evaluate the EHR system performance, where applicable. |
| 3 | The references to any common specification used in accordance with Article 36 and in relation to which conformity is declared. |
| 4 | The results and critical analyses of all verifications and validation tests undertaken to demonstrate conformity of the EHR system with the requirements laid down in Chapter III, in particular the applicable essential requirements. |
| 5 | A copy of the information sheet referred to in Article 38. |
| 6 | A copy of the EU declaration of conformity. |
Annex IV EU declaration of conformity 8
The EU declaration of conformity for the harmonised software components of an EHR system shall contain all of the following information:
| 1 | The name of the EHR system, version and any additional unambiguous reference allowing identification of the EHR system. |
| 2 | Name and address of the manufacturer or, where applicable, its authorised representative. |
| 3 | A statement that the EU declaration of conformity is issued under the sole responsibility of the manufacturer. |
| 4 | A statement that the EHR system in question is in conformity with the provisions laid down in Chapter III and, if applicable, with any other relevant Union law that provides for the issuing of an EU declaration of conformity, complemented by the result from the testing environment mentioned in Article 40. |
| 5 | References to any relevant harmonised standards used and in relation to which conformity is declared. |
| 6 | References to any common specifications used and in relation to which conformity is declared. |
| 7 | Place and date of issue of the declaration, signature plus name and function of the person who signed and, if applicable, an indication of the person on whose behalf it was signed. |
| 8 | Where applicable, additional information. |