European Health Data Space IT systems development, operations and support

This is a competitive EU public procurement (service contract) to provide development, operations, maintenance, cybersecurity, user support and handover for core European Health Data Space IT systems including HealthData@EU platforms, the Health Data IT Portal, the European database of registered EHR/wellness applications and the European Digital Testing Environment. The contract is estimated at €7,000,000 over an indicative 48 month period and will be awarded following evaluation on quality and price with electronic submission through the EU Funding and Tenders Portal by 25 September 2026. Eligible applicants are economic operators such as IT service providers, system integrators, software firms, cybersecurity specialists or consortia able to meet the technical, administrative and security requirements in the tender documents.

What the tender covers

Scope summary

Services to maintain, evolve and operate existing EHDS IT systems:HealthData@EU central platform and infrastructure, Health Data IT Portal, European database of registered EHR/wellness applications, and the European Digital Testing Environment. Key tasks: project management, requirements and architecture evolution, development and operations, cybersecurity, system support design and handover.

Who can apply:Legal entities able to deliver large-scale IT systems development, operations, cybersecurity and support services (single companies or consortia) responding to the procurement selection and qualification criteria; managed by the contracting authority DG SANTE. ¹

1. 1Tender type: services contract (open procurement via Funding & Tenders Portal).
2. 2Estimated value: €7,000,000 (overall contract amount).
3. 3Planned duration: 48 months.
4. 4Deadline for submission: 25 September 2026, 16:00:59 (Brussels time).

Full procurement documents, technical specifications and application instructions are published on the EU Funding & Tenders Portal and must be followed for submission Tender page. ¹

Footnotes

1. 1See the invitation to tender, technical and administrative specifications, financial offer template and draft contract on the Tender page linked above.

Opportunity snapshot

Call identifier EC-SANTE/2026/OP/0035. Contracting authority:European Commission, DG SANTE (Health and Food Safety). Procedure type: public procurement (service contract) for IT systems development, operations, cybersecurity and support for the European Health Data Space (EHDS). Estimated overall contract value: €7 000 000. Planned duration: 48 months. Main CPV codes: 72000000 (IT services) and 72200000 (software consultancy and development). Submission method: electronic submission through the EU Funding and Tenders Portal. Deadlines: initial timestamp 2026-01-01T14:00:59Z (metadata entry) and formal closing date 25 September 2026, 16:00:59 (Brussels time). Open tender event (information session / opening): 28 September 2026, 10:00 (Brussels time). Additional information request period ends 17 September 2026.

What is being procured

The contract covers continuing development, operations, maintenance, cybersecurity, support and handover activities for the European Health Data Space IT systems. The set of systems included under this procurement are explicitly defined as: HealthData@EU Central Platform and HealthData@EU Infrastructure; Health Data IT Portal; European Database of registered European Health Record systems and wellness applications; and the European Digital Testing Environment. All systems are already developed and deployed to at least an acceptance environment available for stakeholder testing.

Estimated contract value:€7 000 000 (estimated overall contract amount) over an indicative period of 48 months ¹.

Scope of work and tasks (detailed)

The contractor is expected to support the DG SANTE IT teams by delivering on six task groups. Task 1 is a horizontal task (project management). Tasks 2 through 6 are functional technical tasks as specified in the tender technical specifications and draft contract annexes.

1. 1Task 1: Project management — ensure sound project governance, reporting, planning, coordination with DG SANTE and stakeholders, quality assurance and risk management.
2. 2Task 2: Maintain and evolve business requirements, architecture model and technical specifications — ongoing requirements management, architectural design updates and technical documentation.
3. 3Task 3: Systems development and operations — software development (enhancements, bug fixes), deployment, continuous integration/continuous delivery processes, production operations and incident management.
4. 4Task 4: Cybersecurity — implement and maintain security measures, compliance with Appendix 2 Security requirements, vulnerability management, security monitoring and incident response.
5. 5Task 5: Design and provide systems support — service desk, user support, operational runbook, service level management and monitoring.
6. 6Task 6: Ensure proper handover — prepare handover artifacts and execute handover activities to DG SANTE or successor contractors, including knowledge transfer and final documentation.

Who can apply (eligible applicant types)

This is a public procurement addressed to economic operators competent to deliver IT services to the European Commission. Eligible applicant types include: private companies (startups, SMEs, large enterprises), system integrators, IT service providers, software development companies, cybersecurity specialists, consortia or joint ventures of economic operators, research organisations or universities acting as part of a tendering economic operator, and nonprofit legal entities where they meet the procurement selection criteria. Individual natural persons are generally not appropriate as prime contractors for this service contract.

Consortium requirement

The tender documentation contains selection requirements and templates indicating that qualification criteria are applied to the tenderer. The procurement allows economic operators and therefore consortia, joint ventures or subcontracting arrangements, provided the tenderer meets the required selection and exclusion criteria in the administrative specifications. In summary: a single contracting legal entity must submit the tender and may present a consortium/joint venture or subcontracting structure to fulfil the requirements.

Geographic eligibility and benefitting zones

This is an EU public procurement launched by the European Commission. Participation is governed by EU procurement rules and the tender documents; typically economic operators established in EU Member States and potentially EEA countries and other countries covered by the Agreement on Government Procurement are eligible. The contracting authority is DG SANTE (European Commission, Brussels).

Target sectors and technology areas

The activity targets health and digital sectors with a strong ICT and cybersecurity focus. Primary thematic areas include: health data infrastructure, health IT platforms, electronic health records interoperability, digital testing environments, cloud platforms and services, cybersecurity for health systems, software development and operations, DevOps/CI-CD, systems architecture, data governance, and support services.

Project maturity and expected deliverables

Project stage:maintenance, operations, incremental development and production support. The systems are already developed and deployed to at least an acceptance environment; the contractor will work on operation, evolution and stabilization, security/compliance, user support and handover. Deliverables include updated requirements and architecture documents, software releases, operational runbooks, cybersecurity artefacts, support documentation and handover packages.

Funding type and nature of support

Primary financial mechanism:procurement — a service contract awarded by the European Commission in exchange for payment (no grant). Beneficiaries receive monetary payments under the contract for delivered services. The contract may include invoicing and payments based on the financial offer template and payment terms defined in the draft contract.

Application and evaluation process

Application type:open public tender published on the EU Funding and Tenders Portal. Submission is electronic (eSubmission) through the Portal. Key dates include an additional information request period (ends 17 September 2026) and tender submission deadline 25 September 2026, 16:00:59 Brussels time. A public open tender event is scheduled for 28 September 2026 at 10:00. The award criteria are quality (70 weighting) and price (30 weighting) — refer to tender documents for detailed sub-criteria and scoring.

Submission method:Electronic submission required via the EU Funding and Tenders Portal (eSubmission) ¹.

Application stages and selection

The procurement process follows standard public tender procedures. Practically applicants will go through: (1) submission stage (complete administrative, selection and technical documents before deadline), (2) eligibility and selection evaluation (exclusion, selection criteria, capability checks), (3) technical and financial evaluation (award criteria: quality and price), and (4) contract award and signature including any clarifications and standstill period where applicable. Therefore there are typically 3 to 4 sequential stages from submission to award.

Success rates and competition

No published historical success rates are provided in the tender listing. As a public EU service contract with a single award and competitive evaluation, the success rate will depend on the number and quality of bids received; applicants should assume competitive procurement and align proposals carefully to the technical and administrative specifications to maximize chances.

Co-funding and financial requirements

No co-funding from the tenderer is required as a condition of award; the contract remunerates the contractor for deliverables and services. Tenderers must submit a financial offer using the provided Financial offer template (Annex 7). The tenderer must comply with financial and invoicing rules set out in the draft contract and administrative specifications.

Key tender documents and templates provided

1. 1EN-Invitation to tender EC-SANTE2026OP0035 EHDS IT systems developmentoperations (Invitation letter).
2. 2EC-SANTE2026OP0035_Specifications_Part 1 - Administrative specifications (administrative tender specifications).
3. 3EC-SANTE2026OP0035_Specifications_Part 2 Technical specifications (detailed technical requirements documenting Tasks 1–6).
4. 4EC-SANTE2026OP0035_Annex 7-Financial offer template (Excel) — mandatory financial offer form.
5. 5EC-SANTE2026OP0035 - Annex 2- Declaration of honour template (tender exclusion and integrity declaration).
6. 6Annex 6 - Technical tender template (technical offer structure to complete).
7. 7Annexes to the Direct Contract EC-SANTE2026OP0035 (draft contract annex).
8. 8EC-SANTE2026OP0035 contrat-direct-service (draft contract).
9. 9Appendix 2 Security requirements EC-SANTE2026OP0035 (security and cybersecurity requirements).

Structure of application forms and recommended content

Tenderers must provide administrative, selection and technical offers plus a financial offer. The administrative part follows the Administrative specifications (Part 1) and Declaration of honour template. The technical offer must follow the Technical tender template (Annex 6) and address each task (Task 1–Task 6) with proposed approach, staffing, project management, methodology, deliverables, timelines, quality assurance, security measures and evidence of relevant experience. The financial offer must be submitted on the supplied Financial offer template (Annex 7) in the requested currency (EUR) and format. The draft contract and annexes set the contractual terms; bidders must ensure proposed prices, staffing and deliverables match contract obligations and security requirements.

Security and compliance

Security is a core element of the procurement. Appendix 2 Security requirements is provided as a draft contract annex. Bidders must demonstrate compliance with the security requirements in their technical offer and show operational controls, certifications, data protection measures and incident response capabilities. Cybersecurity (Task 4) is a contractual task area and evaluated under quality criteria.

Additional procurement details

Estimated tender validity period after submission is 6 months. The awarding model weights quality at 70 percent and price at 30 percent. The procurement is part of EU-funded activity and includes post-award processes that support electronic ordering and electronic payment.

Mentioned countries and geographic references

Explicit organization:European Commission, DG SANTE (Belgium/Brussels). The tender listing does not restrict applicants to specific Member States in the text but is an EU procurement; therefore geographic eligibility aligns with EU procurement rules and likely includes EU Member States and other countries covered by applicable procurement treaties. No other countries are explicitly named in the scraped content.

Project stage and expected contractor profile

Expected maturity:systems are in acceptance/production-like state; the contractor should be experienced in enterprise-scale health IT systems, cloud infrastructures, interoperability of electronic health records, DevOps, operations and cybersecurity. The contractor should be capable of both systems development (enhancements) and operational service delivery.

Practical next steps for interested bidders

1. 1Register or sign in to the EU Funding & Tenders Portal and access the tender page for EC-SANTE/2026/OP/0035 ¹.
2. 2Download all tender documents listed (administrative and technical specifications, Annexes 2, 6 and 7, draft contract and security appendix).
3. 3Review technical specifications and Appendix 2 security requirements in detail and map compliance gaps.
4. 4Prepare administrative, selection and technical offers following the provided templates; complete Annex 7 financial template.
5. 5Submit the complete eSubmission before the deadline 25 September 2026, 16:00:59 (Brussels time).

Contact and further information:consult the tender listing on the EU Funding & Tenders Portal for the full set of documents, clarifications, Q&A and the precise administrative and contractual requirements; the portal also indicates how to request additional information during the question period up to 17 September 2026. The invitation and tender specifications include formal instructions and forms to use.

Summary: What is this opportunity about and how to approach it

This is a competitive EU public procurement to award a direct service contract to one economic operator (or a consortium acting as a single tenderer) to carry out ongoing maintenance, further development, operations, cybersecurity, support and handover of core components of the European Health Data Space digital ecosystem. The contract is estimated at €7 million for up to 48 months and requires demonstrated expertise in large-scale health IT systems, software engineering, cloud operations, cybersecurity and project management. Bidders must submit administrative, selection/qualification, technical and financial offers following the provided templates. The award will be based on quality (70) and price (30). Interested bidders must register and submit electronically via the EU Funding and Tenders Portal before 25 September 2026 and should carefully study the technical specifications and security appendix to ensure compliance and competitive scoring.

Footnotes

1. 1Tender and all procurement documents are available on the EU Funding & Tenders Portal opportunity page: ec.europa.eu

This is an EU service tender for the development, operation, maintenance, cybersecurity, support and handover of the digital systems that implement the European Health Data Space. The opportunity covers HealthData@EU and related platforms, and it sits within the legal and technical framework created by the EHDS Regulation, which establishes common rules, standards, infrastructures and governance for the primary and secondary use of electronic health data.[13][15][16]

What the tender covers

According to the opportunity metadata, the systems already exist at least up to acceptance environment and are publicly available for stakeholder testing. The contractor is expected to support DG SANTE IT teams responsible for each project by maintaining and evolving the business requirements, architecture model and technical specifications, delivering systems development and operations, handling cybersecurity, providing systems support, and ensuring a proper handover. A closely related HealthData@EU tender used a very similar task structure, including project management, requirements and architecture preparation, development, deployment and maintenance, test support and handover.[11]

• HealthData@EU Central Platform and HealthData@EU Infrastructure
• Health Data IT Portal
• European Database of registered European Health Record systems and wellness applications
• European Digital Testing Environment

Main work packages

1. 1Project management as the horizontal coordination task
2. 2Maintenance and evolution of business requirements, architecture and technical specifications
3. 3Development, operations and maintenance of the systems
4. 4Cybersecurity activities across the solution landscape
5. 5Design and provision of support services for users and stakeholders
6. 6Proper handover at the end of the assignment

Who can apply

This is a procurement tender, so the relevant applicants are economic operators, typically IT service providers, software firms, system integrators, cybersecurity specialists or consortia with the capacity to deliver large scale public sector digital services. The related HealthData@EU tender was issued as an open procedure, which indicates a competitive procurement process rather than a restricted grant scheme.[11]

Policy and programme context

HealthData@EU is the cross-border infrastructure for secondary use under the EHDS Regulation, and the European Commission has described it as a federated EU wide dataset catalogue supported by a common application form for multi-country applications.[16] The Regulation entered into force in March 2025, with further implementing acts expected by March 2027 and phased application milestones in 2029 and 2031.[15]

The official notice and procurement documents should be checked on Funding and Tenders Portal.