---
title: "European Health Data Space II: Health-Record Systems and…"
description: "What Chapter III of Regulation (EU) 2025/327 asks of manufacturers, importers and distributors of electronic health record systems, how wellness apps can claim…"
url: https://pitch.law/academy/european-health-data-space-health-record-systems-and-wellness-apps
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data Protection](https://pitch.law/academy/topics/privacy)

# European Health Data Space II: Health-Record Systems and Wellness Apps

What Chapter III of Regulation (EU) 2025/327 asks of manufacturers, importers and distributors of electronic health record systems, how wellness apps can claim interoperability, and where the Medical Devices Regulation takes over.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

The European Health Data Space Regulation, [Regulation (EU) 2025/327](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0327) of 11 February 2025, entered into force on 25 March 2025. Most people talk about its data side: patients' access to their records and the secondary use of health data, which we cover in our [first EHDS article](https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits). Chapter III, "EHR systems and wellness applications", is a product law. It decides which health-record software may be sold or used in the EU, and on what conditions.

### What is an EHR system

An **electronic health record system** is any system whose software, alone or with hardware, lets personal electronic health data in the priority categories be stored, intermediated, exported, imported, converted, edited or viewed, and which the manufacturer intends for use by healthcare providers in patient care or by patients accessing their data ([Article 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_2)). The priority categories are patient summaries, electronic prescriptions, electronic dispensations, medical imaging, test results and discharge reports ([Article 14(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_14)).

Chapter III does not apply to general purpose software used in a healthcare environment ([Article 25(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_25)). A hospital's word processor is not an EHR system.

Two cases count as "putting into service" even without a sale: EHR systems made and used within health institutions in the Union, and EHR systems offered as a service to someone established in the Union ([Article 26(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_26)). An in-house system and a cloud-based practice management platform are both caught.

### The harmonised software components

Every EHR system must include two **harmonised software components**: a European interoperability software component and a European logging software component (Article 25(1)). Annex II sets the essential requirements. In short, the system must export and receive data in the European electronic health record exchange format, must not obstruct authorised access, sharing or export (also when a customer replaces the system), must authenticate health professionals reliably and must log every access. The Commission adopts common specifications by 26 March 2027 ([Article 36](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_36)).

### When it applies

[Article 105](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_105) ties the dates to the data categories. The Regulation applies generally from 26 March 2027, but the core product rules (Articles 25 to 27 and 47 to 49) apply:

- from **26 March 2029** to EHR systems intended to process patient summaries, e-prescriptions and e-dispensations;
- from **26 March 2031** to EHR systems intended to process imaging, test results and discharge reports.

For in-house systems and systems offered as a service (Article 26(2)), Chapter III applies from 26 March 2031.

### Duties of manufacturers

[Article 30](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_30) lists the manufacturer's duties. It must:

- ensure the harmonised components meet Annex II and the common specifications, and are not adversely affected by other parts of the system;
- test those components in a European or national **digital testing environment** before placing the system on the market and include the results in the documentation ([Article 40](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_40));
- draw up **technical documentation** under Article 37, an **information sheet** under Article 38 and clear instructions for use, free of charge for the user;
- draw up the **EU declaration of conformity** ([Article 39](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_39)), one single declaration where other EU acts also require one;
- affix the **CE marking** to the accompanying documents and, where relevant, the packaging ([Article 41](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_41));
- register the system in the **EU database** before placing it on the market ([Article 49](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_49));
- run complaint channels, keep registers of complaints and non-conforming systems, and take corrective action, recall or withdrawal when needed.

Documentation and the declaration are kept for 10 years. On a reasoned request, the manufacturer must give authorities the source code or programming logic where they need it to check compliance (Article 30(3)). Serious incidents are reported to market surveillance authorities as soon as a causal link is established or reasonably likely, and in any event within three days of becoming aware ([Article 44(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_44)).

Marketing matters too. [Article 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_28) prohibits claims, names, trademarks or pictures that mislead professional users about intended purpose, interoperability or security, for instance by claiming functions the system lacks or hiding interoperability limits.

### Authorised representatives, importers and distributors

A manufacturer outside the EU appoints an **authorised representative** in the Union by written mandate, which is jointly and severally liable if the manufacturer fails its duties ([Article 31](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_31)).

**Importers** ([Article 32](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_32)) check the documentation, the declaration, the CE marking and the information sheet, add their own contact details, keep a copy of the declaration for 10 years, and maintain complaint channels and registers. **Distributors** ([Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_33)) check the declaration, the CE marking, the information sheet and the importer's details. Neither may sell a system they believe does not conform.

Under [Article 34](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_34), an importer, distributor or **user** becomes the manufacturer if it sells the system under its own name or trademark, or modifies it in a way that may affect conformity or changes its intended purpose. Every operator must be able to name its suppliers and customers for 10 years (Article 35).

### Wellness applications

A **wellness application** is software, or hardware with software, intended by the manufacturer for use by an individual to process electronic health data for information on health or care delivery, for purposes other than the provision of healthcare (Article 2). A wellness app is not obliged to be interoperable. If its manufacturer **claims** interoperability with EHR systems, it must meet Annex II and the common specifications and carry a label ([Article 47](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_47)):

- issued by the manufacturer, stating the data categories covered, the common specifications and a validity period of at most three years;
- in digital form inside the app when it is software only (a 2D barcode may be used);
- supplied with every unit, and made available electronically by distributors at the point of sale.

The app must also be registered in the EU database (Article 49). Interoperability must never mean automatic sharing: data go to the EHR only with the person's consent, and the person chooses which categories ([Article 48](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_48)).

### Medical devices and AI systems

The EHDS sits next to the [Medical Devices Regulation (EU) 2017/745](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0745). Software intended by its manufacturer for diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease is a medical device ([MDR Article 2(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32017R0745#art_2)). Under classification rule 11 in Annex VIII MDR, software that provides information used to take diagnostic or therapeutic decisions is at least class IIa, and software to monitor physiological processes is generally class IIa.

Where a medical device manufacturer claims interoperability with the harmonised components, it must prove compliance with the essential requirements in Section 2 of Annex II EHDS ([Article 27(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_27)). The same goes for high-risk AI systems under the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) that are not medical devices (Article 27(2)). Market surveillance for these products stays with the MDR authorities ([MDR Article 93](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32017R0745#art_93)) or the AI Act authorities (Article 43(7) EHDS), and they register in the MDR or AI Act database, from which the data are also forwarded to the EHDS database (Article 49(3)).

The EHDS also amended the [Cyber Resilience Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847): an EHR system that is a product with digital elements demonstrates conformity with the CRA's essential cybersecurity requirements through the EHDS Chapter III procedure ([Article 104](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_104)).

### Enforcement

Market surveillance follows [Regulation (EU) 2019/1020](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R1020) ([Article 43](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_43)). Authorities can require corrective action, restrict or prohibit sales and order recalls (Articles 44 and 45). Member States set penalties ([Article 99](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_99)).

## In practice

### A Belgian EHR vendor selling as a service

A Belgian software company offers a cloud platform for GP practices, holding patient summaries and e-prescriptions. Because it is offered as a service in the Union, it counts as put into service, and Chapter III applies to it from 26 March 2031. The work before then: build or integrate the two harmonised components against the common specifications, run the testing environment, write the technical documentation and information sheet, issue the declaration, affix the CE marking to the documents, register, and set up complaint and incident processes with a three-day reporting path. Its sales material needs a check against Article 28.

### A non-EU supplier and its Belgian reseller

A non-EU vendor sells its hospital records software in Belgium through a reseller. The vendor needs an authorised representative, and the reseller is either the importer or a distributor depending on who places the system on the EU market. If the reseller sells the system under its own brand or adapts it for local use in a way that may affect conformity, it becomes the manufacturer under Article 34. The distribution agreement should allocate those roles, the documentation hand-over, complaint handling, incident reporting and recalls, and say who pays for re-testing after modifications.

### A wellness app that wants to talk to EHRs

A sleep and fitness app wants to send data to patients' records. It can, but only by meeting Annex II, issuing a label valid for at most three years, registering in the EU database and letting users choose which categories to share. If the app starts giving treatment advice, check first whether it has become a medical device under the MDR.

### Contract points

- Warranties that the harmonised components conform, and a duty to keep them conforming through updates.
- Access to the information sheet, declaration and test results for customers and resellers.
- Cooperation on serious incidents within the three-day window.
- Clear rules on rebranding and modifications, given Article 34.
- Data export on termination, which Annex II already requires the components to allow.

## Frequently asked questions

### Is our practice management software an EHR system?

It is if it lets healthcare providers or patients store, view, exchange or edit personal data in one of the six priority categories. Pure scheduling or billing software that never touches those categories is unlikely to be one, and general purpose software is excluded.

### Do we need a notified body?

Chapter III has the manufacturer demonstrate conformity itself, through the testing environment, technical documentation and the EU declaration of conformity. If the product is also a medical device or a high-risk AI system, the procedures of the MDR or the AI Act apply for those aspects.

### Must every wellness app carry a label?

No. The label is only required when the manufacturer claims interoperability with EHR systems.

### Who is liable if the software causes harm?

The EHDS deals with conformity and market surveillance. Liability for defective software is covered by product liability law, which we discuss in our article on [AI, software and the new Product Liability Directive](https://pitch.law/academy/ai-software-and-the-new-product-liability-directive) in this series.

## How this connects

EHR vendors and app makers need contracts that match these roles, and the classification questions overlap with the AI Act. We draft and review supply, reseller and SaaS terms in our [commercial contracts](https://pitch.law/solutions/commercial-contracts-transactions) practice, and our [contract review](https://pitch.law/technologies/clause-library-risk-review) checks counterparty drafts for the points above. Where the software includes AI, our [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) service and the [AI Act register](https://pitch.law/technologies/ai-act-governance-toolkit) keep the classification and the duties in one place. See also [conformity assessments for high-risk AI systems](https://pitch.law/academy/conformity-assessments-high-risk-ai-systems).

### At a glance

- **Provisions cited:** EHDS Articles 2, 14(1), 25 to 28, 30 to 41, 43 to 45, 47 to 49, 99, 104 and 105, Annex II; MDR Articles 2(1) and 93, Annex VIII rule 11.
- **Key dates:** in force 25-03-2025; general application 26-03-2027 (common specifications due); EHR systems for patient summaries, e-prescriptions and e-dispensations 26-03-2029; other priority categories and in-house or as-a-service systems 26-03-2031.
- **In this series:** [European Health Data Space I: secondary use and data permits](https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits); [AI, software and the new Product Liability Directive](https://pitch.law/academy/ai-software-and-the-new-product-liability-directive).
- **Related reading:** [Distribution and reseller agreements](https://pitch.law/academy/distribution-reseller-agreements); [SaaS agreements](https://pitch.law/academy/saas-agreements); [Conformity assessments for high-risk AI systems](https://pitch.law/academy/conformity-assessments-high-risk-ai-systems).

## In short

- Which software counts as an EHR system, and what is excluded
- Duties of manufacturers, authorised representatives, importers and distributors
- Harmonised components, testing, CE marking and the EU database
- Labelling rules for wellness apps that claim interoperability
- How the EHDS relates to the Medical Devices Regulation and the AI Act

## Related solutions

- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)
- [Solutions](https://pitch.law/solutions/ai-act-compliance)
  ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance)
  [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)
- [Technology](https://pitch.law/technologies/ai-act-governance-toolkit)
  ### [AI Act Register and Assessments](https://pitch.law/technologies/ai-act-governance-toolkit)
  [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://pitch.law/technologies/ai-act-governance-toolkit)

## More in Data Protection

- ### [AI under Swiss Law and the GDPR: Key Differences](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr)
  [What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the EU AI Act.](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr)
- ### [Cookies and Consent](https://pitch.law/academy/cookie-compliance-and-consent-management)
  [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://pitch.law/academy/cookie-compliance-and-consent-management)
- ### [GDPR Breach Notification: the 72-Hour Rule](https://pitch.law/academy/data-breach-response-the-72-hour-countdown)
  [Article 33 GDPR: notify the authority within 72 hours of becoming aware of a personal data breach. When to notify, how hours count, when to tell people.](https://pitch.law/academy/data-breach-response-the-72-hour-countdown)
- ### [GDPR Data Retention: How Long to Keep Personal Data](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
  [The GDPR sets no fixed retention period: Article 5(1)(e) allows no longer than necessary. How to set retention periods, handle backups and delete data.](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)
- ### [How to Answer a DSAR Within the GDPR Deadline](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
  [Answer a data subject access request within one month, extendable by two (Articles 12 and 15 GDPR): what to send, what you may refuse, how to keep time.](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide)
- ### [The Wider Digital Omnibus: What Would Change in the GDPR, Cookies and the Data Act](https://pitch.law/academy/digital-omnibus-gdpr-cookies-data-act)
  [The Commission's proposal COM(2025) 837 would amend the GDPR, the cookie rule in the ePrivacy Directive and the Data Act, and fold the Data Governance Act into the Data Act. What the proposal says, provision by provision, and where it stands.](https://pitch.law/academy/digital-omnibus-gdpr-cookies-data-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)