The two-speed EHDS

The European Health Data Space is one regulation. It is not producing one outcome.

Across all 27 Member States, the gap between the most prepared country and the least is 75 points out of 100 — a chasm, and one where the countries on the wrong side are rarely the ones people expect.

Three countries score 75 or above: France (85), Lithuania (84), and Finland (79). All three spent the previous decade building the legislative and technical foundations that the EHDS now requires everyone to have. Finland enacted its Act on the Secondary Use of Health Data in 2019. France stood up the Health Data Hub in 2019 and has processed hundreds of data access applications since. Lithuania has had a functioning national eHealth system for years and connected to MyHealth@EU early. The EHDS didn't make these countries advanced — it measured what they had already built.

At the bottom, Bulgaria scores 10. Romania scores 22. Slovakia scores 24. These are countries where the foundational infrastructure — designated authorities, patient portals, data access governance — is largely absent. The Regulation applies to them identically, but the distance they need to cover by 2029 is an order of magnitude greater.

The middle is where the story gets interesting — and uncomfortable. 12 countries sit in Tier C, scoring between 25 and 49: early stage by any honest measure. That group includes Italy (28), Austria (25), Ireland (25), Spain (41), and Poland (37). These are not small peripheral states. Italy and Spain are the EU's third and fourth largest economies. Poland is the fifth. Austria is one of the wealthiest countries in Europe per capita. Their presence this far down the table reflects years of underinvestment in digital health infrastructure combined with institutional fragmentation that makes rapid catch-up exceptionally difficult.

The secondary use cliff

The sharpest divergence in the data sits in secondary use — the dimensions that determine whether a country can participate in the research and innovation economy that the EHDS is designed to unlock.

Dimensions 4 and 5 measure secondary use governance and infrastructure: Has the country designated a Health Data Access Body? Is it operational? Does a Secure Processing Environment exist? Is there a data catalogue? Can researchers actually apply for and receive health data access?

Seven countries score 15 or above out of 20 on D4 (secondary use governance): France, Lithuania, Germany, Denmark, and Belgium all hit 20; Finland scores 17; Greece scores 15. All seven have designated HDABs, most with operational capacity. At the other end, 11 countries score zero. Not low — zero. No designated HDAB, no governance framework, no oversight structure. The 2029 deadline requires all of this to exist. For those 11 countries, the entire institutional apparatus for secondary use of health data needs to be built from nothing in three years.

The infrastructure picture is equally stark. France, Germany, Denmark, and Sweden all score 18 out of 20 on D5 — they have operational or near-operational Secure Processing Environments, functioning data catalogues, and established researcher access pipelines. Finland scores 17. Below them, the floor drops away. 13 countries score 5 or below, with four at zero.

If you are designing a real-world evidence strategy for Europe, or building analytics tools for secondary use data, this is the map that matters. The EHDS promises a continent-wide framework. The reality is that secondary use infrastructure exists in a handful of countries today, and the timeline for the rest is uncertain at best.

The big-country paradox

The most consequential pattern in the data has nothing to do with the gap between top and bottom. It is where Europe's largest countries sit.

Germany scores 73 — Tier B, respectable at first glance. Look closer and the profile is lopsided in a way that matters. Germany scores a perfect 20 out of 20 on secondary use governance — the Forschungsdatenzentrum Gesundheit is operational, the BfArM is the designated HDAB — and 18 out of 20 on data infrastructure. Yet it scores zero on MyHealth@EU connectivity. Zero. Europe's largest economy has built a strong domestic research data apparatus and is not connected to the cross-border health data exchange that the EHDS makes mandatory. The gap reads less like a lag and more like a structural mismatch between national ambition and European integration.

Belgium tells the same story from a different angle. Perfect 20 on governance, zero on cross-border connectivity, and one of Europe's more advanced legal foundations (D1: 11) anchored by its 2023 Health Data Agency law — further along than Germany on legislation, further behind on the pipe that connects it to everyone else. The Netherlands scores 55 overall but only 9 on secondary use governance: one of Europe's most digitised healthcare systems still standing up the EHDS-specific institutions it needs. Three wealthy Western European countries, three different gaps — none trivial to close.

A regulation that works in Helsinki and Vilnius but not in Rome or Warsaw deserves a different name: a Nordic and Western European health data space with a regulatory wrapper around it.

Then there are the countries whose position should alarm anyone planning around the EHDS as a functioning continent-wide system. Italy scores 28 — the EU's third-largest economy has no functioning HDAB, minimal legal foundations, and limited cross-border connectivity. Spain scores 41, with solid legislative progress but zero MyHealth@EU connectivity and single-digit scores on secondary use. Poland scores 37, with zeroes across both secondary use dimensions.

Germany, Italy, Spain, and Poland together account for roughly half the EU's population. Add France (which is in Tier A) and the figure rises to 65%. The EHDS requires data to flow between countries.

What this means in practice

The practical consequence is that the EHDS creates a single regulatory framework but does not — yet — create a single market. If your product, your study, or your policy depends on secondary use data access, the addressable Europe in 2026 is seven or eight countries, not 27. France, Finland, Germany, Denmark, Lithuania, Belgium, and Greece have the governance infrastructure to process data access applications today. Estonia and Sweden have material pieces in place. Everyone else is building, planning, or hasn't started.

That matters differently depending on where you sit. If you are building a health tech company around real-world evidence or secondary use analytics, you validate in the countries that work now and plan expansion on a timeline measured in years, not quarters. If you are running a cross-border research programme, your protocol needs to be designed around infrastructure that exists, not regulation that applies. And if you are a health ministry official in a Tier C or D country, the uncomfortable truth is that the 2029 deadline does not adjust for your starting position. The countries at the top did not get there by responding to the EHDS. They built what the EHDS now requires, years before anyone told them to.

The gap will harden. The Regulation provides no equalisation mechanism, no structural funds for digital health catch-up, and no enforcement tool that can compress a decade of underinvestment into three years of compliance. The EHDS was designed as one space. What we are building, so far, is two.