Europe's fragile shield: why healthcare resilience is still a work in progress

Europe has some of the most advanced healthcare systems in the world. Yet recent crises, from COVID-19 to cyberattacks and climate-driven disasters, have exposed an uncomfortable truth: our healthcare systems remain fragile.

The good news is that Europe is moving in the right direction. Initiatives such as the Medical Countermeasures Strategy, the EU Preparedness Union Strategy and the action plan on cybersecurity for hospitals and healthcare providers all show growing ambition.

But ambition alone will not translate into resilience.

As discussed at the recent Friends of Europe Health Summit, Europe now needs to connect the dots between policy initiatives, investment priorities and operational readiness. Without coherent alignment, even well-designed policies risk creating fragmentation, uncertainty and delays when systems are under pressure. Three areas of action should be prioritised.

1. Harmonise rules and definitions

Europe’s legislative landscape for healthcare security is dense but fragmented. The NIS2 Directive, the Critical Entities Resilience Directive and the Cross-Border Health Threats Regulation all pursue legitimate goals. But overlapping requirements and inconsistent implementation across member states could create legal uncertainty and increase the compliance burden for hospitals and health technology manufacturers.

In practice, this means that a medical device considered critical in one country may not be treated the same way in another, even when performing an equally important life-saving function.

Addressing these gaps should start with a common baseline: a shared understanding of which devices and systems are critical to keeping healthcare running during a crisis. An EU-wide catalogue of critical medical devices could help clarify the scope of existing frameworks and guide R&D, procurement and stockpiling decisions.

At the same time, EU requirements for cybersecurity of medical devices should be updated to keep pace with rapidly evolving technologies and emerging threats. Cybersecurity also needs to be more systematically embedded into healthcare procurement processes. The upcoming revision of the Public Procurement Directive is an opportunity to strengthen cybersecurity requirements in tendering processes and create stronger incentives for secure-by-design medical technologies. In this context, the Manufacturer Disclosure Statement for Medical Device Security provides the necessary transparency, and its broader adoption across Europe should be encouraged as a standard requirement in procurement processes.

2. Invest in the foundations of resilience

Legislation alone cannot build resilience. Many hospital providers are still operating with outdated and ageing software, and limited cybersecurity capacity. Smaller healthcare providers often lack the resources to upgrade infrastructure or retain specialist expertise. These represent structural vulnerabilities across the European health system.

Investment in preparedness should be treated as a strategic priority. The EU Preparedness Union and Stockpiling Strategies both recognise healthcare as critical infrastructure and highlight the need for civilian healthcare, civil protection and military medical systems to work together during major disruptions, such as hybrid attacks and mass casualty scenarios. Delivering that ambition requires sustained investment. The next EU Multiannual Financial Framework should allocate dedicated funding to healthcare resilience, including upgrades and replacement of outdated software and hardware. This should also include funding towards deployment of cloud services and Software-as-a-Service models and workforce training.

Stockpiling is also a key area where investment and public-private coordination matter. The RescEU medical equipment stockpile, one of the EU’s emergency reserve and disaster response mechanisms managed by Philips on behalf of the Dutch Ministry of Health, shows how readiness depends not only on purchasing equipment, but on lifecycle management, maintenance, training, asset visibility and deployment support.

That lesson should inform the next budget cycle. RescEU financing should be expanded, with governance frameworks that ensure stockpiles are maintained, replenished and ready for immediate deployment across different crisis scenarios.

Longer-term, Europe also needs a stronger research and innovation pipeline for crisis readiness, including telehealth and telemedicine, mobile and remote solutions development, emergency care technologies and digital preparedness and data infrastructure. This will require closer and more structured partnerships between public authorities and industry, ensuring that innovation is aligned with real-world needs, manufacturers can scale solutions rapidly in times of crisis, and expertise from across the healthcare ecosystem is fully leveraged to tailor policies.

3. Crisis response: from policy frameworks to tested preparedness

Europe’s ability to respond to health emergencies depends not only on having the right frameworks, but on whether those frameworks work under pressure.

COVID-19 revealed a gap between demand forecasting and procurement coordination. Manufacturers scaled production based on projected demand, but actual purchasing decisions did not always follow. This mismatch between public planning and industrial capacity needs to be addressed in future joint procurement frameworks through better demand forecasting, pre-tender market consultation and value-based criteria that go beyond price.

Response capacity also needs to be exercised, not assumed.

Europe has strong precedents to build on: Cyber Europe 2022 showed the value of bringing public and private healthcare actors together to simulate coordinated cyber incidents at scale. Europe should expand on this model with EU-wide exercises covering hybrid attacks, large-scale pandemics and cross-border climate disasters. These exercises can clarify roles, expose bottlenecks and build the institutional trust needed for effective crisis response.

The crisis management role of the European Commission, and the proposed European Cybersecurity Support Centre for hospitals and healthcare providers, could play an important role here, but only if both are given genuine operational capacity. This should include coordinating mutual aid, providing access to security advisories, supporting joint exercises, and identifying incident command structures at national and regional level.

Finally, preparedness depends on interoperability. Civilian healthcare, civil protection and military medical services cannot coordinate effectively if their systems cannot exchange information securely. Better digital interoperability would strengthen crisis response while also helping address workforce constraints, for example, by enabling remote clinical support and better use of available expertise across borders.

A shared responsibility

One lesson stands above all others: resilience cannot be delivered by governments alone.

Healthcare providers, industry and policymakers must work together as part of a shared ecosystem. Manufacturers have a responsibility to design secure technologies and support incident responses. Hospitals need the resources and capacity to strengthen their own preparedness. But policymakers must ensure that legislation enables cooperation, rather than adding fragmentation.

The threats facing health systems are becoming more complex, interconnected and frequent. Incremental improvements will not be enough.

Europe has many of the right building blocks. The task now is to align with, fund and test them before the next crisis arrives.

This article is a contribution from a member or partner organisation of Friends of Europe. The views expressed in this #CriticalThinking article reflect those of the author(s) and not of Friends of Europe.