MAY 2026 –The European regulatory and policy landscape for health data, medicines, biotechnology, artificial intelligence (AI), data protection and health technology assessment (HTA) is changing rapidly.

Several major EU frameworks are now beginning to converge:

• • • The General Data Protection Regulation (GDPR)
    • The draft EDPB Guidelines on processing personal data for scientific research purposes
    • The European Health Data Space (EHDS) Regulation
    • The EU Artificial Intelligence Act
    • The EU Health Technology Assessment Regulation
    • The reform of EU pharmaceutical legislation
    • The proposed European Biotech Act

At first glance, these may look like separate legal and policy developments. In practice, they are increasingly connected. Together, they are creating a more structured European ecosystem for health data access, scientific research, AI-enabled analysis, real-world evidence (RWE), regulatory decision-making, HTA, lifecycle oversight and health innovation.

For real-world research, the direction of travel is clear: Europe is moving toward wider and more systematic use of health data, but within a more formalised governance environment.

Why This Matters for Real-World Research

Real-world research is no longer sitting at the edge of regulatory and market access strategy.

It is becoming central to how Europe intends to support innovation, assess medicines and technologies, regulate AI-enabled health tools, evaluate relative effectiveness, monitor safety, improve access and strengthen healthcare resilience.

The opportunity is significant. The EHDS should improve discoverability and access to electronic health data for secondary use. The HTA Regulation is creating more structured EU-level clinical assessment processes. The pharmaceutical reform places greater emphasis on access, unmet medical need, supply, and lifecycle management. The Biotech Act aims to strengthen Europe’s biotechnology and biomanufacturing ecosystem. The AI Act sets rules for trustworthy AI, including in high-risk health settings.

At the same time, the EDPB draft scientific research guidelines show that the EU is also clarifying how GDPR applies to research use of personal data. This is particularly important for secondary use of health data, registries, AI-enabled research and real-world evidence generation.

The overall message is that data use will need to be lawful, transparent, secure, proportionate, explainable, interoperable and methodologically robust.

For sponsors, CROs, academic researchers, registry holders, data partners, HTA teams and AI developers, this means RWE strategy will need to become more integrated across regulatory, data protection, clinical development, pharmacovigilance, market access, AI governance and digital health functions.

The Regulatory Layers Are Beginning to Connect

Each framework plays a different role:

• • • GDPR remains the foundation for personal data protection. It governs lawful basis, special category health data, transparency, data minimisation, pseudonymisation, anonymisation, international transfers and research safeguards [1].
    • The EDPB draft scientific research guidelines are the GDPR interpretation layer. They clarify how GDPR applies to scientific research processing, including further processing, broad consent, public interest, legitimate interest, transparency, data subject rights, safeguards and controller accountability [2].
    • EHDS is the health-data access layer. It creates a sector-specific framework for access to and secondary use of electronic health data for purposes including research, innovation, policy-making, patient safety, personalised medicine, statistics and regulatory activities [3].
    • The AI Act is the AI governance layer. It sets harmonised rules for AI systems, including requirements for high-risk AI systems that may affect health, safety or fundamental rights [4].
    • The HTA Regulation is the evidence-use layer. It creates EU-level joint clinical assessments and joint scientific consultations, increasing the need for evidence that can support relative effectiveness assessment and future HTA decision-making [5][6].
    • The EU pharmaceutical reform is the medicines lifecycle layer. It is the most significant overhaul of the EU medicines framework in more than two decades and is intended to modernise authorisation, innovation, access and supply-related elements of the EU pharmaceutical system [7][8].
    • The proposed European Biotech Act is the innovation and competitiveness layer. It aims to strengthen the EU biotechnology and biomanufacturing sector by supporting innovation, simplifying regulatory processes, improving competitiveness and maintaining high safety, ethics and sustainability standards [9][10].

The combined effect is a new European operating environment in which data access, evidence generation, AI governance, regulatory assessment, HTA and innovation policy are increasingly interdependent.

GDPR: The Baseline Governance Framework

GDPR continues to be the starting point for any real-world research involving personal data.

For RWR, GDPR matters because most health data used in observational research will either be personal data or require careful assessment to determine whether data are anonymised, pseudonymised or still indirectly identifiable.

The GDPR research framework allows processing for scientific research purposes, but only with appropriate safeguards for the rights and freedoms of data subjects. These safeguards include technical and organisational measures, particularly to support data minimisation [1].

In practice, GDPR affects:

• • • Lawful basis for processing
    • Processing of special category health data
    • Transparency information for data subjects
    • Pseudonymisation and anonymisation strategies
    • Data minimisation
    • Data retention
    • Data protection impact assessments
    • Controller / processor arrangements
    • International transfers
    • Secondary use governance

GDPR does not prevent real-world research. However, it means RWR must be governed, documented and justified.

EDPB Scientific Research Guidelines: The GDPR Interpretation Layer

The draft EDPB Guidelines 1/2026 on processing personal data for scientific research purposes should be viewed as a key part of the emerging European research-data framework.

Adopted for public consultation in April 2026, the Guidelines are intended to clarify how GDPR applies to scientific research processing and respond to difficult questions raised by controllers, processors and supervisory authorities [2].

For real-world research, the Guidelines are particularly important because they address several issues that routinely arise in secondary use of health data, registry-based studies, biobanks, AI-enabled research and public-private research collaborations.

These include [2]:

• • • What qualifies as scientific research
    • When further processing for research may be compatible with the original purpose
    • How broad consent and dynamic consent may be used
    • When public interest or legitimate interest may support research processing
    • How special category health and genetic data should be handled
    • Transparency expectations for research participants and data subjects
    • Data subject rights in research contexts
    • Controller responsibility and accountability
    • Appropriate safeguards for scientific research processing

The Guidelines also reinforce the importance of using anonymised or pseudonymised data where possible, and using directly identifiable data only where necessary and proportionate. They identify safeguards such as ethical oversight, secure processing environments, privacy-enhancing technologies, publication safeguards and confidentiality arrangements [2].

This is highly relevant to the EHDS because improved access to health data will not remove GDPR accountability. Instead, EHDS access pathways and GDPR research safeguards will need to operate together.

Organisations preparing for EHDS-enabled secondary use should therefore also review the EDPB Guidelines when updating RWE governance, data-access procedures, transparency materials, DPIAs, controller / processor role assessments and data minimisation strategies.

EHDS: From Fragmented Access to Structured Secondary Use

The EHDS is likely to be one of the most important long-term developments for real-world research in Europe.

The Regulation establishes a common European framework for electronic health data and is designed both to improve individuals’ access to and control over their health data, and to enable secondary use of electronic health data for purposes that benefit society [3].

Secondary use purposes include research, innovation, policy-making, health threats preparedness, patient safety, personalised medicine, official statistics and regulatory activities [3].

This is directly relevant to real-world research.

Once implemented, EHDS should support more structured access to health data across Member States, including through Health Data Access Bodies, data permits, data catalogues and secure processing environments.

For RWR teams, this could support:

• • • Multinational observational studies
    • Registry-based research
    • Feasibility assessments
    • Natural history studies
    • Post-authorisation safety studies
    • Post-authorisation effectiveness studies
    • Comparative effectiveness research
    • Health services research
    • AI model development and validation
    • Regulatory studies
    • HTA evidence generation

However, EHDS will not simply make data “freely available”. It will create a regulated access framework. Researchers and sponsors should expect stronger expectations around permitted purpose, public interest, data minimisation, secure processing, transparency, data-source metadata and controls on re-identification.

The EDPB Guidelines are important here because they clarify how GDPR research concepts should be understood alongside emerging health-data access frameworks. EHDS may improve access, but GDPR accountability will remain central to lawful and trustworthy research.

AI Act: AI-Enabled RWR Will Need Stronger Governance

AI is becoming increasingly important in real-world research.

AI and machine learning may be used for cohort identification, phenotype development, endpoint extraction, natural language processing, imaging analysis, risk prediction, signal detection, patient stratification, data linkage, synthetic controls and decision-support tools.

The AI Act adds a new layer of governance to this environment.

The Regulation establishes harmonised rules for AI systems in the EU and sets out requirements for high-risk AI systems, including systems that may affect health, safety or fundamental rights [4].

This matters for real-world research because AI-enabled tools used in health research may sit at the intersection of several frameworks at once:

• • • GDPR for personal data processing
    • EDPB scientific research interpretation for research safeguards
    • EHDS for access to electronic health data
    • AI Act for model governance and high-risk AI requirements
    • MDR / IVDR where the AI system is a medical device
    • HTA expectations where AI-enabled evidence supports reimbursement
    • Pharmaceutical regulation where AI-enabled evidence supports regulatory decision-making

For RWR teams, the practical impact is likely to include greater scrutiny of:

• • • Training data provenance
    • Data quality and representativeness
    • Bias and fairness
    • Model validation
    • Transparency and explainability
    • Human oversight
    • Performance monitoring
    • Change control
    • Documentation
    • Accountability for model outputs

AI-enabled RWR will need to be treated as a governed evidence-generation process, not simply an analytical shortcut.

HTA Regulation: RWE Must Address Decision-Relevant Questions

The HTA Regulation creates an EU framework for joint clinical assessments and joint scientific consultations [5][6].

This matters because regulatory approval and HTA decision-making often require different evidence.

Regulators may focus on quality, safety, efficacy, benefit-risk and specific regulatory questions. HTA bodies are more likely to focus on relative effectiveness, appropriate comparators, patient-relevant outcomes, subgroups, durability of effect, treatment sequencing, healthcare-resource impact and uncertainty relevant to reimbursement.

The HTA Regulation does not make RWE mandatory in every assessment. However, it increases the importance of planning evidence that can support both regulatory and HTA needs.

For real-world research, this means RWE may become increasingly important for:

• • • Burden of disease
    • Natural history
    • Treatment pathways
    • Current standards of care
    • Comparator selection
    • External control arms
    • Long-term outcomes
    • Subgroup evidence
    • Real-world effectiveness
    • Adherence and persistence
    • Quality of life
    • Healthcare resource utilisation
    • Post-launch evidence generation

The practical implication is that RWE planning should begin earlier in development. Waiting until after authorisation to design real-world studies may be too late if evidence is also needed to support HTA, pricing, reimbursement or managed access.

EU Pharmaceutical Reform: Lifecycle Evidence Becomes More Important

The reform of EU pharmaceutical legislation is the most significant overhaul of the EU medicines framework in more than 20 years [7].

While the final legal details are being implemented, the direction of travel is clear: the reform is intended to modernise the EU medicines system, support innovation, improve access, address unmet medical need, strengthen supply resilience and update the regulatory framework for a changing development environment [7][8].

For RWR, this is important because many of these policy objectives depend on real-world data.

Real-world evidence may support:

• • • Unmet medical need assessments
    • Rare disease and orphan medicine development
    • Post-authorisation safety monitoring
    • Post-authorisation effectiveness studies
    • Conditional or exceptional evidence packages
    • Real-world utilisation and access monitoring
    • Supply and shortage impact assessment
    • Treatment pathway analysis
    • Comparative effectiveness
    • Evidence generation for under-represented populations

The pharmaceutical reform should therefore be viewed alongside EMA’s broader RWE activities, including regulatory use of real-world data, DARWIN EU, data-quality expectations, registry-based studies and non-interventional study guidance.

The practical message for sponsors is that RWE is likely to become more important across the entire lifecycle, from early development and scientific advice through authorisation, HTA, pharmacovigilance and post-authorisation evidence generation.

Biotech Act: Innovation Will Need Evidence Infrastructure

The proposed European Biotech Act is less directly focused on real-world research than EHDS or HTA, but it is strategically relevant.

The proposal is intended to strengthen Europe’s biotechnology and biomanufacturing sector, support innovation, simplify regulatory processes, improve competitiveness, facilitate access to finance and maintain high safety, ethics and sustainability standards [9][10].

For RWR, this matters because many biotechnology innovations raise evidence-generation challenges.

These may include:

• • • Small patient populations
    • Rare diseases
    • Advanced therapies
    • Personalised medicines
    • Platform technologies
    • Long-term safety monitoring
    • Manufacturing changes
    • Complex endpoints
    • Biomarker-defined populations
    • Real-world follow-up after early access or conditional approval

Biotech innovation will increasingly require evidence infrastructure that can support long-term follow-up, registries, treatment-outcome tracking, manufacturing comparability, safety monitoring and real-world effectiveness.

The Biotech Act therefore connects to EHDS, AI, HTA and pharmaceutical reform by increasing the strategic importance of Europe’s ability to generate decision-grade evidence from health data.

The Key Intersections

The practical impact comes from how these frameworks overlap:

• • • Data Access and Data Protection
      • EHDS aims to improve access to health data for secondary use. GDPR sets the baseline safeguards for personal data processing. The EDPB Guidelines clarify how GDPR applies to scientific research processing.
      • This means RWR teams may gain clearer routes to access data, but will also need stronger governance, documentation and safeguards.
      • The key question will not simply be: “Can we access the data?”
      • It will be: “Can we access and use the data lawfully, transparently, securely and proportionately for this specific research purpose?”
    • Scientific Research and Secondary Use
      • The EDPB Guidelines are particularly relevant because they address further processing for scientific research purposes, broad consent, legal bases, safeguards and transparency.
      • This directly intersects with EHDS because much EHDS-enabled research will involve secondary use of existing health data.
      • For RWR, the practical issue will be ensuring that data access under EHDS is supported by GDPR-compliant research governance. That includes data minimisation, pseudonymisation, secure processing environments, transparency, ethical oversight and clear accountability for controllers and processors.
    • AI and Health Data
      • EHDS may improve access to health data for research and innovation. The AI Act governs how AI systems are developed, deployed and monitored. GDPR and the EDPB Guidelines govern the personal-data processing underpinning many AI-enabled research activities.
      • This creates a direct intersection between health data access, scientific research safeguards and AI governance.
      • RWR teams using AI for endpoint extraction, cohort selection, disease progression modelling, safety signal detection or predictive analytics will need to demonstrate that data and models are fit for purpose, validated and appropriately governed.
    • Regulatory Evidence and HTA Evidence
      • The Pharma Package and EMA RWE initiatives support regulatory use of real-world evidence. The HTA Regulation creates more structured EU-level evidence expectations for relative clinical assessment.
      • This means RWE strategies need to be designed for multiple decision-makers.
      • A study designed only for regulatory purposes may not answer HTA questions. A study designed only for HTA may not meet regulatory expectations for data quality, bias control or protocol discipline.
      • Integrated evidence planning will become increasingly important.
    • Innovation and Lifecycle Oversight
      • The Biotech Act and Pharma Package are designed to support innovation. EHDS, GDPR, EDPB guidance, the AI Act and HTA Regulation create governance and evidence expectations.
      • This is not a contradiction. It is the emerging European model.
      • Innovation is being supported, but increasingly within a lifecycle framework requiring transparency, evidence generation, safety monitoring, data governance and post-market evaluation.
    • Fragmented Data and European-Scale Evidence Infrastructure
      • EHDS, HTA, AI governance, EU data catalogues and EMA RWE initiatives all point toward more structured, interoperable and reusable evidence systems.
      • This will increase the importance of:
        • • Metadata quality
          • Common data models
          • Data catalogues
          • Federated analytics
          • Secure processing environments
          • Data-source fitness-for-purpose assessments
          • Study registration
          • Protocol transparency
          • Reproducibility
          • Auditability

RWE will need to become more standardised without losing the flexibility required for different research questions.

What This Means in Practice

For organisations conducting real-world research in Europe, the combined impact is substantial.

Key practical implications include:

• • • RWE strategy should be developed earlier in the product lifecycle
    • Data access planning should account for EHDS and national implementation pathways
    • GDPR governance remains essential and should be integrated with EHDS readiness
    • The EDPB Guidelines should be reviewed when updating scientific research governance
    • AI-enabled research tools will need model governance, validation and documentation
    • HTA evidence needs should be considered alongside regulatory evidence needs
    • Registries and data partners should prepare for stronger metadata and interoperability expectations
    • Sponsors should strengthen data quality and fitness-for-purpose assessment processes
    • Protocols should be more transparent about data sources, bias, limitations and analytical assumptions
    • Multinational RWD studies should prepare for more federated and secure processing models
    • Long-term follow-up and lifecycle evidence will become more important, particularly for rare disease, ATMPs, biotech products and AI-enabled interventions

What Should Sponsors and CROs Do Now?

The immediate priority is not to treat these developments as separate compliance projects.

Organisations should build an integrated European evidence strategy covering:

• • • Data Governance: GDPR, EDPB scientific research guidance, EHDS, transparency, consent / lawful basis, data minimisation, secure processing and cross-border access.
    • Evidence Planning: Regulatory, HTA, pharmacovigilance, market access and post-authorisation evidence needs.
    • Data Quality: Fitness-for-purpose assessment, metadata, completeness, representativeness, provenance and linkage capability.
    • AI Governance: Model purpose, training data, bias, validation, explainability, human oversight and performance monitoring.
    • Lifecycle Monitoring: Long-term safety, real-world effectiveness, utilisation, shortages, access and patient outcomes.
    • Operational Readiness: SOPs, templates, data partner contracts, study registration, data access applications, secure analytics environments and governance boards.

This is not just a legal exercise. It is an operating model change.

Real-World Research Context

For real-world research, the combined effect of the AI Act, EHDS, GDPR, EDPB scientific research guidance, HTA Regulation, Pharma Package and Biotech Act is a major shift from opportunistic use of data toward regulated, transparent and decision-grade evidence generation.

The opportunity is significant. EHDS should improve access to health data. HTA reform should create clearer evidence expectations. The pharmaceutical reform and Biotech Act should increase demand for lifecycle evidence. AI may improve feasibility, phenotyping, signal detection and analytics.

However, the bar for using RWD will continue to rise.

Organisations will need to demonstrate that data are lawful, suitable, representative, secure, interoperable and methodologically fit for purpose. AI-enabled research will need stronger validation and monitoring. HTA-facing evidence will need to address relative effectiveness and patient-relevant outcomes. Regulatory-facing evidence will need stronger protocol discipline, transparency and data-quality justification.

The EDPB draft scientific research Guidelines are particularly important because they clarify the GDPR conditions under which RWR can use personal data for scientific research, including secondary use, broad consent, further processing, safeguards and accountability [2]. This makes them a critical companion to EHDS implementation rather than a separate data-protection issue.

The practical message is that RWE strategy in Europe can no longer sit only within epidemiology, medical affairs or health economics. It needs to be integrated across regulatory, HTA, data privacy, AI governance, clinical development, pharmacovigilance, market access and digital health.

Conclusion

Europe is building a more connected health data and innovation ecosystem.

The AI Act, EHDS, GDPR, EDPB scientific research guidance, HTA Regulation, pharmaceutical reform and proposed Biotech Act do not all regulate the same thing. However, they increasingly intersect around the same strategic objective: enabling health innovation and data use while maintaining trust, safety, transparency and evidence quality.

For real-world research, this is a defining moment.

RWE is becoming more important, but also more regulated. Data access may improve, but governance expectations will increase. AI may create new analytical opportunities, but model accountability will become more important. HTA and regulatory evidence needs will increasingly need to be planned together.

The direction of travel is clear: Future real-world research in Europe will need to be EHDS-ready, GDPR-compliant, EDPB-aware, AI Act-aware, HTA-relevant, regulator-ready and capable of supporting lifecycle evidence generation across the full product pathway.

References

1. European Parliament and Council – Regulation (EU) 2016/679: General Data Protection Regulation (GDPR).
Link: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

2. European Data Protection Board – Guidelines 1/2026 on processing of personal data for scientific research purposes. Adopted on 15 April 2026; adopted version for public consultation.
Link: https://www.edpb.europa.eu/system/files/2026-04/edpb_guidelines_202601_scientificresearch_en.pdf

3. European Parliament and Council – Regulation (EU) 2025/327 on the European Health Data Space.
Link: https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng

4. European Parliament and Council – Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
Link: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

5. European Parliament and Council – Regulation (EU) 2021/2282 on health technology assessment.
Link: https://eur-lex.europa.eu/eli/reg/2021/2282/oj/eng

6. European Commission – Joint Scientific Consultations under the EU HTA Regulation.
Link: https://health.ec.europa.eu/health-technology-assessment/implementation-regulation-health-technology-assessment/joint-scientific-consultations_en

7. European Medicines Agency – Reform of the EU pharmaceutical legislation.
Link: https://www.ema.europa.eu/en/about-us/what-we-do/reform-eu-pharmaceutical-legislation

8. Council of the European Union – The pharma package: new EU rules on medicines.
Link: https://www.consilium.europa.eu/en/policies/pharma-pack/

9. European Commission – Biotechnology: European Biotech Act and supporting documents.
Link: https://health.ec.europa.eu/biotechnology_en

10. European Parliamentary Research Service – European Biotech Act: EU legislation in progress. April 2026.
Link: https://www.europarl.europa.eu/RegData/etudes/BRIE/2026/785708/EPRS_BRI(2026)785708_EN.pdf