A European Perspective #1 | HUNGARY
Hungary has quietly built one of the most significant centralised healthcare data infrastructures in Central and Eastern Europe. As of 1 January 2026, a new legislative framework allows controlled access to parts of this infrastructure for the development of artificial intelligence systems and digital health technologies. Under the amended Act XLVII of 1997 on the processing and protection of health-related personal data, authorised applicants may obtain access to certain datasets stored in Hungary’s national digital health platform for the training, testing and evaluation of AI algorithms, as well as for the development of medical devices and digital health applications.
The platform connects hospitals, outpatient providers, general practitioners, pharmacies and other healthcare actors through a nationwide digital health system. It aggregates electronic health records generated in the course of patient care, including medical documentation, prescriptions, diagnostic results and treatment data. Public sources indicate that the system already contains billions of healthcare data entries and hundreds of millions of care events, recorded across a very large connected provider base. This scale and centralisation make Hungary unusual even by European standards and particularly relevant for data-driven medical research and AI development.
The importance of the new framework lies not simply in the fact that access is now possible, but in the model chosen by the Hungarian legislator. The law does not permit free extraction or broad downstream reuse of healthcare data. Instead, it creates a controlled access regime. Access may only be granted for specified AI-development purposes, only to anonymised datasets, and only within a secure processing environment inside the national health data infrastructure. Access is limited to specifically authorised individuals and all activities within the environment must be logged and monitored.
The framework is also built around layered governance safeguards. Applicants must obtain approval from the relevant ethics committee of the Hungarian Medical Research Council (ETT) and must carry out a data protection impact assessment (DPIA) before the project begins. In addition, the detailed conditions governing the use of the data and the handling of results must be set out in a contractual arrangement with the operator of the system.
From a European policy perspective, the reform reflects the broader move towards enabling the secondary use of health data for research and innovation while maintaining strong privacy safeguards. In particular, the Hungarian model mirrors important elements of the European Health Data Space (EHDS) Regulation, which entered into force in March 2025 and will be implemented gradually across the EU over the coming years. At the same time, organisations developing AI tools on the basis of healthcare data will also need to consider the requirements of the EU AI Act, especially where the resulting solutions may qualify as high-risk AI in a healthcare or medical device context.
For pharmaceutical, biotech, medtech and digital health companies, Hungary may therefore become an increasingly interesting jurisdiction for data-driven innovation. The key challenge will be whether projects can be structured to operate within the constraints of anonymised datasets, ethics review, DPIA requirements and the contractual and regulatory framework governing access to health data.
This is important for life sciences companies:
The new framework does not create a simple access route to Hungarian healthcare data. It creates a regulated one. Companies planning AI projects in this space should prepare early for the constraints of working with anonymised datasets, ethics approvals, DPIA requirements, contractual arrangements with the system operator and, where relevant, downstream compliance under the EU AI Act and medical device regulation.
