Health Data Sovereignty: GDPR, EHDS and the EU AI Act
Health data is the most sensitive information a state holds about its citizens, and it is also the raw material of every useful medical AI system. Europe has spent the past decade building a legal framework that tries to hold both truths at once: strict protection of the individual, and structured, permit-based reuse of data for care, research and policy. For Moldova, an EU candidate country now negotiating accession, that framework is no longer someone else's regulation. It is the standard its national healthcare digitalisation will be measured against.
This article sets out the three layers of European law that matter most for healthcare AI: the General Data Protection Regulation (GDPR), the European Health Data Space (EHDS) regulation and the EU Artificial Intelligence Act. It then looks at how Finland put secondary use into practice, and explains why processing on premises, inside the country, is the practical expression of data sovereignty.
Layer one: GDPR and health data as a special category
GDPR (Regulation (EU) 2016/679) remains the foundation. It treats data concerning health, genetic data and biometric data as "special categories" whose processing is prohibited unless one of a limited set of conditions applies, such as the provision of health care, reasons of public interest in public health, or scientific research with appropriate safeguards. Every hospital information system, laboratory database and AI pipeline that touches patient records operates inside this regime.
Three GDPR principles bear directly on AI design:
- Purpose limitation. Data collected to treat a patient cannot automatically be reused to train a model. A separate legal basis, and often a separate governance decision, is needed.
- Data minimisation and security. Controllers must use only what is necessary and must protect it with measures appropriate to the risk. For health data, the risk is high by definition.
- Restrictions on international transfers. Personal data may leave the jurisdiction only under defined conditions such as adequacy decisions or approved safeguards. Every transfer adds legal analysis and residual risk.
GDPR answers the question "may this data be processed?" It does not by itself create the infrastructure for reusing health data at scale. That is the job of the EHDS.
Layer two: the European Health Data Space
The EHDS regulation, Regulation (EU) 2025/327, was published in the Official Journal on 5 March 2025 and entered into force on 26 March 2025. It has two parts.
Primary use: data following the patient
The first part gives people electronic access to their own health data and lets that data move between providers, including across borders. According to the European Commission's timeline, cross-border exchange of patient summaries and ePrescriptions is due from March 2029, with medical images, laboratory results and hospital discharge reports following from March 2031. EHR systems placed on the EU market must meet common interoperability and security requirements before they can be sold.
Secondary use: permits, not downloads
The second part, the more consequential one for AI, creates a regulated route for reusing health data for research, innovation, policy-making and statistics. The key mechanisms are:
- Health data access bodies in each member state, which issue data permits for specified purposes only.
- Secure processing environments. The Commission states that approved users work in environments meeting high privacy and cybersecurity standards, and that personal data may not be downloaded.
- An opt-out right. Individuals can decline secondary use of their data in a simple and reversible way, with narrow exceptions for important public-interest purposes.
Most secondary-use rules apply from March 2029, with some data categories, including genomic data, following in 2031. The model is clear: data stays in a controlled environment, and analysts and algorithms come to it.
Layer three: the EU AI Act and medical AI
The Artificial Intelligence Act, Regulation (EU) 2024/1689, classifies AI systems by risk. Most clinical AI is high-risk through Article 6(1). An AI system is high-risk where it is a safety component of a product, or is itself a product, covered by the EU harmonisation legislation listed in Annex I (which includes the Medical Devices Regulation and the In Vitro Diagnostic Medical Devices Regulation) and that product must undergo third-party conformity assessment. In practice, AI software that supports diagnosis or triage and is certified as a medical device above the lowest risk class will typically fall here.
High-risk obligations include a risk-management system, data governance requirements for training, validation and testing datasets, technical documentation, automatic logging, transparency towards deployers, human oversight, and appropriate levels of accuracy, robustness and cybersecurity. Deployers such as hospitals take on duties of their own, including using systems according to instructions, assigning competent human oversight and monitoring operation.
The 2026 timeline change
The timetable moved in 2026. The "Digital Omnibus on AI", Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It postponed the high-risk obligations to fixed dates: 2 December 2027 for stand-alone high-risk systems listed in Annex III, and 2 August 2028 for high-risk AI embedded in products under Annex I, which includes medical devices. Prohibited practices and AI-literacy duties already apply.
The delay does not change what will be required. Health systems procuring or building AI today should assume their systems will have to show documented data governance, traceable logs and effective human oversight. All three are much easier to show when data and models run on infrastructure the health system controls.
Findata: what permit-based secondary use looks like in practice
Finland did not wait for the EHDS. Its Act on the Secondary Use of Health and Social Data (552/2019) came into force in May 2019 and created Findata, the Finnish Social and Health Data Permit Authority. Findata grants permits for secondary use of social and health data, then compiles, combines and pre-processes the data from multiple registers itself, so the requester never assembles a copy. Approved analysis takes place in secure processing environments, including Findata's own remote-access environment, Kapseli. In 2020 Findata issued binding requirements for secure environments: individual-level data may only be analysed in environments that meet them.
Three lessons from Findata apply to any country designing national health data governance:
- One permit authority beats many bilateral agreements. A single legally mandated body makes access predictable for researchers and auditable for citizens.
- The environment is the control. Restricting where analysis can happen gives a stronger guarantee than trying to control copies after release.
- Operational capacity matters as much as law. Permits without fast, well-run secure environments create backlogs. Finland has since reformed parts of its secondary-use law to address practical friction.
Where Moldova stands
Moldova is formally on the path to EU membership. The European Council granted it candidate status on 23 June 2022, decided to open accession negotiations on 14 December 2023, and held the first intergovernmental conference on 25 June 2024. According to the European Commission, the conference opening the first negotiating cluster, the fundamentals, took place on 15 June 2026.
Alignment with the EU's data protection acquis is part of that process. Moldova's Parliament adopted Law No. 195/2024 on personal data protection on 25 July 2024. It replaces the 2011 framework, partially incorporates GDPR provisions into national law and applies from 23 August 2026. It recognises health, genetic and biometric data as protected categories and regulates cross-border transfers. The EHDS and the AI Act are not yet binding on Moldova. But a candidate country that designs its national systems to EU standards now avoids costly re-engineering at accession, and can join European data and research networks earlier.
Why on-premise processing is the practical form of sovereignty
Laws set the rules, and infrastructure decides whether they can be enforced. For national health data, keeping processing in the country and on premises gives several concrete advantages:
- Jurisdictional clarity. Data that never leaves national infrastructure stays under national law and national supervisory authorities. There are no transfer impact assessments and no exposure to foreign legal demands for access.
- EHDS-style control by design. A national secure processing environment, where models are trained and run next to the data, is the architecture both Findata and the EHDS use.
- AI Act readiness. Logging, version control of models and datasets, and human-oversight workflows are simpler to implement and audit on infrastructure the health system operates.
- Clinical continuity. Time-critical workflows such as imaging triage should not depend on international connectivity or the commercial priorities of a third party.
Sovereignty is not isolation. The same infrastructure can take part in federated research, where models or aggregate statistics move but identifiable records do not. That is the direction European health data policy is taking.
What this means for Moldova's National Healthcare Digitalization Program
The National Healthcare Digitalization Program of the Republic of Moldova (2025–2030) covers around 2.36 million people across five AI domains: medical imaging, genomics, pharmacology and treatment planning, disease prediction and healthcare management. The programme's founding principle is that the medical data of Moldovan citizens is processed only inside the country, with public cloud processing excluded.
As a technical partner of the programme, SRL "IMPORT MEDICAL" owns and operates sovereign, on-premise, high-performance AI computing capacity in Moldova for exactly this kind of workload. Clinical data, genomic sequences and administrative records stay under Moldovan jurisdiction while the programme follows European practice on secure processing, auditability and human oversight. Our AI infrastructure page describes the approach. For background on how other countries have built national systems, see our articles on Estonia's national eHealth system and national genomics programmes, and on capacity planning in how to plan on-premise AI computing for national healthcare.
If you are a hospital director, Ministry official or IT lead working out how EU-aligned data governance applies to your institution, contact our team.
Sources
- European Health Data Space Regulation (EHDS) — European Commission, DG SANTE
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — EUR-Lex, Publications Office of the EU
- Digital Omnibus on AI has been published — Cuatrecasas
- Findata – Finnish Social and Health Data Permit Authority — Findata
- Moldova – EU enlargement — European Commission, DG Enlargement
- Data protection laws of the world: Moldova — DLA Piper