Commission Implementing Regulation (EU) 2025/1467 of 18 July 2025 laying down rules for the application of Regulation (EU) 2024/1938 of the European Parliament and of the Council as regards the technical specifications for the EU SoHO Platform to exchange information concerning substances of human origin intended for human application

For the purpose of this Regulation, the following definitions shall apply: (1) ‘actor’ means a natural person who registers a SoHO entity on the EU SoHO Platform after authentication; (2) ‘authorised actor’ means a natural person who, after authentication, has been granted access to the EU SoHO Platform to perform actions in accordance with the access rights assigned to the person’s profile and who acts on behalf of a Member State, a SoHO national authority, a SoHO competent authority, the SoHO Coordination Board, a SoHO entity, the Commission, the European Centre for Disease Prevention and Control (ECDC) or the European Directorate for the Quality of Medicines & HealthCare (EDQM); (3) ‘local administrator’ means an authorised actor who has the right to grant access to the EU SoHO Platform to other actors or authorised actors within the same Member State, SoHO national authority, SoHO competent authority or SoHO entity.

1 The Commission shall maintain and optimise the EU SoHO Platform to carry out the tasks referred to in Article 73 of Regulation (EU) 2024/1938.

2 Actors and authorised actors shall use the platform to comply with the requirements laid down in Articles 4(2), 5(5), 9(4), 16, 17(2), (5) to (7), 19(1), (3) and (10), 21(4) and (5), 25(1), (2) and (6), 27(7), 31 to 35, 37(2), 41(2) and (4), 54(3), 56(4), 63(3) point (e), 64(3), 65(3), 68(3) and (4), 69(1), 71 to 74, 76, 81, 82 and 86 of Regulation (EU) 2024/1938.

1 The EU SoHO Platform shall be accessible via a dedicated website.

2 The EU SoHO Platform shall provide at least the modules and functionalities listed in Annex I.

1 The access of actors to the EU SoHO Platform shall be controlled via an authentication tool. The access of authorised actors to the EU SoHO Platform shall be controlled via an authentication tool and an authorisation tool. The authentication tool and the authorisation tool shall ensure that actors and authorised actors have the appropriate access rights for the EU SoHO Platform and the proper permissions to perform actions on the EU SoHO Platform. Following authentication, actors shall have access to the registration module of the EU SoHO Platform for the registration of a SoHO entity.

2 The Commission shall be responsible for granting, suspending or revoking the access rights of local administrators for the EU SoHO Platform.

3 Local administrators shall manage the access rights of actors and authorised actors for the EU SoHO Platform by granting, suspending or revoking those access rights.

4 Member States shall define the appropriate level of access of authorised actors acting on their behalf for the EU SoHO Platform in accordance with national law.

1 The general public shall be able to view on the EU SoHO Platform the publicly available information referred to in Article 71(5), point (d), Article 74(3) and, without prejudice to national legislation and if the Member State so decides, information referred to in Article 75(5) of Regulation (EU) 2024/1938.

2 No registration, authentication or authorisation shall be required to access the publicly available information referred to in paragraph 1.

3 The general public shall be able to perform searches on the publicly available information referred to in paragraph 1.

1 Actors and authorised actors shall ensure that the information entered by them into the EU SoHO Platform is complete and accurate, and respects the format and specifications defined by the SoHO Coordination Board.

2 SoHO competent authorities shall be responsible for recording and verifying the accuracy of the information on authorised SoHO establishments and SoHO preparations. SoHO competent authorities shall also be responsible for keeping this information up to date, and consistent with their national registry of SoHO entities when such registry is established outside the EU SoHO Platform.

3 The Commission shall safeguard the safety and security of all data stored on the EU SoHO Platform using security protocols and connectivity rules from non-proprietary open standards established by international standards bodies or organisations.

Data shall be deemed to have been submitted to the EU SoHO Platform at the date when the data is successfully registered on the EU SoHO Platform.

1 Personal data, including data concerning health, pseudonymised when necessary, shall be processed through the EU SoHO Platform for the purpose of complying with the obligations set out in Article 76(1) to (5) of Regulation (EU) 2024/1938.

2 The categories of personal data to be processed, and their retention periods, are listed in Annex II. The Commission shall be responsible for deleting all personal data collected on the EU SoHO Platform when the retention period has expired.

3 The local administrator shall be responsible for the management of the personal data of the authorised actors under its responsibility. The local administrator shall, at any time after the upload of the personal data of authorised actors to the EU SoHO Platform, rectify or erase personal data which is inaccurate or no longer up to date.

The Commission shall put in place measures to safeguard the safety and security of personal data, including data concerning health, processed through the EU SoHO Platform. Such measures shall include prevention of unauthorised access, reading, copying, modification or deletion of personal data, and shall ensure that authorised actors have access only to data covered by their access authorisation and that it is possible to verify and establish what data has been created, modified or deleted, by which authorised actor and at what time.

1 The Commission shall set up a support team to provide timely assistance to actors and authorised actors of the EU SoHO Platform, reachable via a dedicated functional mailbox.

2 The Commission shall make specific manuals available on the EU SoHO Platform to actors and authorised actors.

1 The Commission, in collaboration with the SoHO national authorities, shall develop detailed contingency arrangements to be applied in cases of prolonged failure or unavailability of the EU SoHO Platform or any of its modules or functionalities for reasons outside the Commission’s control.

2 The detailed contingency arrangements shall describe the procedures to be followed to ensure continuity of the regulatory processes supported by the EU SoHO Platform using appropriate alternative electronic means.

1 Where the Commission suspects that an information technology (IT) security incident, IT security risk or IT security threat occurred, which it considers as potentially harmful for the EU SoHO Platform, its data or the confidentiality of its data, the Commission may suspend all access to the EU SoHO Platform and inform the SoHO national authorities.

2 An actor or authorised actor who becomes aware of or suspects an IT security incident, IT security risk or IT security threat, shall immediately inform the Commission and the SoHO national authority thereof.

1 The user interface of the EU SoHO Platform shall be provided in English.

2 Member States, SoHO competent authorities, SoHO Coordination Board, the Commission and SoHO entities shall use English, as the commonly understood language in the field of SoHO, for all information, data and documents exchanged through the EU SoHO Platform, when appropriate.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 7 August 2027.