Picture someone in a rural region such as Agder, Extremadura or the north of Sweden, living with two or three chronic conditions. Their health data exists. It is just scattered: a hospital system here, a GP’s records there, a pharmacy, an app the cardiologist asked them to install. None of it flows. They can’t easily see it, and they certainly can’t decide who else gets to. This is the ordinary, unglamorous reality for most Europeans, and it is worst exactly where care is hardest to reach.
That is the problem CRANE set out to solve: a €5M pre-commercial procurement across three rural regions in Sweden, Spain and Norway, five years, 155 people with chronic conditions testing real solutions in real care. PPCN was in it as a knowledge partner. I came out with one conviction.
The thing that’s actually missing
Two solutions came through validation, and they matter because they are concrete and tested. Data for Care puts the citizen in charge of how their data moves between organisations: you decide, request by request, who sees what, and your data is used without being handed over. dHDSI comes at the same goal from the infrastructure side: a standards-based, decentralised way for health data to move, built to fit Europe’s rules rather than fight them. Both routes lead to a layer on the citizen’s side of the table.
And here is what CRANE proved. Giving people rights over their data takes more than law. Rights need an institution to make them real: somewhere the consent lives, the choices are recorded, access is granted and pulled back. Both winning solutions had to build that trust layer themselves before anything else could work, and neither could find anyone to buy it. It is the part of the system no one funds, no one owns, and no one currently procures, and everything else depends on it. CRANE’s bluntest recommendation to the Commission is exactly that: treat the citizen-side governance layer as a public capability worth procuring in its own right.
The governance layer is the trusted place where a person’s “yes” and “no” carry weight.
What it should look like
Picture the citizen-side layer done right. A person holds their own health record, the way they hold a boarding pass or a bank card, and grants access on their own terms, instead of asking permission to see their own life. One place to open, everything in view, and a decision the citizen makes case by case: who gets in, for what, and for how long. None of this is science fiction; it is what the two validated solutions were reaching for. The technology exists. What is missing is someone asked to own it.
It is also where the new EU digital identity wallet stops being a bureaucratic curiosity. Every member state must issue one by the end of 2026. Strip the jargon and it is a simple thing: a place on your phone to hold proof of who you are, and to share exactly one fact without surrendering the rest. That is precisely the shape consent needs. And, most important in rural, cross-border Europe, it can carry that choice across a national border, where today it would simply be lost.
Concretely: a patient in Extremadura agrees their data may train a diabetes-care algorithm but not set their insurance terms. Today that distinction lives, at best, on a form in one hospital’s basement. Held in a wallet, it travels with the patient and stays revocable. That is the distance between a right on paper and a right that works.
Why now, and what to do
The borders are the catch, and CRANE put a number on it the hard way. It ran pilots in three countries and met three different ethics and data-protection regimes: what needed approval in one fell outside the rules of another. So a project built to demonstrate citizen-controlled data sharing concluded that sharing data between three European countries was a complexity best avoided, and kept each country’s data at home.
The flagship demonstration of cross-border health data found cross-border too hard.
Few things make the case for harmonisation more plainly. The European Health Data Space, now moving into implementation, is about to give every European the right to opt out of having their data used for research and AI, and to move their records across borders. The rights are arriving. The question CRANE answers and policy has not is who builds and pays for the layer that makes them real. Europe knows how to fund research. It is learning to fund deployment. The bit in between, the citizen-side trust layer that the person actually touches, falls straight through the gap. Both CRANE solutions fell into it. ROSIA, my other procurement, leaned on the same missing layer to make telerehabilitation prescribable across three health systems.
So the applied reading, the one that matters to a public buyer or a policymaker rather than a lawyer: the law is coming, and the layer the law assumes has no owner and no funding route. Fund it. Procure it. Treat the governance layer as the load-bearing public capability it is, and buy it on purpose.
That is what five years inside these procurements taught me. The systems that get this right will be the ones that paid for the part everyone else assumed was free.