HDS v2: the May 16, 2026 deadline has passed — are your hosting providers still certified?
Since May 16, 2026, HDS certificates issued under the former v1.1 standard are no longer enough: every hosting provider had to migrate to the v2 standard. What every healthcare organization and software vendor must check, now.
It is a deadline that went largely unnoticed outside specialist circles: since May 16, 2026, already-certified health data hosting providers had to have obtained their certification under the new HDS v2 standard, approved by an order of 26 April 2024 published in the Official Journal on 16 May 2024. New entrants had already been assessed against it since November 2024. In practical terms: a certificate issued under the former 2018 v1.1 standard no longer covers your hosting provider.
What the v2 standard changes
The v2 standard aligns with ISO 27001:2022 and strengthens two major requirements: hosting located within the European Economic Area, and greater transparency about access from third countries — a direct echo of the debates on health data sovereignty.
It also clarifies the scope of the six certifiable hosting activities, which forces hosting providers and their customers to re-qualify precisely who does what.
Why this concerns you, even if you are not a hosting provider
The obligation to use a certified hosting provider rests on you, the controller (Article L.1111-8 of the French Public Health Code). If your provider has not migrated, it is your compliance that is exposed — towards the CNIL, your patients and your partners.
Three immediate checks: request the valid v2 certificate (and its exact scope), verify the subcontracting chain (is your software vendor’s own hosting provider covered?), and update your contracts and your record of processing activities with the references of the new certificate.
The reflex to adopt
Build the annual verification of the HDS certificates of your entire provider chain into your control plan — it is one of the systematic checkpoints of our audits and of our healthcare compliance checklist, available for download on this site.
The six certifiable activities: read the scope, not just the logo
HDS certification covers six distinct activities: provision of physical sites (1) and hardware infrastructure (2), provision of virtual infrastructure (3) and of an application hosting platform (4), administration and operation of the information system (5), outsourced backup (6). A certificate is only worth the activities it lists: a provider certified for “3-4” that also administers your servers without “5” coverage leaves you exposed.
The reflex: reconcile line by line the services actually contracted with the exact scope of the v2 certificate — and demand alignment, contractual or operational, at the slightest gap.
Sovereignty: what v2 really says
The v2 standard requires hosting within the European Economic Area and contractual transparency about possible access from third countries — including for providers subject to extraterritorial legislation. This is not an embargo on non-European players, but an obligation of truth: the customer must be able to measure and document its exposure. For a controller, this information must feed into the risk analysis and, where applicable, the data protection impact assessment.
Update — heading for HDS v2.1
In summer 2026 the Agence du Numérique en Santé announced an evolution of the standard: version HDS v2.1, released for public consultation, with publication planned for October 2026 and entry into application three months later, in December 2026 — from which date initial, surveillance and renewal audits will be conducted under v2.1.
On the agenda: stronger transparency on data transfers and possible subjection to the laws of third countries, and reinforced European sovereignty requirements expected by 2027, in line with the future European cloud certification scheme (EUCS). For software vendors and controllers, the message is the same as in May: check your certificates and their scope — and now, anticipate v2.1 in contracts coming up for renewal.