EHDS Article 105: Which Staged Application Date Between 2027 and 2035 Actually Binds Your Organisation?

The EHDS Regulation is in force. Almost none of it applies yet.

Article 105 is the reason, and it is not an application date. It is a schedule: four fixed dates, one undated trigger, and a staging logic that runs per data category and per EHR-system intended purpose rather than per entity.

That last point breaks most implementation plans. Article 105 does not tell you when the EHDS applies to your organisation. It tells you when each provision applies to each category of data you hold, and to each system you build, buy or host.

A single hospital group can sit inside three of these clocks at once.

Why EHDS Article 105 is a schedule of four dates and one undated trigger, not a single application date

Article 105 sits in Chapter IX, which the Regulation titles "Deferred application, transitional and final provisions". The staging is the operative design, not a drafting artefact.

The second paragraph sets the default: this Regulation shall apply from 26 March 2027.

The third paragraph immediately carves that open. It begins "However" and pulls Articles 3 to 15, Article 23(2) to (6), and Articles 25, 26, 27, 47, 48 and 49 out of 2027, reassigning them to three sub-clocks: point (a) at 26 March 2029, point (b) at 26 March 2031, and point (c) with no date on it at all.

The fourth paragraph defers a class of EHR systems to 26 March 2031. The fifth handles Chapter IV: secondary use from 26 March 2029, with a named set pulled forward to 2027, five points of Article 51(1) pushed back to 2031, and exactly one provision sent to 26 March 2035. The sixth and seventh say when the implementing acts apply, which is not the same as when they must be adopted.

Count the fixed dates and you get four. The fifth clock has no date, because it does not exist yet.

What actually applies on 26 March 2027, and why almost none of it is a duty on health data holders

The 2027 set is defined by subtraction: everything the third, fourth and fifth paragraphs do not move.

That leaves Chapter I in full. It leaves Chapter II except Articles 3 to 15 and Article 23(2) to (6). It leaves Chapter III except Articles 25, 26, 27, 47, 48 and 49, which means Articles 28 to 46 apply from 2027: obligations of economic operators, technical documentation, the EU declaration of conformity, the common specifications regime under Article 36, and market surveillance. And it leaves Chapters V to IX.

Notice what that does to Chapter III.

Article 26(1) is the substantive gate: EHR systems shall be placed on the market or put into service only if they comply with the provisions laid down in that Chapter. That gate is staged out to 2029 or 2031. The conformity apparatus surrounding it is not. Manufacturers reading Article 105 as "Chapter III starts in 2029" will miss two years of Chapter III obligations that were never deferred.

Then there is the Chapter IV set pulled forward to 2027 by the fifth paragraph:

→ Article 55(6) and Article 75(1): Member States tell the Commission which health data access bodies they have designated, and the name and contact details of their national contact point for secondary use.

→ Articles 70, 73(5), 75(12), 77(4) and 78(6): the Commission adopts implementing acts covering the access application, data permit and health data request templates; the requirements for secure processing environments; the requirements, technical specifications and IT architecture of HealthData@EU; the minimum dataset elements; and the visual characteristics of the data quality and utility label.

Every one is a Member State duty or a Commission duty. Designate a body. Designate a contact point. Adopt an implementing act. Not one is an obligation on a health data holder.

The early Chapter IV date is institution-building. It is the state constructing the apparatus that will later receive your data. Holder duties start in 2029.

Which Article 14(1) priority categories pull the core provisions to 26 March 2029, and which wait until 2031

The third paragraph splits by data category, using the EHDS priority categories Article 14(1) sets out.

Points (a), (b) and (c) are patient summaries, electronic prescriptions and electronic dispensations. Those go to 26 March 2029, together with EHR systems intended by the manufacturer to process such categories.

Points (d), (e) and (f) are medical imaging studies and related imaging reports, medical test results including laboratory and other diagnostic results and related reports, and discharge reports. Those go to 26 March 2031, together with the systems intended to process them.

The block that moves with them is substantial: Articles 3 to 15, Article 23(2) to (6), and Articles 25, 26, 27, 47, 48 and 49.

Translate that into duties.

Article 13(1) requires healthcare providers, where electronic health data are processed for the provision of healthcare, to register the relevant personal electronic health data falling under at least the Article 14 priority categories in electronic format in an EHR system. Live in 2029 for summaries, prescriptions and dispensations. 2031 for imaging, lab results and discharge reports.

Article 15(4) requires Member States to ensure the priority categories are issued in the European electronic health record exchange format, and the receiving provider to accept and read that format for automated transmission. Same split.

Article 23(6) requires pharmacies, including online pharmacies, to access and accept electronic prescriptions transmitted from other Member States through MyHealth@EU and to report the dispensation back. Prescriptions and dispensations are points (b) and (c), so 2029.

The lighter, structured categories move first. The heavy-volume clinical categories, imaging and laboratory, get the extra two years.

One textual point for your counsel. Article 23(2) carries an internal deadline of 26 March 2027 for Member States to inform the Commission of their national contact point for digital health, yet Article 23(2) is itself in the third-paragraph carve-out, so as a provision it applies from 2029 or 2031. Read that deadline as a programming date for national administrations. It accelerates nothing on a provider or a manufacturer.

For anyone running a healthcare compliance programme, the operative rule is that staging is per category and per intended purpose, never per entity. Your patient-summary flow and your imaging flow are on different clocks inside the same building.

If your EHR system is built in-house or bought as a service, does Chapter III really only bind you from 26 March 2031

Yes, and it is a different kind of deferral from the category clock.

The fourth paragraph says Chapter III shall apply to EHR systems put into service in the Union referred to in Article 26(2) from 26 March 2031.

Article 26(2) deems two things to have been put into service: EHR systems manufactured and used within health institutions established in the Union, and EHR systems offered as a service, as defined in Article 1(1), point (b), of Directive (EU) 2015/1535, to a natural or legal person established in the Union.

In practice: your in-house build, and your hosted EHR.

For those systems the deferral is not category-staged. It is the whole of Chapter III, all categories, one date. An in-house hospital EHR handling patient summaries does not fall under Chapter III in 2029 the way a packaged product intended to process patient summaries does. It falls under Chapter III in 2031.

That produces a real asymmetry between two vendors selling substantially the same capability. A packaged EHR product placed on the market is on the category clock for Articles 25, 26 and 27, and on 2027 for Articles 28 to 46. The same capability delivered as a service to an EU customer is deemed put into service, and the whole Chapter sits at 2031.

Now the mistake to avoid. Chapter III at 2031 defers the system obligations. It does not defer your obligations as a healthcare provider under Chapter II, and it does not defer your obligations as a health data holder under Chapter IV.

You can be required to make data available for secondary use two years before the system holding it must comply with the essential requirements in Annex II.

Why Chapter IV applies from 26 March 2029 but holds five points of Article 51(1) until 2031, and Article 75(5) until 2035

The EHDS Chapter IV secondary use date is 26 March 2029. For most health data holders, the EHDS 26 March 2029 date is the one to plan against, because that is when Article 51(1) starts requiring you to make categories of electronic health data available.

Article 51(1) lists seventeen categories, point (a) to point (q). Twelve apply from 2029. Five do not.

The fifth paragraph holds these back to 26 March 2031:

• (b) data on factors impacting on health, including socioeconomic, environmental and behavioural determinants of health
• (f) human genetic, epigenomic and genomic data
• (g) other human molecular data such as proteomic, transcriptomic, metabolomic, lipidomic and other omic data
• (m) data from clinical trials, clinical studies, clinical investigations and performance studies subject to Regulation (EU) No 536/2014, Regulation (EU) 2024/1938, Regulation (EU) 2017/745 and Regulation (EU) 2017/746
• (p) data from research cohorts, questionnaires and surveys related to health, after the first publication of the related results

These are the five hardest to prepare: the deepest consent history, the strongest re-identification exposure, the most contested ownership. The two-year gap is not generosity. It is the time you will need.

Article 51(4) also lets Member States introduce stricter measures and additional safeguards for points (f), (g), (i) and (q). The deferred set and the stricter-measures set overlap on genomic and omic data without being the same list. Hold genomic data and you face a later start date and a higher probability of national add-ons.

The 2035 item is a single provision. Article 75(5) governs third countries and international organisations becoming authorised participants in HealthData@EU. That is the only thing in Article 105 dated 26 March 2035, and it is a cross-border infrastructure question, not a holder duty.

What is the undated sixth clock in Article 105, third paragraph, point (c)

Point (c) is what most compliance calendars will get wrong, because there is nothing to put in the calendar yet.

It runs the staged provisions from one year from the date established in a delegated act to be adopted pursuant to Article 14(2), for each amendment of the main characteristics of personal electronic health data set out in Annex I, provided that date is subsequent to the point (a) or point (b) date for the categories concerned.

Article 14(2) empowers the Commission to amend Annex I by adding, modifying or removing those main characteristics, where the amendments adapt the categories to technical developments and international standards. Additions and modifications must also be relevant for healthcare provided to natural persons and used in the majority of Member States according to the most recent information.

Annex I today sets out main characteristics across the six categories, including eighteen enumerated elements inside patient summaries alone, from vaccination information to medical devices and implants to plan of care.

Add a characteristic there and a fresh one-year clock starts for it, provided that clock lands after the category's own date.

The EHDS phased application timeline is open-ended by construction. Any plan that hard-codes four dates will be wrong the first time a delegated act under Article 14(2) lands. That is the case for treating regulatory change as a monitored input rather than a one-time mapping exercise: the amendment does not only change the requirement, it changes the date the requirement attaches.

Why the implementing acts must be adopted by 26 March 2027 but only apply from 2029

Nine articles carry a 26 March 2027 adoption deadline for the Commission: Article 13(4) on data quality requirements for registration, Article 15(1) on the European electronic health record exchange format, Article 23(4) on MyHealth@EU technical development and security rules, Article 36(1) on common specifications for the Annex II essential requirements, and Articles 70, 73(5), 75(12), 77(4) and 78(6) on the secondary-use side.

The sixth paragraph says the implementing acts under Articles 13(4), 15(1), 23(4) and 36(1) apply from the third-paragraph dates, depending on whether the data fall under Article 14(1) points (a) to (c) or points (d) to (f). The seventh says the acts under Articles 70, 73(5), 75(12), 77(4) and 78(6) apply from 26 March 2029.

Together those give you the most useful fact in the article: the technical target exists roughly two years before the obligation does.

That gap is the build window:

→ Field-level gap analysis of your export against the Article 15(1) exchange format, per priority category.

→ Annex II conformity gap analysis against the Article 36(1) common specifications, including the logging fields in Annex II point 3.2.

→ Secure processing environment designed or procured against the published Article 73(5) specification rather than an assumption.

→ Dataset metadata built against Article 77(4), and a decision on which datasets were collected or processed with Union or national public funding, because Article 78(2) makes the data quality and utility label mandatory for those.

Two years of specification-led preparation, or two years of waiting followed by a scramble. The dates are the same either way.

What this means operationally

Article 105 turns one regulation into a matrix. Rows are your data categories and your systems. Columns are 2027, 2029, 2031, 2035, and an open column for whatever a delegated act adds. Most organisations will populate that matrix once, in a spreadsheet, and it will be stale the first time Annex I moves.

That is the argument for holding obligations as structured data: every obligation traced to a verbatim quote from the source legal text, with the application date carried as a property of the obligation rather than a footnote in a project plan. Answer once. Assess everything.

It is also the difference between a readiness claim and an audit posture you can evidence: a posture you can defend in front of a regulator, a board, or a plaintiff.

Map every EHDS obligation to the date it actually applies against your own organisational profile. See your exposure at aegis-grc.com.

FAQ

What changes on 26 March 2027 for a hospital or a health data holder?

Directly, very little. The 2027 set is the general application date for everything Article 105 does not defer, plus a Chapter IV block (Articles 55(6), 70, 73(5), 75(1) and (12), 77(4) and 78(6)) that is entirely Member State designation duties and Commission implementing acts. Manufacturers placing EHR systems on the market pick up Articles 28 to 46. Health data holders pick up no secondary-use duty until 2029.

Does EHDS apply to my whole organisation on one date?

No. Staging is per priority category of data and per the categories an EHR system is intended by its manufacturer to process. One organisation routinely runs two live clocks: patient summaries, prescriptions and dispensations on 26 March 2029, and imaging, test results and discharge reports on 26 March 2031.

Our EHR is hosted by a vendor. Which date applies to it?

An EHR system offered as a service to a person established in the Union is deemed put into service under Article 26(2), and Chapter III applies to EHR systems put into service under Article 26(2) from 26 March 2031, for all categories. That deferral covers the system only. Your Chapter II and Chapter IV duties run on their own dates.

Are there really only four dates?

There are four fixed dates in Article 105: 26 March 2027, 2029, 2031 and 2035. There is also one undated trigger in the third paragraph, point (c), running one year from a date established in a future delegated act under Article 14(2) amending Annex I, where that date falls later than the category's own date. Four dates and an open clock.