Mandatory metadata for health data in the EU: what hospitals and insurers must do in 2026

Key data

If your organization manages electronic health data—whether a public hospital, a private insurer, a clinical laboratory or a patient registry—the Implementing Regulation (EU) 2026/2098 requires you to describe your datasets with a minimum set of metadata defined at European level. The regulation, published on 21 September 2026, develops Article 77.4 of Regulation (EU) 2025/327, which creates the European Health Data Space (EHDS).

The objective is clear: any researcher, authority or company that wants to access health data in Europe should be able to find, compare and request access to that data in a homogeneous way, regardless of the country or entity that holds it. For this to happen, all data holders must "speak the same language" in their catalogues.

What does this regulation establish?

The Implementing Regulation defines the minimum metadata elements that health data holders must provide when describing their datasets for secondary use, as well as the specific characteristics of each element. This is not a recommendation: it is a mandatory requirement to participate in the EHDS data exchange ecosystem.

Metadata are, in practical terms, the "technical sheet" of each dataset: what it contains, from what period, from what population, with what level of quality, under what access conditions, etc. Until now, each entity described them in its own way. With this regulation, everyone must follow the same European standard.

Economic and operational impact

This regulation does not impose fines or direct fees, but non-compliance has very concrete operational and strategic consequences:

• Exclusion from the EHDS ecosystem: Without correct metadata, the organization's datasets will not be visible or accessible to researchers, public authorities or pharmaceutical or technology companies operating in the EHDS. This means losing opportunities for collaboration and funding linked to European health research projects.
• Technology adaptation costs: Organizations will need to review and update their data cataloguing systems. Depending on the current state of data governance maturity, this may require investment in software, specialized consulting and internal training.
• Governance costs: Redesign internal processes to ensure that each new dataset is described with the minimum required metadata from the moment of its creation, not just retroactively.
• Reputational and regulatory risk: Entities that do not comply may be exposed to requirements from health data access authorities designated in each Member State under the EHDS framework.

Who does it affect?

The Regulation applies to any entity—public or private—that holds electronic health data in the EU. Specifically:

• Hospitals and health centres (public and private)
• Health insurers that manage clinical or claims data
• Clinical and diagnostic laboratories
• Clinical registries (oncology, rare diseases, vaccination, etc.)
• Public entities with health information systems (health departments, public health agencies)
• Technology and digital health companies that hold patient data
• Pharmaceutical and clinical research companies that have patient databases

Practical example

Imagine a private university hospital that manages a database of medical records for 200,000 patients and a registry of laboratory results from the last ten years. Until now, that hospital described its datasets internally with its own nomenclature.

With Regulation (EU) 2026/2098, that hospital must create a standardized "metadata sheet" for each dataset, following exactly the minimum elements and characteristics defined by the Commission. That sheet must be available in the EHDS ecosystem so that, for example, a European research consortium can identify that dataset, assess whether it meets its criteria and request secondary access through the mechanism established in Regulation (EU) 2025/327.

If the hospital does not publish that metadata in the correct format, its data simply will not appear in the European catalogue and will be excluded from any research project or collaboration that uses the EHDS as an access platform.

What should companies do now?

1. Identify all electronic health datasets that your organization manages and that could be subject to secondary use under the EHDS. Make a complete inventory.
2. Review current data cataloguing systems to determine which metadata fields are already collected and which are missing according to the minimum elements defined by Regulation (EU) 2026/2098.
3. Adapt data governance processes so that any new dataset is described from its creation with the minimum metadata required in the European format.
4. Designate an internal responsible party (DPO, data manager or equivalent) to coordinate adaptation to the EHDS metadata standard and be the contact point with the health data access authority in your Member State.
5. Consult the full text of Regulation (EU) 2026/2098 to learn the exact technical characteristics of each metadata element and assess whether specialized consulting support in health data interoperability is required.
6. Monitor complementary technical guides published by the European Commission and national health authorities, as the EHDS is an ecosystem under construction and additional developments are expected.

Official source

Consult full regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602098