From Preparedness to Operational Readiness: Assessing the EU/EEA Health Security Architecture for Hybrid, Compound and Cascading Crises

1. Introduction

The COVID-19 pandemic exposed persistent vulnerabilities in health-system surge capacity, supply chains, surveillance, cross-border coordination and continuity of essential services, while simultaneously accelerating institutional reform in European health governance. In the years that followed, the European Union (EU) moved beyond the emergency arrangements developed during the pandemic toward a more permanent health-security architecture. Regulation (EU) 2022/2371 strengthened the framework for prevention, preparedness and response to serious cross-border threats to health, including preparedness planning, epidemiological surveillance, early warning, risk assessment and coordinated response [1]. The establishment and subsequent development of the Health Emergency Preparedness and Response Authority (HERA) added dedicated capabilities for health-threat intelligence, medical-countermeasure development, manufacturing, procurement and deployment [2]. These reforms have progressively embedded health emergencies within a broader European framework of resilience and crisis management rather than treating them solely as episodic public-health events.

This evolution has continued as the European risk environment has broadened. The European Preparedness Union Strategy, adopted in March 2025, explicitly frames preparedness through integrated all-hazards, whole-of-government and whole-of-society approaches and links crisis readiness to health emergencies, critical infrastructure, cybersecurity, information manipulation, civil protection and civil–military cooperation [3]. The 2025 Medical Countermeasures Strategy similarly extends health preparedness across an end-to-end chain encompassing threat assessment, research and development, scalable manufacturing, stockpiling, procurement and rapid deployment [4]. At the same time, EU policy increasingly recognises that crises may originate from natural, technological or deliberately induced threats and may affect several sectors simultaneously. Hybrid threats, in EU terminology, involve coordinated harmful activities undertaken with malign intent through multiple and potentially combined instruments, including cyberattacks, information manipulation, economic coercion and other disruptive means [5].

These developments represent a substantial change in the institutional architecture of European health security. Previous analysis characterised the post-COVID trajectory as a shift from predominantly reactive crisis management toward transformative resilience, reflected in stronger supranational coordination, digital governance, medical-countermeasure structures and closer integration between health and security policy [6]. That perspective is useful for understanding institutional and regulatory transformation, but it leaves a different question unresolved. The existence of legislation, strategies, institutions and allocated resources does not necessarily demonstrate that the associated capabilities can be activated, coordinated, scaled and sustained when an emergency actually occurs. Structural preparedness and operational performance are related, but they are not equivalent.

This distinction is captured by the emerging concept of operational readiness. English et al. describe operational readiness as occupying the space between longer-term preparedness and emergency response, involving the immediate capabilities and actions required to respond rapidly to an imminent or emerging public-health threat [7]. Their review also demonstrated that operational readiness remains less consistently conceptualised than either preparedness or response and that readiness-related activities are often embedded within broader preparedness frameworks rather than identified explicitly [7]. The World Health Organization (WHO) similarly places operational readiness at the interface between established capacities and effective response. Its Health Emergency Preparedness, Response and Resilience (HEPR) architecture identifies five interconnected systems, collaborative surveillance, community protection, safe and scalable care, access to countermeasures and emergency coordination, whose functioning depends on underlying capacity and operational readiness [8]. More recent WHO guidance has continued this emphasis on translating preparedness structures into coordinated multi-hazard response functions rather than maintaining preparedness as a predominantly planning-oriented activity [9].

The distinction becomes particularly important when health systems are confronted with hybrid, compound or cascading crises. These concepts describe different forms of complexity and should not be treated as interchangeable. A hybrid campaign is defined principally by deliberate intent and the coordinated use of multiple instruments [10]. By contrast, compound crises arise when hazards or pressures interact, while cascading disruption occurs when failure in one system propagates into other dependent systems [11]. A severe infectious-disease outbreak accompanied by energy disruption, workforce shortages and supply-chain failure may therefore become compound or cascading without constituting a hybrid campaign [10,12,13]. Conversely, coordinated cyberattacks, information manipulation and deliberate disruption of health infrastructure may constitute a hybrid threat even if the initial direct health impact is limited [14]. This distinction is increasingly relevant because modern healthcare depends on tightly coupled digital, energy, transport, manufacturing, laboratory and logistics systems. The EU Preparedness Union Strategy itself reflects this broader understanding of crisis interaction by linking preparedness across sectors and by emphasising comprehensive risk assessment, critical societal functions and regular exercises [3].

Despite this expansion of European preparedness policy, the evidence required to determine whether formal arrangements translate into operational capability remains fragmented. Strategies and legislation can establish mandates; programmes can create mechanisms and resources; exercises can test selected components; and actual emergencies can provide evidence of deployment. These represent different forms of evidence and should not be treated as equivalent indicators of readiness. The distinction is particularly important when assessing newer capabilities related to cyber resilience, civil–military coordination, information integrity or deliberate threats, for which public documentation of real-world activation may be inherently more limited. Conversely, established mechanisms such as medical evacuation, deployable public-health expertise or medical-countermeasure procurement may generate observable operational evidence without demonstrating the readiness of the entire system in which they operate.

The introduction of the European Centre for Disease Prevention and Control (ECDC) Public Health Emergency Preparedness Assessments (PHEPAs) provides an important additional evidence layer. Conducted under the framework established by Regulation (EU) 2022/2371, PHEPAs examine implementation of national prevention, preparedness and response capacities rather than only the formal existence of plans [1]. The first assessment cycle began in 2024, and the 2026 interim synthesis of the first 15 assessments identified both recurrent strengths and common implementation challenges across surveillance, laboratories, health-emergency management and related preparedness capacities [15]. ECDC explicitly cautions that these findings are not a comprehensive comparative assessment of EU/EEA preparedness, but they provide an opportunity to examine the interface between European-level architecture and national-level implementation.

Complementing this top-down perspective, a local lessons-learned study of civil–military pandemic response in Heidelberg/Rhine-Neckar identified practical preparedness themes including local alignment, community networks and relationships, clear leadership roles and responsibilities, timely transition into disaster mode, personnel reserves, frequent all-hands exercises and functioning as a learning organisation [16]. Although derived from a single regional case, these findings illustrate how operational readiness is also shaped by local relationships, role clarity and learning processes that may not be fully visible in supranational policy architecture.

Taken together, the current policy landscape creates a need to move the analytical focus from whether preparedness structures exist toward what evidence demonstrates that they can function under crisis conditions. Existing literature has conceptualised operational readiness and international organisations have developed increasingly detailed preparedness frameworks, but there has been limited systematic examination of operationalisation across the contemporary EU/European Economic Area (EU/EEA) health-security architecture as a whole. In particular, it remains unclear how consistently formal commitments are supported by established mechanisms, demonstrable activation or scaling capability, completed exercises or documented real-world use, and whether current arrangements have been developed and tested for interacting hybrid, compound and cascading disruptions rather than predominantly conventional or single-hazard emergencies.

Accordingly, this study examines to what extent the emerging EU/EEA health preparedness architecture is supported by documented operational capabilities to respond to hybrid, compound and cascading health crises. It addresses three questions: (1) Which operational health-readiness capabilities are embedded in the current EU/EEA preparedness architecture? (2) What evidence exists beyond formal policy commitments for established mechanisms, operational functionality, exercise-based validation or real-world use? and (3) To what extent do existing arrangements address deliberate, hybrid, compound and cascading disruptions rather than isolated single-hazard emergencies? Rather than generating a composite readiness score or ranking national systems, the study distinguishes different forms of evidence of operationalisation and examines where preparedness architecture is supported by operational functionality, scalability, validation and adaptive learning. In doing so, it seeks to provide a framework for analysing the transition from preparedness as institutional capacity to readiness as demonstrable capability under crisis conditions.

2. Methods

2.1. Study Design and Analytical Scope

This study used a structured qualitative policy analysis combined with a capability-based Framework Method to examine the extent to which the emerging European Union/European Economic Area (EU/EEA) health preparedness architecture is supported by documented operational capabilities for hybrid, compound and cascading health crises. Document analysis was selected because the study sought to examine the relationship between formal policy architecture, implementation mechanisms, and documented evidence of operationalisation rather than to estimate intervention effects or clinical outcomes [17,18].

Operational readiness was conceptualised as the intermediate state between longer-term preparedness and emergency response in which existing plans, resources, structures, and capacities can be rapidly activated, mobilised, scaled, and deployed in response to an emerging or imminent threat. This conceptualisation was informed by the rapid scoping review of operational readiness by English et al. and by the WHO HEPR architecture [7,8]. WHO identifies five interconnected health-emergency systems, collaborative surveillance, community protection, safe and scalable care, access to countermeasures, and emergency coordination, whose effectiveness depends on operational readiness and underlying capacities. The 2026 WHO Framework for Health Emergency Preparedness and Response Capabilities for National Public Health Agencies was additionally used to refine the analytical domains and distinguish technical capabilities from cross-cutting enabling functions [19].

The primary analytical period was 1 January 2024 to 17 September 2026. Earlier documents were retained only when they constituted an essential legal or conceptual foundation for the contemporary architecture, including Regulation (EU) 2022/2371 on serious cross-border threats to health and relevant WHO preparedness frameworks. Regulation (EU) 2022/2371 was treated as a foundational legal instrument because it establishes Union-level arrangements for preparedness planning, surveillance, early warning, risk assessment, crisis communication, medical countermeasures, and continuity of healthcare services, and provides the legal basis for periodic ECDC assessment of national prevention, preparedness and response planning [1].

2.2. Documentary Corpus and Source Hierarchy

Documents were identified from publicly available sources maintained by EU institutions, bodies, agencies and repositories, including the European Commission, particularly the Directorate-General for Health and Food Safety and HERA; ECDC; the European Medicines Agency; the Directorate-General for European Civil Protection and Humanitarian Aid Operations and the Union Civil Protection Mechanism; the European Union Agency for Cybersecurity (ENISA); the European External Action Service; the Council of the European Union; and EUR-Lex.

Eligible sources included legislation, Commission communications, strategies, preparedness and response plans, technical guidance, implementation reports, country assessments, operational reports, exercise reports, after-action material, deployment reports, and other official documents containing substantive evidence relevant to one or more predefined readiness capabilities.

Particular attention was given to ECDC PHEPAs. Under Article 8 of Regulation (EU) 2022/2371 and the associated ECDC assessment process, PHEPAs are conducted across EU/EEA countries on a three-year cycle to assess implementation of national prevention, preparedness and response planning. PHEPA reports were therefore treated as the principal national-level implementation evidence rather than simply as additional policy documents [1,20].

WHO documents were used as external conceptual and technical benchmarks rather than as evidence of EU/EEA implementation. NATO documents were used selectively as external benchmarks for civil–military preparedness, disruptive health crises, continuity of essential services, and hybrid-threat resilience. In particular, the 2026 NATO Baseline Requirements for Resilience were used to cross-check the coverage of health-system continuity, civilian–military information exchange, healthcare capacity inventories, medical stockpiling, and exercise-based validation, but NATO itself was not an analytical unit in the study [21]. The 2026 requirements explicitly include resilience to mass casualties and disruptive health crises, civil–military information exchange, healthcare-capacity inventories, medical stockpiling and exercises.

A complete inventory of the primary analytic sources, supporting/contextual sources, and foundational or benchmark documents, including their provenance and analytical role, is provided in Supplementary Material 1.

2.3. Search Strategy and Document Identification

Documents were identified through structured searches of institutional websites and repositories, supplemented by targeted domain-restricted web searches. Search concepts covered operational readiness, health emergency preparedness, health security, surge capacity, continuity of essential health services, medical countermeasures, strategic stockpiling, emergency coordination, civil–military health preparedness, hybrid threats, deliberate events, cybersecurity, critical infrastructure, compound crises, cascading disruption, exercises, deployment, and emergency logistics.

The core concepts were combined iteratively according to the mandate, structure, and terminology of each institution rather than applying a single identical search string across all repositories. Examples included combinations of “operational readiness”, “health emergency preparedness”, “surge capacity”, “medical countermeasures”, stockpil*, “civil-military”, “hybrid threat*”, cyber*, “continuity of essential health services”, exercise*, and deployment with terms related to health, hospitals, public health, the European Union, and the EEA.

Details of the institutional sources searched, search concepts and combinations, search period, and document-identification procedures are provided in Supplementary Material 2.

2.4. Eligibility Criteria

Documents were eligible for the primary analysis when they concerned the EU/EEA or one or more EU/EEA countries; addressed at least one predefined operational-readiness domain; and contained substantive information on a policy commitment, established mechanism or resource, activation procedure, mobilisation or deployment capability, completed exercise, real-world activation, implementation status, operational dependency, or explicitly documented operational gap.

Documents published between 1 January 2024 and 17 September 2026 were eligible for inclusion in the primary analytical corpus. The start date was selected to coincide with the launch of the first ECDC Public Health Emergency Preparedness Assessment cycle (2024–2026), marking the beginning of systematic implementation-focused assessment within the reformed EU health-security architecture [15,20].

Earlier documents were retained only when they were necessary to establish the legal or conceptual basis of the contemporary preparedness architecture and were classified separately as foundational or benchmark sources rather than as primary analytic evidence.

Duplicates, superseded versions where a final version was available, documents unrelated to health emergency readiness, purely routine health-system material, and commentary without substantive evidence were excluded. Speeches, promotional material, and press releases were not normally treated as primary evidence when an underlying legal, strategic, technical, implementation, or operational document was available. Official event or deployment notices were retained when they constituted the authoritative public record of a completed exercise or real-world activation.

2.5. Development of the Operational Readiness Framework

An a priori analytical framework was developed by cross-mapping the WHO HEPR architecture, the 2026 WHO Framework for Health Emergency Preparedness and Response Capabilities for National Public Health Agencies, ECDC PHEPA capacities, the EU Preparedness Union Strategy, and external health-security and resilience benchmarks [3,8,19,20,21]. WHO’s 2026 framework distinguishes three foundational capabilities, legal authority, evidence generation and use for policy, and secure and flexible financing, from technical capabilities covering coordination, emergency management, workforce, surveillance and intelligence, laboratory systems, risk communication and community engagement, public health and social measures, clinical care, and countermeasure research and deployment [19].

The resulting framework comprised eight operational domains presented in Table 1.

Legal authority, flexible emergency financing, and evidence-to-policy mechanisms were coded as cross-cutting enablers rather than separate operational domains.

Detailed operational definitions, indicator-level coding rules, evidence-of-operationalisation criteria, threat-context classifications, gap coding, and ambiguity-resolution rules are provided in Supplementary Material 3.

The EU Preparedness Union Strategy provided an additional policy-level cross-check because it explicitly adopts an integrated all-hazards, whole-of-government, and whole-of-society approach and includes foresight, crisis coordination, stockpiling, public–private arrangements, civil–military cooperation, exercises, and protection against information manipulation

2.6. Evidence-of-Operationalisation Coding

For every eligible document–capability observation, evidence was coded using five non-mutually exclusive categories:

• P (Policy) indicated a formal strategy, plan, legal requirement, or explicit policy commitment.
• M (Mechanism) indicated that a named structure, resource, procedure, stockpile, workforce arrangement, coordination mechanism, or other implementation instrument had been established.
• (Operational) required explicit evidence that the capability could be activated, mobilised, deployed, redistributed, or scaled in an emergency. Describing a mechanism as “operational” without information demonstrating activation or deployment functionality was not sufficient on its own.
• E (Exercised) required evidence that the relevant capability had been tested in a completed simulation, tabletop, functional, full-scale, or comparable exercise.
• R (Real-world use) required evidence of activation or deployment during an actual emergency, crisis, incident, or operational response.

The categories were non-mutually exclusive and could be assigned in combination when supported by the same document–capability observation. They were not treated as an ordinal scale or as a mandatory sequential progression, and they were not converted into a numerical readiness score. For example, an observation could contain evidence corresponding to P+M+O+E+R, but the absence of one category did not preclude assignment of another.

The codebook additionally defined NR (not publicly reported) as an evidence-status category for circumstances in which adequate public evidence concerning a relevant capability status could not be established. NR was not interpreted as evidence that the capability itself was absent or non-functional. Detailed assignment and exclusion rules for each evidence category are provided in Supplementary Material 3.

2.7. Hybrid, Compound and Cascading Threat Classification

Threat characteristics were coded independently along two dimensions.

The first captured intent: natural/accidental, deliberate, hybrid campaign, or unclear. Hybrid threats were defined in accordance with EU terminology as coordinated harmful activities undertaken with malign intent through multiple, often combined instruments, which may include cyberattacks, information manipulation, economic coercion, covert action, or other means [10].

The second captured interaction structure: single hazard, multi-hazard, compound crisis, or cascading disruption [11,12,13]. This separation prevented the term hybrid from being used as a synonym for any complex emergency. Interaction categories were assigned only on the basis of explicit documentary description rather than coder inference. A multi-hazard context was coded where a source addressed more than one hazard type without describing interaction between them. A compound crisis required an explicit description of two or more concurrent hazards interacting to affect the same capability, population or service within the same period. A cascading disruption required an explicit description of a primary event triggering secondary failures in dependent systems, such as energy, transport, digital infrastructure or supply chains, that in turn affected health-system functioning. Where a source described several hazards in parallel or referred to complex emergencies in general terms, the observation was coded as multi-hazard.

Artificial intelligence was coded as a cross-cutting modifier rather than an independent readiness domain using four categories: none, capability-enabling, threat-amplifying, or both. This allowed AI-supported surveillance, forecasting, logistics, or decision support to be distinguished from AI-enabled cyber or information threats.

Detailed threat-context definitions and coding rules are provided in Supplementary Material 3.

2.8. Data Extraction and Analytical Variables

The primary unit of analysis was the document–capability observation rather than the document itself. A single source could therefore contribute evidence to multiple domains and indicators.

For each observation, the extraction matrix recorded the document identifier, institution or source, publication date, geographic level, exact page, section or other source location, supporting evidence, readiness domain and indicator, evidence-of-operationalisation code(s), threat intent, hazard-interaction type, governance level, cross-border scalability, civil–military component, AI role, cross-cutting enabler(s), critical dependencies, gap status, and documented gap or corrective recommendation.

Dependencies were coded inductively when they materially enabled or constrained operational readiness and included factors such as workforce availability, digital infrastructure and telecommunications, energy and utilities, transport and logistics, laboratory capacity, manufacturing and procurement, supply chains, financing, and inter-organisational or cross-sector interoperability.

Implementation limitations were distinguished from missing public information. A documented gap was coded only where the source explicitly identified a shortcoming, limitation, insufficient capacity, implementation problem, bottleneck, or corrective need. No gap reported indicated only that the source did not identify a limitation and was not interpreted as evidence that no limitation existed. Where an issue was outside the scope of the source or adequate public evidence was unavailable, it was classified separately as not assessed/evidence gap rather than as a documented capability deficit.

Detailed definitions of the extraction variables and coding rules are provided in Supplementary Material 3. The complete document–capability extraction and coding matrix is provided in Supplementary Material 4.

2.9. Screening and Coding Procedure

Document identification, eligibility screening, extraction, and primary coding were undertaken using the predefined codebook. Before full extraction, the framework was pilot-tested against a purposive set of heterogeneous documents representing EU-level strategy, national preparedness assessment, medical countermeasures, cyber preparedness, exercises, and operational deployment. The pilot was used to clarify domain boundaries, distinguish mechanisms from operational capabilities, separate exercise evidence from real-world use, and finalise the hybrid/compound classification before the codebook was frozen.

Ambiguous classifications and higher-level thematic interpretations were discussed and resolved during framework refinement; independent duplicate screening or coding was not performed. An audit trail linking every analytical observation to the underlying source passage and document location was maintained throughout the analysis.

The final coding framework and ambiguity-resolution rules are provided in Supplementary Material 3, while the complete extraction matrix linking each document–capability observation to its source location and coded variables is provided in Supplementary Material 4.

2.10. Framework Analysis and Synthesis

Data were analysed using a deductive–inductive Framework Method [18]. In the deductive phase, observations were charted against the eight predefined operational-readiness domains and the P/M/O/E/R evidence categories. Framework matrices were then constructed to compare capability × operationalisation evidence × threat context × governance level × cross-border scalability × dependency × gap status. The observation-level data underlying these analyses are provided in Supplementary Material 4.

The inductive phase identified recurrent bottlenecks, enabling conditions, cross-sector dependencies, implementation problems, and vulnerabilities not fully captured by the initial framework. Particular attention was given to differences between formal preparedness architecture and evidence of activation, scalability, exercise-based validation, real-world use, and subsequent learning or adaptation.

Analysis was performed at two interconnected levels. The first examined EU-level architecture and capabilities, including coordination, medical countermeasures, stockpiling, civil protection, cyber preparedness, and deployable mechanisms. The second examined national implementation evidence, principally through ECDC PHEPA documentation.

PHEPA findings were not used to construct country rankings. Because the depth of assessment was not identical across all capacities and countries, absence of a capability from a country report was not interpreted as national absence of that capability. Cross-country synthesis was restricted to recurrent patterns explicitly supported by comparable assessment material. ECDC itself cautions that the first-cycle interim synthesis of 15 assessments does not constitute a comprehensive overview of all prevention, preparedness and response capacities across the EU/EEA [15].

No aggregate readiness score was calculated. The analysis instead distinguished areas where operationalisation was supported by policy, mechanism, operational, exercise, or real-world evidence and areas where official sources documented implementation limitations or where adequate public evidence of operationalisation was not identified. Descriptive counts of sources and document–capability observations were used to characterise the distribution of evidence across domains and analytical categories and were not interpreted as comparative measures of readiness or performance.

As a sensitivity analysis, observations were stratified into PHEPA-derived and non-PHEPA evidence streams, and the distribution of documented gaps across readiness domains and the six recurrent gap mechanisms was compared descriptively. No statistical testing was performed.

2.11. Methodological Rigour

Methodological rigour was supported through the use of a predefined and externally anchored capability framework, explicit eligibility criteria, a frozen codebook, pilot coding, systematic recording of document provenance, recording of supporting evidence and precise source locations, maintenance of an audit trail, and explicit separation of documented capability gaps from limitations in publicly available evidence.

Evidence was interpreted according to source provenance and evidentiary function. Binding legislation and primary institutional documents were used to establish formal mandates and policy architecture; implementation and operational reports were preferred for claims about operationalisation; completed exercise documentation was required for assignment of E codes; and documented real-world activation or deployment was required for R codes. Peer-reviewed literature was used selectively for conceptual triangulation and interpretation and was not used to override primary institutional evidence concerning the existence or operational status of EU/EEA mechanisms or capabilities.

Coding decisions were constrained by predefined assignment and exclusion rules. Ambiguous cases were resolved conservatively, with higher levels of operationalisation assigned only where the documentary evidence met the relevant codebook threshold. Absence of publicly available evidence was not interpreted as evidence of capability absence or failure.

2.12. Ethics

The study analysed publicly available policy, legal, technical, and operational documents and did not involve human participants, identifiable personal information, or individual-level health data. Formal ethics review and informed consent were therefore not required.

3. Results

3.1. Characteristics of the Documentary Corpus

The final primary analytical corpus comprised 33 sources falling within the predefined study period from 1 January 2024 to 17 September 2026. Twenty sources represented EU-level policy, implementation, operational, exercise, or deployment evidence, while 13 provided ECDC preparedness-assessment evidence, comprising 12 publicly available country-level PHEPA reports and the interim synthesis of the first 15 assessments [15]. By documentary year, one source was dated 2024, 17 were dated 2025, and 15 were dated 2026. The composition and temporal distribution of the final documentary corpus are summarised in Table 2. A complete inventory of the included sources and their analytical roles is provided in Supplementary Material 1.

The corpus deliberately combined evidence on formal preparedness architecture with documentation of implementation and operationalisation. EU-level sources included strategic and regulatory initiatives, health-crisis planning instruments, HERA work programmes, medical-countermeasure and stockpiling mechanisms, cybersecurity initiatives, deployable workforce arrangements, civil-protection capacities, and completed simulation exercises. Country-level implementation evidence was derived primarily from PHEPA assessments conducted pursuant to Article 8 of Regulation (EU) 2022/2371, under which ECDC assesses Member States’ implementation of national prevention, preparedness and response plans on a three-year cycle [1,20].

The interim PHEPA synthesis was retained as a separate cross-country source because it aggregates findings from the first 15 assessments and therefore captures assessment evidence beyond the set of individual country reports included in the analytical corpus. ECDC explicitly notes that this interim synthesis presents selected recurrent or illustrative findings rather than a comprehensive overview of preparedness and response planning across the EU/EEA [15].

Application of the predefined codebook generated 185 document–capability observations across the eight operational-readiness domains. The complete observation-level extraction and coding matrix is provided in Supplementary Material 4. Three additional institutional or methodological sources were retained for contextual or methodological triangulation but were not included in the coded primary corpus, while seven earlier or external sources were retained solely as foundational or benchmark documents. Consistent with the study design, WHO and NATO documents informed framework construction but were not treated as evidence of EU/EEA operational readiness.

3.2. Overall Pattern of Operationalisation

At source level, evidence was concentrated in formal policy commitments and established mechanisms, while fewer sources documented exercise-based validation or real-world use. Of the 33 primary sources, 29 contained policy-level evidence (P), 27 documented established mechanisms or resources (M), 20 contained explicit evidence of operational functionality (O), nine documented completed exercise-based validation (E), and eight documented real-world activation or deployment (R). Across the 185 document–capability observations, the corresponding counts were 118 P, 129 M, 76 O, 14 E, and 16 R. The full observation-level basis for these counts is provided in Supplementary Material 4.

These categories were non-mutually exclusive and were not interpreted as an ordinal readiness scale or mandatory sequential progression. The distribution nevertheless shows that documentary evidence was substantially more extensive for policy commitments and established mechanisms than for exercise-based validation or real-world use. At the same time, several capabilities were supported by explicit operational or real-world evidence, including laboratory surge capacity identified through PHEPA assessments [15], deployment of the EU Health Task Force [22], and rescEU medical and CBRN reserves and cross-border medical-evacuation capacity [23]. ECDC reports that the EU Health Task Force had implemented 33 assignments during its first 1,000 days, including field deployments, while the Commission reports operational rescEU medical evacuation and strategic medical/CBRN reserves, including deployment in response to the war in Ukraine.

Documented implementation gaps were identified in 74 of the 185 coded observations and occurred in 18 of the 33 primary sources. Gaps were represented across all eight operational-readiness domains. Their frequency was treated descriptively and was not interpreted as a comparative measure of domain readiness or performance because the volume, scope, and depth of publicly available evidence differed substantially between domains. The distribution of evidence-of-operationalisation categories and documented gaps across the eight readiness domains is summarised in Figure 1.

3.3. Threat Intelligence, Surveillance and Diagnostics

Threat intelligence, surveillance and diagnostic readiness was supported by a broad policy and institutional architecture, but evidence of integration and scalability remained uneven. Thirty-eight document–capability observations from 19 primary sources were mapped to this domain. Policy-level evidence was identified in 21 observations, established mechanisms in 28, and explicit operational functionality in 24. Two observations documented real-world use, while 15 contained explicitly documented implementation or capacity gaps. No observation in this domain met the predefined threshold for exercise-based evidence (E). The complete observation-level coding basis is provided in Supplementary Material 4.

Surveillance capability increasingly reflected a multi-source and cross-sector model. At EU level, the emerging architecture combined epidemic intelligence, wastewater and environmental surveillance, genomic and laboratory capacity, and structured health-threat prioritisation. HERA’s 2026 Work Plan continued development of the ATHINA threat-intelligence system, support for the Epidemic Intelligence from Open Sources (EIOS) system, wastewater surveillance, and the GLOWACON aviation-surveillance programme [24]. ECDC preparedness assessments likewise treated surveillance and laboratory capacity as core preparedness functions [15].

Operational evidence was particularly prominent for laboratory and diagnostic surge. EU-level mechanisms included the DURABLE laboratory network and additional initiatives intended to strengthen diagnostic, sequencing, and reference-laboratory capacity [24]. National preparedness assessments also documented capacities retained or expanded following COVID-19, while identifying recurrent limitations related to the formalisation of surge arrangements, specialised or high-containment laboratory access, trained personnel, specimen-referral pathways, information-system interoperability, and sustainability of expanded capacity [15,25]. The first-cycle PHEPA synthesis similarly identified laboratory and surveillance capacities as areas in which recurrent strengths and implementation challenges were observed across assessed countries [15].

A second recurrent limitation concerned data integration and interoperability. Country assessments documented fragmented surveillance systems, incomplete automation, inconsistent laboratory-to-surveillance data flows, and limited interoperability between information platforms. Cyprus illustrates this pattern. The CIPHIS platform enables participating primary-care clinicians to report electronically, access near-real-time dashboards, and link epidemiological and laboratory data for sentinel surveillance; however, substantial reporting remained manual, automatic extraction from electronic health records was incomplete, and laboratory surveillance remained distributed across multiple information systems [25].

Risk assessment and foresight mechanisms were also represented across the corpus, although their degree of institutionalisation varied. The PHEPA interim analysis documented differences in national preparedness contexts and implementation capacity [15], while EU-level threat prioritisation was more formally structured for medical-countermeasure planning. HERA’s Comprehensive 2025 Health Threat Prioritisation Assessment identified four major categories: respiratory or contact-based viruses with pandemic potential; vector-borne or animal-reservoir viruses with epidemic potential; antimicrobial resistance; and armed-conflict-related and chemical, biological, radiological and nuclear threats [26].

Taken together, the dominant documented limitations in this domain concerned incomplete interoperability, variable formalisation of surge arrangements, and uneven evidence that existing surveillance, laboratory, and risk-assessment mechanisms could function as integrated and scalable operational systems.

3.4. Governance, Activation and Emergency Coordination

Governance, activation and emergency coordination was the most extensively represented operational-readiness domain, comprising 47 document–capability observations across 23 primary sources. Policy-level evidence was identified in 35 observations, established mechanisms in 38, and explicit operational functionality in 19. Five observations documented completed exercise-based validation, while no observation met the predefined criteria for real-world-use coding at the governance level. Eighteen observations contained explicitly documented governance or implementation gaps. The complete observation-level coding basis is provided in Supplementary Material 4.

At EU level, the corpus documented an increasingly interconnected crisis-governance architecture linking health-security mechanisms with wider crisis-management, civil-protection and cross-sector coordination arrangements. The 2025 Union prevention, preparedness and response plan for health crises, for example, describes joint capacities and resources that may be mobilised or activated during a Union-level health emergency and explicitly links health response with cross-sectoral and civil-protection mechanisms [27]. At national level, the PHEPA process assessed implementation of emergency-management, coordination and preparedness arrangements rather than solely the formal existence of plans, thereby providing an implementation-focused evidence layer for this domain [15,20].

The most recurrent national-level limitation concerned the translation of strategic preparedness into implementable operational arrangements. Documented problems included insufficiently detailed standard operating procedures, unclear activation or escalation thresholds, incomplete alignment between strategic and operational plans, continuing reliance on informal coordination relationships, and emergency-operations or incident-management structures that were still under development.

Cyprus provides a clear illustration. The ZENON framework comprised 22 national emergency-management plans and defined four activation levels, but ECDC concluded that escalation triggers required clearer definition. In parallel, the planned Public Health Emergency Operations Centre (PHEOC) and Incident Management System (IMS) had not yet been fully established at the time of assessment [25].

Cross-border and cross-sector coordination was widely represented in the corpus, although the degree of documented operationalisation varied. Bilateral agreements, EU mechanisms and multisectoral structures provided formal channels for coordinated action, whereas several national assessments identified continued reliance on informal relationships, incomplete standardisation of information exchange, or insufficiently formalised roles and responsibilities. These limitations were particularly evident at interfaces linking public health with civil protection, border authorities, law enforcement and security actors.

Civil–military and deliberate-threat coordination was less extensively documented than general emergency coordination, but completed exercises provided evidence of selected capabilities. Operation Vector, conducted jointly by ECDC and Europol on 11–12 November 2025, involved more than 100 operational and technical professionals and tested multi-country public-health and law-enforcement coordination in a scenario involving the intentional release of a genetically engineered pathogen. The exercise addressed early-warning mechanisms, cross-sectoral information exchange, communication and operational decision-making under time pressure [28].

However, such exercise evidence remained selective rather than system-wide. Across the wider corpus, the documented formalisation and validation of civil–military and cross-sector health coordination varied, and several newer EU initiatives had not yet progressed to completed exercise-based validation by the search closure date. HERA’s 2026 Work Plan, for example, announced two simulation exercises for 2026: one focusing on intentional CBRN threats within a multisectoral approach including civil–military cooperation, and another testing the updated pandemic-procurement framework [24]. Because these exercises were prospective in the source document, they were not coded as E evidence.

Taken together, this domain was characterised by a dense formal and institutional architecture, alongside a narrower documentary evidence base for clearly specified activation procedures, repeated exercise-based validation, and sustained operational coordination across sectors and jurisdictions.

3.5. Workforce and Surge Mobilisation

Workforce and surge mobilisation was less extensively represented in the documentary corpus than surveillance or governance, comprising 12 document–capability observations from 10 primary sources. Four observations contained policy-level evidence, seven documented established workforce mechanisms, six demonstrated operational mobilisation functionality, and four provided evidence of real-world activation or deployment. No observation met the predefined threshold for exercise-based evidence (E), while six identified workforce-related limitations. The complete observation-level coding basis is provided in Supplementary Material 4.

The strongest operational evidence concerned deployable public-health personnel. The EU Health Task Force (EUHTF) functioned as an established supranational mobilisation mechanism providing preparedness and outbreak-response support on request. According to the EUHTF 2025 Bulletin, 14 requests were accepted during 2025, with assignments in 12 EU/EEA locations and two outside the EU/EEA; six experts were deployed [29]. The same source described the ECDC staff and fellowship pools as operational, while the external expert pool remained only partially operational and was being developed incrementally [29]. These findings document established mobilisation capacity while also identifying limitations in workforce scalability.

Country-level evidence showed a similar coexistence of mobilisation capacity and workforce constraints. National assessments documented mechanisms for deploying or redistributing personnel during emergencies, while recurrent limitations included small specialist teams, incomplete workforce mapping, limited reserve capacity, and the difficulty of maintaining routine functions while simultaneously supporting emergency response. Cyprus illustrates this pattern. ECDC reported that the Ministry of Health had demonstrated the ability during COVID-19 to coordinate and mobilise human resources at national and intermediate levels, while also identifying several preparedness functions dependent on very small teams and recommending the creation of trained reserve pools [25].

Workforce continuity represented a distinct challenge from short-term mobilisation. Although deployment or redistribution could be demonstrated in several observations, the documentary evidence for maintaining adequate specialist staffing during prolonged, concurrent or geographically distributed disruptions was more limited. Training and competency-development mechanisms were nevertheless present. The EUHTF documented outbreak-response and analytical training activities [29], while HERA’s 2026 programme continued EU-level training, e-learning and staff-exchange activities intended to strengthen preparedness and response competencies [24].

Taken together, the dominant documented workforce limitation concerned the sustainability and scalability of specialist human resources over time, rather than the absence of mobilisation mechanisms themselves.

3.6. Scalable Care and Continuity of Essential Health Services

Scalable care and continuity of essential health services showed a high concentration of operational evidence relative to the volume of documentation available. Twelve document–capability observations from seven primary sources were assigned to this domain; six contained policy-level evidence, 10 documented established mechanisms, nine demonstrated operational functionality, and four documented real-world use. No observation met the predefined threshold for exercise-based evidence (E), while only one contained an explicitly documented capability gap. The relatively small evidence base, however, limits broader inference. The complete observation-level coding basis is provided in Supplementary Material 4.

The clearest real-world evidence concerned patient redistribution and medical evacuation. Cross-border transfer mechanisms were documented at both EU and national levels, including arrangements linked to the Union Civil Protection Mechanism and rescEU medical-evacuation capacity [23,27]. By April 2026, the European Commission had facilitated the transfer of more than 5,000 patients from Ukraine to hospitals in 22 European countries under the Union Civil Protection Mechanism, providing direct evidence of large-scale mobilisation of medical transport, receiving-hospital capacity, logistics and cross-border coordination [30].

National evidence also documented operational use of cross-border arrangements. Cyprus maintained agreements with Greece, Israel and Italy for mutual assistance and patient transfer, which ECDC reported had been used in recent evacuation and humanitarian operations. Cyprus also participated in rescEU and had both received and provided assistance through the mechanism [25]. Its health system had additionally monitored and managed public and private hospital capacity during COVID-19. ECDC nevertheless identified incomplete Ministry-level visibility of private-sector bed and workforce capacity as a limitation for whole-system surge situational awareness [25].

Evidence for continuity of essential services was more heterogeneous. At EU level, the Commission’s 2026 critical-infrastructure guidance addressed prevention of disruption to essential services and resilience against natural, man-made, cross-sectoral and cross-border risks, including public-health emergencies and hybrid threats [31]. At national level, sector-specific continuity mechanisms were identifiable; for example, the Cyprus assessment reported operational continuity plans across reference laboratories intended to maintain critical functions and support rapid restoration following disruption [25].

Within the coded D4 observations, however, no capability met the predefined threshold for exercise-based validation. The documentary evidence was therefore stronger for operational patient redistribution, medical evacuation and selected surge or continuity mechanisms than for completed exercises explicitly testing continuity of essential health services under simultaneous or cascading disruption.

Taken together, this domain revealed a distinction between documented capacity to redistribute patients or mobilise medical transport and the more limited evidence concerning sustained continuity of the broader spectrum of essential health services during prolonged compound or cascading disruption.

3.7. Medical Countermeasures, Stockpiles and Supply Chains

Medical-countermeasure, stockpiling and supply-chain readiness was supported by substantial documentary evidence of established and operational mechanisms, although important limitations remained in demand visibility and scalable manufacturing. Thirty-two document–capability observations from 15 primary sources were mapped to this domain. Policy-level evidence was identified in 26 observations, established mechanisms in 21, and explicit operational functionality in 15. No observation met the predefined threshold for exercise-based evidence (E), while three documented real-world use and 11 contained explicitly documented implementation or capacity gaps. The complete observation-level coding basis is provided in Supplementary Material 4.

The distribution of evidence varied across the four indicators. Strategic reserves were represented by five observations from five sources, while inventory and needs visibility accounted for eight observations from seven sources. Procurement and manufacturing surge was the most frequently represented component, with 11 observations from eight sources, followed by logistics and deployment with eight observations from seven sources. Two documented gaps concerned strategic reserves, four inventory and needs visibility, and five procurement and manufacturing surge; no explicit gap was coded for logistics and deployment in the available evidence.

At EU level, the medical-countermeasure architecture increasingly addressed the full preparedness-to-deployment cycle. The 2025 Medical Countermeasures Strategy linked surveillance and intelligence, research and development, scalable manufacturing, procurement, stockpiling and rapid deployment within an end-to-end approach. It also set out flexible and scalable manufacturing arrangements, including RAMP-UP, together with reserved production capacity, improved stockpiling practices and crisis-procurement arrangements [4].

Strategic stockpiling showed explicit operational and real-world evidence. The rescEU reserve included strategic medical and CBRN stockpiles across participating Member States; at the search closure date, the Commission reported that 17 of 22 stockpiles under development were fully operational [23]. The 2025 EU Stockpiling Strategy further broadened the approach by addressing the full stockpiling cycle, including anticipation, supply-chain monitoring, identification of gaps and duplications, stock management, transport and deployment [32].

Real-world evidence also documented the use of selected EU-level procurement and deployment mechanisms. During the 2022 mpox outbreak, the Commission secured more than 109,000 vaccine doses in June 2022, which were distributed to Member States and associated countries within a month. In 2023–2024, subsequent joint procurement secured access to up to two million doses, allowing participating countries to build stocks and plan vaccination strategies in advance [27]. These observations were coded as real-world evidence only for the specific procurement and deployment capabilities involved and were not interpreted as evidence of readiness across the medical-countermeasure system as a whole.

National assessments documented a different recurrent pattern. Physical strategic stockpiles were widely present, while mechanisms for determining stock composition and volumes, monitoring supply and demand, linking risk scenarios to demand estimates, and planning manufacturing scale-up were less consistently developed [15]. In the first 15 PHEPA assessments, for example, supply-and-demand monitoring was frequently fragmented or crisis-activated, scenario-based demand forecasting was limited, and systematic mapping of manufacturing capacity was incomplete.

Cyprus illustrates these limitations. A national strategic MCM stockpile and multidisciplinary stockpile-management arrangements were in place, but the methodology for defining and quantifying stockpile requirements had not been fully formalised. ECDC also found no specific national policy or plan for monitoring supply and estimating demand for critical MCMs. Domestic production was limited and the country remained highly dependent on external suppliers, increasing vulnerability to transport and supply-chain disruption [25].

Taken together, the dominant documented limitation was not the absence of medical reserves but the integration of those reserves into an end-to-end capability able to anticipate requirements, maintain visibility of inventories and supply constraints, scale production, replenish stocks and deploy countermeasures rapidly under changing or simultaneous crisis conditions. EU-level policy increasingly addressed these functions, while national implementation evidence remained heterogeneous.

3.8. Community Protection and Information Integrity

Community protection and information integrity was the least extensively documented of the eight operational-readiness domains. Only five document–capability observations from five primary sources were mapped to this domain. Three contained policy-level evidence and one documented an established mechanism; no observation met the predefined criteria for operational functionality (O), completed exercise-based validation (E), or real-world use (R). Three observations contained explicitly documented gaps. The complete observation-level coding basis is provided in Supplementary Material 4.

The evidence was unevenly distributed across the four predefined indicators. Information integrity accounted for three observations, while risk communication and population protection were represented by one observation each. No observation was independently coded to the community-engagement indicator. This should not be interpreted as evidence that community-engagement capability was absent across the EU/EEA; under the study’s coding rules, it indicates that the primary corpus did not provide sufficiently explicit and distinct evidence to support separate coding of this capability. As specified in the codebook, absence of public evidence was not treated as evidence of capability absence.

At EU policy level, information integrity was increasingly incorporated into preparedness planning. The Preparedness Union Strategy included strategic communication, public awareness measures and tools for countering information manipulation within its whole-of-society preparedness approach [3]. HERA’s 2026 Work Plan similarly included measures intended to strengthen knowledge and skills for addressing health-related misinformation and disinformation, including professional networks and communication activities [24].

National implementation evidence, however, indicated that risk-communication, community-engagement and infodemic-management arrangements were not uniformly institutionalised. Spain’s PHEPA assessment identified the need for a more formalised and structured approach to risk communication, community engagement and infodemic management (RCCE-IM), including strategies, standard operating procedures, scalable emergency mechanisms and dedicated trained staff [33].

Cyprus showed a related but distinct pattern. Public-health communication campaigns and links with professional associations and community representatives were documented, but rapid communication could be constrained by approval procedures and a formal RCCE approach remained under development [25]. The assessment therefore recommended strengthening arrangements for rapid emergency communication and community engagement.

Evidence concerning population-protection measures was similarly limited in the coded corpus. The first-cycle PHEPA synthesis documented that, in several assessed countries, decision-making, implementation and evaluation of public-health and social measures remained ad hoc and did not consistently involve all relevant stakeholders [15]. Accordingly, the available evidence was stronger for policy expectations concerning population protection than for documented operational, exercised or real-world implementation.

Taken together, this domain differed from the more extensively documented operational domains. The principal finding was not evidence of absent or failed community-protection capability, but a markedly thinner public documentary evidence base linking risk communication, community engagement, information integrity and population-protection arrangements to operational, exercised or real-world performance. This documentary asymmetry limited the extent to which societal and communication capabilities could be assessed using the same evidence thresholds applied to more observable mechanisms such as stockpiles, laboratories, deployments and crisis-coordination structures.

3.9. Digital, Cyber Resilience and Interoperability

Digital, cyber and interoperability readiness was represented by 14 document–capability observations from 12 primary sources. Policy-level evidence was identified in nine observations, established mechanisms in eight, and explicit operational functionality in two. No observation met the predefined criteria for completed exercise-based validation (E) or real-world use (R) within this domain. Nine observations contained explicitly documented implementation or capability gaps. The complete observation-level coding basis is provided in Supplementary Material 4.

The evidence was strongly concentrated in data interoperability. Ten observations were mapped to this indicator, nine of which contained an explicitly documented gap. Across national assessments, digital surveillance and laboratory-information systems were present, but fragmentation between platforms, incomplete automation, inconsistent data-sharing arrangements and limited interoperability remained recurrent constraints.

National assessments illustrated different manifestations of this problem. Luxembourg’s PHEPA identified limited interoperability between databases and digital systems as a potential constraint during major health crises [34]. Belgium was continuing development of the be.Prepared platform for automated integration of laboratory, epidemiological and genomic data, with ECDC recommending further development and finalisation [35]. In Cyprus, routine laboratory and epidemiological reporting remained fragmented across systems despite digital capabilities developed during COVID-19, while emerging One Health surveillance platforms had not yet achieved fully integrated cross-sector data exchange [25]. Cyprus therefore combined established digital capabilities with persistent integration barriers rather than representing an absence of digital infrastructure.

The emerging Epi+ architecture provided a further example of digital capability still under development. ECDC describes Epi+ as a multi-hazard, open-source, event-based surveillance platform designed to support national signal detection, risk assessment, response coordination and documentation before and alongside EU-level information exchange [36]. ECDC also reported that most Member States did not yet have a dedicated national digital tool for these functions. Testing of the common ECDC platform was scheduled to begin in September 2026, while the first national systems were planned to go live in June 2027, beyond the analytical period of the present study [36]. Accordingly, the D7 observation was not coded as demonstrated operational functionality.

Cybersecurity showed a different evidence pattern. The 2025 European Action Plan on the Cybersecurity of Hospitals and Healthcare Providers established a dedicated sectoral framework centred on prevention, threat detection, preparedness, response and recovery and proposed tailored guidance, tools, services and training, including a pan-European cybersecurity support function [37]. By 2026, implementation had progressed beyond policy formulation in selected areas. ENISA had signed a three-year contribution agreement with the Commission, issued updated healthcare cybersecurity procurement guidance and begun developing a service catalogue for the proposed European Cybersecurity Support Centre [38]. These implementation activities supported mechanism-level and, for selected components, operational coding; however, the corpus contained no completed health-sector cyber exercise or real-world deployment evidence meeting the study’s E or R criteria.

Artificial intelligence appeared primarily as a cross-cutting modifier rather than as a separately demonstrated health-readiness capability. The Commission’s 2026 Action Plan on Cybersecurity and Artificial Intelligence explicitly described AI as dual-use: advanced AI can support vulnerability detection, cyberattack prevention and critical-infrastructure protection, while malicious actors can use it to automate attacks, identify weaknesses and increase the speed and scale of cyber operations [39]. Within the present corpus, this constituted primarily policy-level evidence concerning an enabling technology and an evolving threat amplifier rather than operational validation of AI-enabled health-crisis capabilities.

No independent observation was coded to digital or communication continuity. Under the predefined coding rules, this should not be interpreted as evidence that redundant communications or continuity mechanisms were absent. Rather, the primary corpus did not provide sufficiently explicit and distinct evidence to code such arrangements separately from broader infrastructure, cyber-response or interoperability mechanisms.

Taken together, the digital domain showed a pronounced documentary asymmetry. EU/EEA health-security architecture increasingly incorporated digital surveillance, interoperability and cyber-resilience mechanisms, but evidence of operational functionality remained substantially thinner than evidence of policy commitments and established mechanisms. The predominant documented constraint concerned the integration of heterogeneous systems, automation of information flows and maintenance of interoperable situational awareness across organisations and sectors during crises.

3.10. Exercises, Learning, Recovery and Adaptation

Exercises, learning, recovery and adaptation constituted one of the domains in which preparedness arrangements could be assessed against directly observable validation and learning activity. Twenty-five document–capability observations from 17 primary sources were mapped to this domain. Policy-level evidence was identified in 14 observations, established mechanisms in 16, explicit operational functionality in one, completed exercise evidence in nine, and real-world evidence in three. Eleven observations contained explicitly documented gaps. The complete observation-level coding basis is provided in Supplementary Material 4.

Exercise activity was the component most extensively supported by completed validation evidence. The PHEPA interim synthesis indicated that approximately half of the first 15 assessed countries regularly conducted simulation exercises, although the frequency, scope and institutionalisation of national exercise programmes varied [15]. Country-level assessments documented regular or repeated exercises in several settings, while EU Health Task Force support contributed additional simulation activity during 2026.

Completed exercises also demonstrated the ability to test coordination beyond single-agency health response. In Belgium, an Ebola-based simulation conducted in March 2026 examined cross-sector coordination, surveillance, laboratory diagnostics, crisis management, risk communication and transport-related interfaces during a viral-haemorrhagic-fever scenario [40]. In Malta, a January 2026 chikungunya simulation involved public health, hospital and primary care, laboratories, civil protection, environmental health and veterinary services, explicitly testing multisectoral coordination, communication and joint decision-making [41].

The evidence for deliberate and hybrid-threat testing was narrower. Operation Vector in November 2025 provided completed exercise evidence for a deliberate biological scenario, bringing together public-health, law-enforcement and other actors in a multi-country setting to test coordination and decision-making during an intentional biological incident [28]. Several other deliberate-threat or CBRN exercise commitments remained prospective within the study period. HERA’s 2026 Work Plan, for example, included planned simulation exercises addressing intentional CBRN threats and civil–military cooperation; because these were not documented as completed in the source used for coding, they were classified as policy evidence rather than E evidence [24].

A marked difference emerged between conducting exercises and institutionalising learning from them. After-action learning accounted for only four observations, three of which contained documented gaps. The PHEPA interim evidence identified inconsistent use of structured after-action reviews following real events [15], while national assessments showed that lessons from exercises or emergencies were not always systematically captured, prioritised or translated into formal corrective-action processes. Lithuania, for example, reported frequent participation in multi-stakeholder exercises but was advised to develop a more strategic cross-sector exercise programme and a systematic process for integrating lessons into national emergency planning [42].

ECDC’s 2026 guidance reinforces this distinction by treating the action review as part of a broader cycle extending from preparation and review through follow-up. The guidance specifies that identified findings and proposed corrective actions should be consolidated into a final report and translated into an action plan for implementation [43].

Cyprus illustrates the gap between exercise participation and institutionalised learning particularly clearly. Hospitals, emergency medical services and first responders conducted regular exercises, while the Medical and Public Health Services participated in an avian-influenza simulation and the WHO Regional Office for Europe JADE exercise. However, MPHS had not completed a formal structured AAR, and no systematic national process existed for capturing lessons from exercises or reviews and monitoring subsequent corrective actions [25].

Real-world learning was nevertheless identifiable in selected observations. In Cyprus, internal reflection following COVID-19 led to changes in surveillance arrangements despite the absence of a formal AAR process [25]. Lithuania similarly documented technical and structural changes resulting from previous events and exercises, including virtual meetings, digitalised procedures and tiered activation of emergency operation centres [42]. At EU level, the EU Health Task Force supported countries not only through simulation exercises but also in translating preparedness assessments into plans and follow-up actions, including support for Luxembourg’s post-PHEPA action plan [29].

More recent ECDC activity provided direct examples of structured learning following real events. In March 2026, ECDC and the EU Health Task Force completed an after-action review with Latvian authorities following the 2025 leptospirosis outbreak [44]. In April 2026, the EUHTF also supported an after-action review in Slovakia following the 2025 multi-country hepatitis A outbreak, involving participants from Slovakia, Austria and Czechia [45]. These examples demonstrate operational use of formal review mechanisms, although such practices were not uniformly documented across the national assessments analysed.

Taken together, the documentary evidence was more extensive for conducting and validating exercises than for systematic learning and corrective-action closure. The key documented limitation was therefore not simply whether preparedness arrangements were exercised, but whether findings from exercises and real events were consistently translated into assigned, monitored and completed changes in plans, procedures and capabilities.

3.11. Readiness for Hybrid, Deliberate, Compound and Cascading Crises

Threat-context coding showed that the corpus was dominated by natural or accidental and multi-hazard preparedness rather than by explicitly hybrid, compound or cascading crisis models. Of the 185 document–capability observations, 150 were coded as natural or accidental in intent, 23 as deliberate, three as explicitly related to a hybrid campaign, and nine as unclear. Deliberate-threat evidence was distributed across 15 primary sources, whereas explicit hybrid-campaign evidence was identified in only three. The complete observation-level coding basis is provided in Supplementary Material 4.

The interaction dimension showed an even stronger concentration. Multi-hazard contexts accounted for 138 observations across 28 sources, compared with 45 single-hazard observations across 21 sources. Only two observations, both derived from a single source, met the predefined criteria for cascading disruption, and no observation met the threshold for classification as an explicitly documented compound crisis. These counts describe the framing of the documentary evidence and should not be interpreted as estimates of the frequency of such crises or as evidence that underlying capabilities were absent.

The corpus was therefore predominantly framed through all-hazards and multi-hazard approaches, while explicit operational treatment of interacting crisis dynamics was considerably less visible. The EU Preparedness Union Strategy adopts an integrated all-hazards approach and connects preparedness with health crises, cybersecurity, information manipulation, critical infrastructure, civil protection and civil–military cooperation [3]. However, an all-hazards framework does not itself demonstrate that capabilities have been operationally tested under conditions in which multiple disruptions interact, amplify one another or generate cascading failures.

Documentary evidence was more extensive for deliberate biological and CBRN threats than for coordinated hybrid campaigns. Operation Vector provided completed exercise evidence for an intentional biological incident and tested multi-country coordination among public-health, law-enforcement and other actors [28]. HERA’s 2026 Work Plan likewise included a planned simulation exercise focused on intentional CBRN threats within a multisectoral approach incorporating civil–military cooperation [24]. Because the exercise was prospective in the source document used for coding, it did not meet the predefined threshold for E evidence.

Hybrid-threat evidence was narrower and appeared mainly at the interface between health preparedness and broader security and resilience policy rather than as a distinct health operational-readiness architecture. This distinction is consistent with EU terminology, in which hybrid threats refer to coordinated harmful activities undertaken with malign intent through multiple, often combined, means [5]. Cyberattacks, information manipulation, critical-infrastructure disruption and deliberate biological threats were recognised across contemporary EU preparedness frameworks, but relatively few sources documented how such instruments would be combined operationally within a coordinated hybrid campaign. The Preparedness Union Strategy links preparedness with cyber risks, information manipulation and civil–military arrangements [3], while the Commission’s 2026 critical-infrastructure guidance explicitly addresses cross-sectoral and cross-border risks, public-health emergencies and hybrid threats [31].

Artificial intelligence showed a similar pattern. It appeared as both a potential capability enabler and a threat amplifier, particularly in cybersecurity. The 2026 EU Action Plan on Cybersecurity and Artificial Intelligence states that AI can support vulnerability detection, cyberattack prevention and protection of critical infrastructure, while malicious actors may use it to automate attacks and increase their speed and scale [39]. Within the health-readiness corpus, however, AI-related evidence remained predominantly policy-oriented and did not demonstrate exercised or real-world AI-enabled health-crisis capability.

The limited evidence for compound and cascading scenarios was particularly notable. Under the predefined taxonomy, hybrid campaign, compound crisis and cascading disruption were treated as analytically distinct concepts rather than interchangeable forms of complexity. No observation met the explicit threshold for a compound-crisis classification, while only two were coded as cascading disruption. This does not demonstrate that EU/EEA systems are unable to manage such events. Rather, it indicates that the publicly available evidence analysed in this study was much more frequently structured around multiple hazards than around the operational consequences of interacting hazards, dependencies and cascading system failures.

Taken together, the corpus documented European preparedness extending beyond naturally occurring infectious-disease emergencies to encompass deliberate biological threats, CBRN events, cyber disruption, information manipulation and civil–military contingencies. Explicit exercise-based or real-world validation of coordinated hybrid campaigns, compound crises and cascading health-system disruptions, however, remained sparsely documented relative to their strategic recognition in contemporary EU preparedness policy.

3.12. Cross-Cutting Enablers, Dependencies and Scalability

Across the eight readiness domains, operational capability depended on cross-cutting conditions that were not treated as stand-alone health capabilities within the analytical framework. Legal authority and mandate, flexible emergency financing and resource mobilisation, and evidence-to-policy or decision support were coded as cross-cutting enablers. Workforce, logistics, transport, manufacturing, supply chains, laboratory capacity, digital infrastructure, civil protection and inter-organisational coordination recurred as operational dependencies across multiple domains. The complete observation-level coding of these enablers and dependencies is provided in Supplementary Material 4.

Legal authority and mandate were most visible in relation to activation, coordination and the formalisation of responsibilities. Several national assessments described functional arrangements that depended partly on established practice, voluntary arrangements or informal networks rather than fully specified statutory or procedural mechanisms. Cyprus, for example, continued to operate under an older infectious-disease legal framework while legislative reform was underway, and ECDC identified incomplete formalisation of cross-ministerial communication, escalation procedures and continuous public-health coordination functions [25]. The evidence therefore distinguished between the practical existence of coordination mechanisms and the legal or procedural formalisation required to make responsibilities, authority and activation arrangements explicit during emergencies.

Flexible emergency financing represented a second enabling condition. Where documented, financing arrangements could support rapid mobilisation. In Cyprus, state-budget reserves and supplementary-budget mechanisms could be activated for urgent needs, and ECDC reported that resources had been released within 24–48 hours during COVID-19 and the 2025 wildfires [25]. At the same time, Cyprus had no dedicated budget line for IHR implementation or preparedness activities, no real-time mechanism for monitoring IHR expenditure, and no systematic testing of contingency financing for public-health emergencies [25]. This illustrates the distinction between the ability to release funds during an emergency and the availability of predictable financing for maintaining workforce, laboratory, digital and stockpiling capabilities between crises.

Evidence-to-decision support was represented across surveillance, risk assessment, medical-countermeasure prioritisation and situational-awareness mechanisms. Risk assessments, epidemic intelligence, laboratory information, supply monitoring and crisis-information systems linked preparedness information with operational decision processes. However, national assessments repeatedly documented fragmented datasets, incomplete automation and limited visibility across organisational or public–private boundaries. The existence of information-generating mechanisms therefore did not necessarily imply fully integrated or timely decision support across the system.

Dependency coding further showed that operational capabilities were rarely self-contained. Laboratory surge depended on specialist personnel, reagents, digital systems and specimen transport; medical-countermeasure capability depended on manufacturing, procurement, logistics and cross-border movement; clinical surge depended on workforce availability, transport and visibility of receiving capacity; and digital capability depended on communications infrastructure, cybersecurity and institutional interoperability. Contemporary EU critical-infrastructure policy reflects similar interdependencies: the Commission’s 2026 guidance addresses cross-sectoral and cross-border risks, public-health emergencies, hybrid threats, disruption of essential services, and mitigation and recovery from disruptive incidents [31].

Cross-border scalability provided a further distinction between the existence of a capability and evidence that it could be used beyond its immediate institutional or national setting. Explicit cross-border scalability was documented in 35 of 185 observations across 16 of the 33 primary sources. In the remaining 150 observations, cross-border scalability was not publicly documented. Under the study’s coding rules, this was not interpreted as evidence that scaling was impossible; rather, national or institutional functionality was not assumed to imply cross-border deployability in the absence of explicit evidence. These classifications are reported in Supplementary Material 4.

Governance coding showed a similarly layered architecture. Of the 185 observations, 101 were coded at national governance level, 43 as shared arrangements and 41 at EU level. National systems therefore remained central to operational delivery, while selected functions, including medical-countermeasure procurement and stockpiling, deployable workforce mechanisms, medical evacuation and crisis coordination, were supported through shared or EU-level arrangements [23,27,29].

The cross-cutting analysis consequently indicated that documented operational readiness depended not only on the existence of individual health capabilities but also on whether the dependencies required for their activation and sustained use were available. The operational value of a capability could therefore vary according to workforce availability, transport access, digital and communications continuity, laboratory capacity, supply-chain resilience, legal authority and the ability to mobilise resources across organisational or national boundaries.

Taken together, scalability and interdependence emerged as central analytical properties of operational readiness rather than secondary characteristics of preparedness. Formally established capabilities whose operation depended on poorly documented, untested or fragile external systems could not be assumed to retain equivalent functionality during prolonged, cross-sectoral or cascading disruption.

3.13. Preparedness–Readiness Gaps

Documented preparedness–readiness gaps were identified in 74 of the 185 document–capability observations, originating from 18 of the 33 primary sources. Gaps were present across all eight readiness domains but were unevenly distributed: governance, activation and coordination accounted for 18 gap observations; threat intelligence, surveillance and diagnostics for 15; medical countermeasures, stockpiles and supply chains and exercises, learning, recovery and adaptation for 11 each; digital, cyber resilience and interoperability for nine; workforce and surge mobilisation for six; community protection and information integrity for three; and scalable care and continuity of essential health services for one. These frequencies describe the distribution of explicitly documented limitations in the corpus and should not be interpreted as comparative readiness scores. The complete observation-level coding basis is provided in Supplementary Material 4.

The analysis identified a recurrent distinction between the existence of preparedness architecture and the demonstration of operational readiness. Many limitations did not reflect the absence of plans, institutions or resources. Instead, they concerned the translation of existing arrangements into sufficiently specified, interoperable, scalable, tested and adaptive capabilities. Six recurrent gap mechanisms emerged from the synthesis and are summarised in Table 3.

A first recurrent gap concerned formalisation and activation. National preparedness arrangements frequently included strategic plans, coordination structures and established institutional relationships, while operational details were less consistently specified. Documented limitations included incomplete standard operating procedures, insufficiently defined activation thresholds, unclear or overlapping responsibilities, unfinished emergency-operations arrangements and continued reliance on informal coordination. The first-cycle PHEPA synthesis similarly identified recurrent implementation challenges alongside established preparedness strengths, while emphasising substantial variation in national context and implementation and cautioning that the interim findings did not constitute a comprehensive assessment of the entire EU/EEA [15].

A second gap concerned interoperability and operational visibility. Surveillance, laboratory, hospital-capacity and medical-countermeasure systems were widely represented in the corpus, but the information required for rapid operational decisions was not always integrated across organisations or technological platforms. Data interoperability was the individual indicator with the largest number of explicitly documented gaps in the analytical dataset. National assessments identified limitations in interoperability between databases and continuing development of integrated surveillance platforms, while the emerging Epi+ architecture itself illustrates the continuing transition toward more integrated event-based surveillance and information exchange [34,35,36]. Comparable visibility challenges were evident in stock monitoring, projected demand and supply-chain coordination, areas also emphasised in the EU Stockpiling Strategy [32]. Operational readiness therefore depends not only on generating relevant information, but on making it available across organisational boundaries in a form and timeframe suitable for coordinated action.

A third recurrent gap involved scalability and sustainability. Several capabilities could be activated or had already been used during emergencies, yet the evidence that they could be expanded and sustained under prolonged or simultaneous pressure was less consistent. Workforce mobilisation provides one example: deployable EU-level capacity was operational, while the external expert pool remained only partially operational and was still being expanded [29]. Similarly, medical-countermeasure readiness depended not only on the existence of reserves but on manufacturing scale-up, procurement, supply-chain resilience, logistics and rapid deployment [4,24,32]. Laboratory and clinical surge were likewise conditional on specialist workforce, consumables, transport and receiving capacity. These findings distinguish demonstrable short-term functionality from the ability to maintain equivalent performance as demand increases or persists.

A fourth gap concerned validation under realistic operational conditions. Completed exercises demonstrated selected capabilities for outbreak management, multisector coordination and deliberate biological threats, including Operation Vector and EU Health Task Force-supported exercises in Belgium and Malta [28,40,41]. Exercise-based validation was nevertheless uneven across the wider capability architecture. In particular, the corpus contained limited equivalent public evidence of completed testing for sustained health-sector cyber disruption, compound crises and cascading failures. This should not be interpreted as evidence that the underlying capabilities are absent; rather, equivalent public evidence that they had been operationally tested was not identified under the study criteria. This distinction is especially relevant for health cybersecurity, where substantial policy and implementation architecture had emerged but exercise- or real-world validation remained much less visible in the eligible corpus [37,38].

A fifth gap occurred between exercise or event experience and institutional adaptation. Conducting an exercise or responding to an event did not necessarily imply that identified weaknesses were systematically converted into corrective action. The PHEPA interim synthesis identified inconsistent use of structured after-action review processes [15], while country-level evidence showed that lessons were not always systematically integrated into preparedness planning; Lithuania, for example, was advised to strengthen the strategic use of exercises and the systematic incorporation of lessons into national emergency planning [42]. ECDC guidance explicitly treats action review as a cycle extending from review to agreed corrective actions and implementation planning [43]. At the same time, documented after-action reviews following outbreaks in Latvia and Slovakia demonstrate that structured learning mechanisms are operationally achievable [44,45]. The key readiness issue is therefore not simply whether systems are tested, but whether identified weaknesses lead to assigned, monitored and completed capability change.

A sixth, cross-cutting gap concerned cross-sector and cross-border integration. Contemporary EU frameworks increasingly link health preparedness with civil protection, critical infrastructure, security, logistics and other sectors [27,31], and the corpus contained demonstrated examples of cross-sector coordination and large-scale cross-border mobilisation, including deliberate-threat exercises and medical evacuation [23,28,30]. However, such examples did not establish equivalent interoperability or scalability across all capabilities. Informal information exchange, incompletely formalised interfaces and limited evidence of external scalability therefore remained relevant constraints when response requirements extended beyond a single organisation, sector or jurisdiction.

Because PHEPA assessments constituted the principal source of national-level implementation evidence, a sensitivity analysis was conducted to examine whether the identified preparedness–readiness gap patterns were disproportionately driven by PHEPA-derived observations. The 185 document–capability observations were therefore stratified into PHEPA-derived and non-PHEPA evidence streams and compared descriptively with respect to the frequency and domain distribution of documented gaps and the six recurrent gap mechanisms identified above. No statistical testing was performed. The results are presented in Table 4.

The sensitivity analysis showed a marked difference in the frequency of documented gaps between the two evidence streams. Of 115 PHEPA-derived observations, 67 (58.3%) contained a documented gap, compared with seven of 70 non-PHEPA observations (10.0%). PHEPA-derived gaps occurred across all eight readiness domains, whereas non-PHEPA gaps were identified in four. Nevertheless, four of the six recurrent gap mechanisms, formalisation and activation, interoperability and visibility, scalability and sustainability, and operational validation, were represented in both evidence streams. Learning and corrective-action closure and cross-sector/cross-border integration were identified as documented gaps only in the PHEPA-derived observations. These findings indicate that the absolute frequency and breadth of documented gaps were strongly influenced by the implementation-assessment function of PHEPA sources, while several of the principal preparedness–readiness gap mechanisms were also evident independently in the non-PHEPA evidence stream.

The distribution of evidence codes reinforced this pattern. Of the 74 observations containing a documented gap, 60 did not simultaneously contain evidence of operational functionality, completed exercise validation or real-world use, whereas 14 documented a limitation despite the presence of at least one of these forms of operational evidence. Preparedness–readiness gaps therefore occurred both before operationalisation, where plans or mechanisms had not yet progressed to demonstrable functionality, and within already operational capabilities, where functioning systems continued to exhibit limitations in scalability, interoperability, sustainability or adaptation.

Taken together, the findings indicate that the preparedness–readiness gap is not a single deficit located between policy and implementation. Rather, it comprises a series of potential discontinuities across an illustrative, non-linear operationalisation pathway:

Policy commitment → established mechanism → operational functionality → exercise validation → real-world use → learning → adaptation

This pathway is illustrative rather than sequential or obligatory; capabilities may be documented at different points along it, and learning and adaptation may feed back into earlier policy, mechanism and operational arrangements. Progression along this pathway was neither uniform nor necessarily linear. Some capabilities, including deployable public-health expertise and cross-border medical evacuation, had progressed to documented real-world activation and deployment [22,29,30], while still retaining identifiable constraints related to scalability or sustainability. Other areas, notably digital interoperability, information integrity and preparedness for interacting compound or cascading disruptions, were represented more strongly by policy, developing mechanisms or documented gaps than by equivalent evidence of completed operational validation.

Accordingly, the defining issue emerging from the corpus was not whether Europe possesses preparedness architecture, but whether formal capabilities can be translated into interoperable, scalable, validated and adaptive operational performance when multiple system demands occur simultaneously.

3.14. Integrated EU/EEA Operational Readiness Framework

The synthesis of the eight capability domains, evidence-of-operationalisation patterns and recurrent preparedness–readiness gaps resulted in an integrated framework for conceptualising operational health readiness in the EU/EEA (Figure 2). The framework distinguishes preparedness architecture from operational readiness by treating readiness not as the existence of plans, institutions or resources, but as the demonstrated ability to activate, coordinate, scale, sustain, validate and adapt those capabilities under crisis conditions. It integrates the recurrent discontinuities identified in Table 3 into a single analytical model linking threat context, capability, operationalisation, scalability, enabling conditions, critical dependencies and adaptive learning.

The first component is threat context, defined independently by the nature of intent and by the structure of hazard interaction. Intent may be natural or accidental, deliberate, hybrid, or unclear, whereas interaction may involve a single hazard, multiple hazards, compound crises or cascading disruption. Maintaining these as separate dimensions prevents deliberate or hybrid threats from being conflated with complex but non-deliberate emergencies and allows the same operational capabilities to be assessed across different crisis configurations. This distinction is consistent with EU definitions of hybrid threats and with the wider literature distinguishing intentional hybrid activity from compound and cascading disruption [5,10,11,12,13,14].

The second component is the operational capability base, comprising eight domains: threat intelligence, surveillance and diagnostics; governance, activation and emergency coordination; workforce and surge mobilisation; scalable care and continuity of essential health services; medical countermeasures, stockpiles and supply chains; community protection and information integrity; digital, cyber resilience and interoperability; and exercises, learning, recovery and adaptation. These domains represent distinct operational functions but are interdependent. Laboratory surge, for example, depends on specialist workforce, logistics, consumables and digital reporting, while clinical surge depends on personnel, transport, infrastructure, situational awareness and continuity of essential supplies. The framework therefore treats readiness as a system property rather than as the sum of isolated sectoral capabilities.

The third component is the operationalisation pathway, which describes the forms of documentary evidence through which preparedness capability becomes observable as operational readiness. Evidence was differentiated into formal policy or planning commitments (P), established mechanisms or resources (M), demonstrated operational functionality (O), completed exercise-based validation (E), and documented real-world use (R). These categories are cumulative but non-ordinal and were not combined into a composite readiness score. The pathway therefore organises different forms of evidence without assuming that every capability must progress linearly through all five categories or that real-world use represents a universally higher level of readiness than exercise validation.

Across the corpus, evidence along this pathway was uneven. Some capabilities had progressed from formal arrangements to demonstrated operational functionality or real-world use. Deployable public-health expertise was supported by documented EU Health Task Force deployments [22,29], while cross-border medical evacuation had been implemented at substantial scale during the response to the war in Ukraine [30]. Medical-countermeasure preparedness was supported by increasingly developed mechanisms for threat prioritisation, procurement, manufacturing, stockpiling and deployment [4,24,32]. Completed exercises also provided operational validation for selected outbreak and deliberate biological scenarios [28,40,41]. By contrast, equivalent public evidence of completed testing or real-world activation was less visible for health-sector cyber disruption, compound crises and cascading system failures, despite substantial development of the corresponding policy and implementation architecture [31,37,38,39].

The framework further identifies cross-cutting enablers that condition whether capabilities can progress from formal preparedness to operational performance. Legal authority and clearly defined mandates influence whether mechanisms can be activated; flexible financing and resource mobilisation affect the speed and scale of implementation; and evidence-to-decision mechanisms determine whether surveillance, risk assessment and situational information can be translated into operational action. These functions were treated as transversal enabling conditions rather than as additional readiness domains, consistent with the distinction between foundational and technical capabilities in the 2026 WHO framework for health emergency preparedness and response [19].

Operational readiness is also conditional on critical dependencies. Workforce, digital systems, energy, transport, logistics, laboratories, manufacturing and supply chains repeatedly appeared across the corpus as dependencies supporting multiple capability domains. EU preparedness and critical-infrastructure policy increasingly recognises these interdependencies and the possibility that disruption in one sector can affect the functioning of others [3,31]. Similar dependencies are evident in medical-countermeasure preparedness, where stockpiles alone are insufficient without manufacturing, logistics, distribution and supply-chain continuity [4,32], and in health-sector cybersecurity, where digital disruption can directly affect continuity of healthcare delivery [37,38]. The framework therefore recognises that a formally established capability may lose operational functionality when one or more supporting systems fail.

A further dimension is scalability across organisational and geographic levels. National operational capability cannot automatically be equated with shared or cross-border readiness. Explicit cross-border scalability was documented in 35 of the 185 document–capability observations, distributed across 16 primary sources; in the remaining observations, equivalent public evidence was not identified. These frequencies describe the documentary evidence base rather than the absence of underlying capability. The framework consequently distinguishes national functionality, shared governance and cross-border scalability, while recognising that these levels may interact during major crises. Demonstrated examples such as EU-level deployment of public-health expertise and cross-border medical evacuation illustrate that scalability can extend beyond national systems when appropriate coordination, logistics and governance mechanisms are available [22,29,30].

Finally, the framework incorporates learning and adaptation as a feedback function rather than an endpoint. Exercise validation and real-world activation generate operational evidence, but their contribution to future readiness depends on whether identified limitations are captured, prioritised and translated into corrective action. ECDC guidance explicitly links in-action and after-action review to the identification, assignment and implementation of corrective measures [43], and recent outbreak reviews demonstrate the practical use of these mechanisms [44,45]. However, the PHEPA evidence indicates that systematic learning and corrective-action closure remain unevenly institutionalised [15]. Readiness is therefore strengthened not simply by conducting exercises or responding to crises, but by feeding the resulting evidence back into plans, procedures, training, resources and capability design.

Taken together, the framework conceptualises operational readiness as a dynamic and conditional system state produced by the interaction of threat context, operational capability, evidence of operationalisation, scalability, enabling conditions, critical dependencies and adaptive learning. Preparedness establishes the potential for action; operational readiness concerns whether that potential can be converted into coordinated, scalable and sustained performance under the specific conditions generated by a crisis. Consequently, the same formal preparedness architecture may produce different operational outcomes depending on threat configuration, system capacity, availability of enabling resources and the integrity of critical dependencies.

The framework therefore provides a structured means of identifying where preparedness may fail to translate into readiness without reducing complex systems to a single composite score. Operational gaps can be located more precisely at the level of capability design, establishment of mechanisms, activation, scaling, validation, real-world deployment, or learning and adaptation. In this way, Figure 2 provides the integrative model through which the domain-level findings and preparedness–readiness gaps identified in this study can be interpreted.

4. Discussion

The present analysis indicates that the central challenge for contemporary European health security is no longer simply the construction of preparedness architecture, but the conversion of that architecture into demonstrable operational readiness. Across the eight capability domains, the documentary corpus contained extensive evidence of plans, institutional mechanisms and designated resources, whereas evidence became less consistent when operational functionality, exercise-based validation and real-world use were considered. This distinction is consistent with the emerging literature on operational readiness, which positions readiness between longer-term preparedness and emergency response and emphasises the capacity to translate established structures and resources into actions that can be activated rapidly under crisis conditions [7,8]. The present study extends this distinction by operationalising it across the contemporary EU/EEA health-security architecture and by showing that the preparedness–readiness gap is not confined to the absence of formal capacity, but also arises from incomplete activation, interoperability, scalability, validation and adaptive learning.

This finding develops the trajectory identified in previous analysis of post-COVID-19 European health governance, which described a transition from reactive crisis management toward more institutionalised transformative resilience [6]. Since then, Regulation (EU) 2022/2371 and subsequent initiatives including HERA, strategic stockpiling, medical-countermeasure arrangements, cross-border civil-protection capacities and the Preparedness Union framework have substantially expanded the institutional architecture of European health security [1,2,3,4,23,32]. The present findings should therefore not be interpreted as evidence that Europe lacks preparedness capacity, but rather that institutional maturity and operational maturity do not necessarily develop at the same rate: increasingly elaborate structures may coexist with uneven evidence of activation, scalability, validation and sustained performance.

This distinction is particularly visible in surveillance and diagnostics. The results showed comparatively strong operational evidence for laboratory and diagnostic capability [15,24], consistent with the WHO concept of collaborative surveillance, in which readiness depends on integrating multi-source information and translating it into actionable intelligence [8]. In the EU/EEA evidence examined here, the recurrent weakness was less the absence of surveillance capacity than fragmentation between data streams, laboratories, healthcare providers and administrative platforms, a pattern also reflected in national assessments and the continuing development of Epi+ [15,34,35,36]. Digitalisation alone therefore does not resolve interoperability where information remains organisationally or technically separated.

A similar pattern was evident in cyber and digital readiness. The European Action Plan on the Cybersecurity of Hospitals and Healthcare Providers established a sectoral framework spanning prevention, detection, preparedness, response and recovery [37], with implementation progressing in selected areas by 2026 [38]. The limited operational and exercise evidence identified here should therefore be interpreted as uneven operationalisation rather than absence of cyber-health preparedness architecture, particularly when compared with more established capabilities such as cross-border medical evacuation and deployable public-health expertise [22,29,30].

This difference between institutional existence and operational demonstration was also apparent in workforce readiness. The EU Health Task Force provides a clear example of a mechanism that has moved beyond policy designation to documented operational use. In 2025, 14 requests were accepted, including 12 assignments within the EU/EEA and two outside it, and six experts were deployed, while different expert pools remained at different stages of operational maturity [29]. This illustrates that operational capability may be demonstrable while still constrained by scale, specialist availability or sustainability, reinforcing the interpretation of readiness as conditional rather than binary.

A similar pattern emerged for clinical surge and patient redistribution. Cross-border medical evacuation represented one of the strongest examples of demonstrated European operational capability in the corpus. By April 2026, more than 5,000 patients from Ukraine had been transferred for specialised treatment to hospitals in 22 European countries through the Union Civil Protection Mechanism, requiring coordinated medical transport, logistics, receiving capacity and cross-border governance [30]. However, successful patient redistribution does not establish that the broader health system would retain equivalent functionality during a simultaneous or prolonged system-wide shock. Continuity of essential health services under concurrent disruption additionally depends on workforce availability, energy, supply chains, digital systems, infrastructure and receiving capacity. The corpus therefore provided stronger evidence for patient redistribution and evacuation than for validation of wider continuity under compound or cascading disruption.

Contemporary EU medical-countermeasure preparedness increasingly adopts an end-to-end approach linking threat assessment, research and development, scalable manufacturing, procurement, stockpiling and deployment [4,24,32]. The findings nevertheless indicate that possession of strategic reserves represents only one component of readiness. Inventory and needs visibility, estimation of future requirements, manufacturing scalability, transport, distribution and replenishment determine whether reserves remain operationally useful as demand changes. The distinction between stockpile availability and medical-countermeasure readiness is therefore analytically important: the former concerns the existence of assets, whereas the latter concerns the wider system required to mobilise and sustain them.

The importance of interdependence extends across almost every domain examined. Workforce mobilisation depends on transport, financing and specialist expertise; laboratory surge depends on reagents, personnel, digital systems and referral pathways; clinical surge depends on infrastructure, utilities, transport and receiving capacity; and countermeasure deployment depends on manufacturing, logistics and cross-border movement. Operational readiness is therefore not reducible to the maturity of individual health capabilities. A capability that appears well established in isolation may lose functionality when one or more of its critical dependencies are disrupted. This systems perspective is also reflected in broader resilience frameworks. The 2026 NATO Resilience Baseline Requirements, used in this study solely as an external benchmark, address mass casualties and disruptive health crises, civil–military information exchange, healthcare-capacity inventories, medical stockpiling and exercise-based validation [21]. Although NATO and EU health-security frameworks have different mandates, their shared emphasis on continuity, dependencies and operational testing supports the analytical value of treating health readiness as a system property rather than as a collection of isolated sectoral plans.

The threat-context findings further support this interpretation. The corpus was strongly oriented toward all-hazards and multi-hazard preparedness, whereas explicitly documented compound and cascading crisis scenarios were much less common. Multi-hazard preparedness recognises more than one hazard type, while readiness for compound or cascading crises additionally requires consideration of interacting threats, critical dependencies and secondary failures. The EU Preparedness Union Strategy reflects this broader threat environment by linking preparedness with health emergencies, critical infrastructure, cybersecurity, information manipulation and civil–military cooperation and by calling for regular EU-level exercises [3]. Strategic recognition of interconnected threats, however, does not itself demonstrate operational validation under simultaneous disruption.

The findings regarding deliberate and hybrid threats illustrate the same distinction. Deliberate biological preparedness was more directly observable than broader hybrid-health readiness. Operation Vector provides an important example: the 2025 ECDC–Europol exercise brought together more than 100 operational and technical professionals from public health, law enforcement and related institutions and tested early-warning arrangements, cross-sectoral information exchange, communication and joint decision-making during an intentional biological scenario [28]. Nevertheless, the scarcity of comparable evidence involving simultaneous cyber disruption, information manipulation, infrastructure degradation and healthcare pressure indicates that broader hybrid-health readiness remains less extensively demonstrated.

AI appeared in the analysed architecture as both an enabling technology and a potential threat amplifier rather than as a self-contained readiness capability. EU policy similarly recognises its dual role in supporting vulnerability detection and critical-infrastructure protection while enabling malicious actors to increase the speed and scale of cyber operations [39]. Treating AI as a cross-cutting modifier therefore maintains analytical focus on the operational functions being enabled or disrupted.

Simulation exercises provide one of the few means of testing preparedness assumptions before a real emergency. Operation Vector and recent national exercises demonstrate their use for examining coordination, communication, decision-making and operational procedures [28,40,41], while hospital incident-command studies similarly show how exercises can reveal whether formal crisis structures translate into role clarity, structured communication and coordinated leadership [46,47].

Exercise activity alone, however, does not complete the readiness cycle. The present results showed weaker evidence for structured after-action review, corrective-action monitoring and confirmation that identified limitations had been addressed [15,42,43,44,45]. A system that repeatedly exercises without closing identified gaps may accumulate experience without corresponding capability improvement [48], whereas translating findings into revised plans, procedures, training and resources supports adaptive capability. This logic is consistent with the WHO 2026 framework [19] and underpins the operationalisation pathway proposed here.

Importantly, this pathway should not be interpreted as a linear maturity scale. The P–M–O–E–R categories represent different forms of evidence rather than sequential levels: a capability may be activated without a preceding publicly documented exercise, repeatedly exercised without recent real-world activation, or operational while generating little public evidence. Their value lies in preventing legislation, established mechanisms, exercise validation and demonstrated operational performance from being treated as interchangeable indicators of readiness.

PHEPA findings are particularly valuable because they provide an implementation-oriented perspective below the EU institutional level. The interim synthesis identified recurrent strengths and implementation challenges while cautioning against interpreting the findings as a comprehensive comparative assessment [15]. Accordingly, PHEPA evidence was used to identify recurring implementation patterns rather than to rank national systems. The sensitivity analysis further showed that, although PHEPA sources contributed disproportionately to the absolute frequency of documented gaps, several principal preparedness–readiness gap mechanisms were also evident in the non-PHEPA evidence stream.

Taken together, the findings support a conception of operational readiness as a dynamic relationship between capability, activation, scalability, validation, critical dependencies and learning. This is consistent with WHO frameworks emphasising interconnected capabilities and the translation of preparedness structures into coordinated emergency-response capacity [8,19]. The contribution of the present study is to make this transition analytically explicit within the EU/EEA context without reducing readiness to a single composite score. Different capabilities may display different forms of operational evidence and remain differently affected by threat type, duration, scale and critical dependencies; the preparedness–readiness gap is therefore better understood as a series of potential discontinuities between formal architecture and effective crisis performance.

5. Implications

The findings have several implications for how health preparedness is designed, assessed and operationalised across the EU/EEA. Most importantly, preparedness should not be inferred solely from the existence of legislation, plans, institutions or strategic reserves. The analytical distinction between policy commitment, established mechanism, operational functionality, exercise validation and real-world use suggests that future assessments should explicitly identify what type of evidence supports a claimed capability. This would complement the current PHEPA approach, which focuses on implementation of national prevention, preparedness and response capacities rather than only on the formal existence of plans [1,20], and could allow changes in operationalisation to be followed across successive assessment cycles.

A second implication concerns testing and verification. The EU Preparedness Union Strategy already calls for regular EU-level exercises, stronger crisis coordination and systematic learning from crises [3]. The present findings suggest that exercises are particularly valuable when they move beyond validation of individual plans and test interacting capabilities under conditions resembling contemporary crisis complexity. This includes simultaneous pressure on health services, communications, supply chains, digital infrastructure and workforce, as well as deliberate biological, cyber and information-related disruption. HERA’s 2026 programme moves in this direction by planning simulation exercises addressing intentional CBRN threats and multisectoral coordination, including civil–military cooperation [24]. A logical extension would be to incorporate compound and cascading effects systematically into exercise design rather than treating hazards as operationally independent.

Third, the results highlight the importance of closing the exercise-to-improvement loop. Conducting exercises or after-action reviews provides limited readiness benefit if identified weaknesses are not translated into assigned, resourced and monitored corrective actions. Evaluation frameworks could therefore distinguish between completion of an exercise, identification of lessons, adoption of corrective actions and subsequent verification that those actions have altered capability. This would shift emphasis from exercise frequency alone toward evidence of organisational learning and adaptation. ECDC guidance already frames after-action review as a process extending from identification of findings to corrective actions and implementation planning [43], while HERA’s preparedness activities provide an institutional basis for linking exercises, training and capacity development [24].

A fourth implication relates to interoperability and situational visibility. The recurring gaps identified in surveillance, laboratory reporting, healthcare-capacity monitoring and medical-countermeasure management indicate that further digitalisation alone is unlikely to resolve operational fragmentation. Readiness requires that information from different systems can be exchanged, interpreted and used during decision-making. This distinction is particularly relevant as new EU surveillance and cyber-resilience mechanisms are introduced. The health-sector cybersecurity framework includes prevention, detection, response and recovery functions, while implementation has progressed through sector-specific guidance and development of support services [37,38]. At the same time, platforms such as Epi+ illustrate the continuing development of more integrated surveillance infrastructure [36]. Their operational value will depend not only on technical deployment but also on interoperability with national systems, governance arrangements and continuity mechanisms during disruption.

The findings also imply that medical-countermeasure preparedness should be assessed as a supply system rather than as a stockpile inventory. Current EU policy increasingly reflects this logic: the Medical Countermeasures Strategy links threat prioritisation, research and development, procurement, scalable manufacturing, stockpiling and rapid deployment [4], while HERA programming and the EU Stockpiling Strategy further address implementation, supply-chain visibility and deployment [24,32]. Operational assessment should therefore consider whether authorities can identify emerging demand, observe stocks and shortages, activate procurement or reserved manufacturing capacity, transport resources across borders and replenish supplies during prolonged emergencies. A stockpile that cannot be accurately monitored, replenished or rapidly distributed represents a different form of readiness from one embedded within an operational supply network.

A similar distinction applies to workforce readiness. The ability to deploy experts during a discrete event does not necessarily demonstrate that staffing can be maintained during a prolonged or concurrent crisis. Workforce assessments may therefore need to consider reserve pools, specialist bottlenecks, replacement capacity, occupational protection and the sustainability of surge arrangements alongside immediate mobilisation. This is particularly relevant for laboratory, epidemiological, cyber, infection-control and other specialist functions in which relatively small numbers of personnel may support otherwise well-developed institutional capabilities. The experience of the EU Health Task Force, where operational deployment coexists with differing levels of maturity across expert pools, illustrates this distinction [29].

The study further suggests that cross-border scalability should be treated as a distinct characteristic of readiness rather than inferred from national capability. The EU architecture increasingly provides shared mechanisms for procurement, stockpiling, civil protection, surveillance and specialist support [23,27,29,32], but the present analysis identified explicit cross-border scalability in only a subset of observations. This does not imply that other capabilities cannot scale across borders; rather, it indicates that scalability should be demonstrated independently. This approach is consistent with the Preparedness Union Strategy’s emphasis on preparedness as a responsibility requiring coordinated action across national and European levels [3].

For hybrid and deliberately induced crises, the findings imply that health readiness increasingly needs to be evaluated at the interface between public health and wider security and resilience systems. Contemporary EU policy now incorporates deliberate biological and CBRN threats, cyber disruption, information manipulation, critical-infrastructure resilience and civil–military cooperation [3,24,31]. However, the comparatively limited exercise and real-world evidence identified for combined hybrid scenarios suggests that strategic recognition and operational validation should remain analytically separate. This is particularly relevant for AI-enabled threats, where AI may simultaneously support detection and response while increasing the speed and scale of hostile cyber or information activity [39].

Finally, the framework developed in this study offers a potential basis for longitudinal readiness monitoring without creating a composite readiness score. Repeated application of the same capability and evidence categories could identify changes in the documentary evidence supporting policy commitments, established mechanisms, operational functionality, exercise validation and real-world use, while also recording unresolved dependencies, gaps and corrective actions. This would preserve the contextual nature of readiness and avoid implying that complex national health-security systems can be meaningfully reduced to a single ranking. Such an approach could be used alongside successive PHEPA cycles and EU-level preparedness reviews to examine whether institutional reforms are producing observable changes in operational capability over time.

Overall, the practical implication is that the next phase of European health preparedness is likely to depend less on creating additional standalone preparedness structures and more on demonstrating that existing and emerging mechanisms can interoperate, scale, withstand dependency failures, be validated under realistic conditions and adapt after exercises or real-world use. This would shift the emphasis from preparedness architecture alone toward the operational performance required during hybrid, compound and cascading health crises.

6. Limitations

This study has several limitations that should be considered when interpreting the findings. First, the analysis was based predominantly on publicly available institutional documentation. Operational readiness, however, includes capabilities that may be documented only internally or may not be publicly disclosed for security, operational or political reasons. This is particularly relevant to civil–military coordination, cyber response, CBRN preparedness, critical-infrastructure protection and deliberate or hybrid-threat scenarios. Consequently, absence of public evidence was not interpreted as absence of capability and was coded separately from an explicitly documented gap, in accordance with the predefined analytical framework.

Second, the evidence base was heterogeneous in purpose, granularity and reporting depth. Legislation, strategies, work programmes, operational reports, exercise documentation and country preparedness assessments provide different types of evidence and cannot be treated as directly equivalent indicators of readiness. The P–M–O–E–R framework was introduced specifically to preserve this distinction; however, differences in documentation practices remain an inherent limitation of documentary synthesis. In particular, a capability may be operational without having generated publicly available exercise or deployment documentation, whereas highly visible mechanisms may appear disproportionately prominent because they produce more extensive reporting.

Third, the country-level evidence was not designed to support comprehensive comparisons between national systems. PHEPA assessments address a common set of preparedness capacities, but selected capacities are examined in greater depth during individual country assessments and the degree of detail varies according to national context and assessment priorities. ECDC has similarly cautioned that interim first-cycle findings should not be interpreted as a complete comparative assessment of preparedness across the EU/EEA. Accordingly, country reports were used to identify recurrent implementation patterns and illustrative examples rather than to rank countries or calculate comparative readiness levels.

Fourth, the analytical period captured a rapidly evolving policy environment. Several major initiatives, including elements of the Preparedness Union Strategy, the Medical Countermeasures Strategy, new cyber-health measures, Epi+, updated HERA programmes and national post-PHEPA action processes, were still being implemented at the search closure date of 17 September 2026. Some mechanisms classified as policy commitments or developing mechanisms may subsequently become operational, exercised or deployed. The study should therefore be interpreted as a time-bounded assessment of documented readiness rather than a definitive assessment of completed reform.

Fifth, the analysis relied on documentary evidence of capability rather than direct measurement of operational performance. The presence of an established mechanism, documented mobilisation procedure or completed exercise does not demonstrate how effectively that capability would perform under every future crisis condition. Conversely, poor performance in one event would not necessarily establish a persistent absence of readiness. The framework therefore assesses documented evidence of operationalisation, not effectiveness, response quality or expected outcomes.

Sixth, evidence categories were intentionally non-ordinal and were not combined into a composite readiness score. This avoids implying unsupported precision or ranking heterogeneous systems, but it also prevents simple quantitative comparison between domains or countries. Counts of policy, mechanism, operational, exercise and real-world observations reflect the structure of the documentary corpus and should not be interpreted as measures of absolute capability strength. Similarly, the number of documented gaps partly reflects the depth and transparency of assessment: extensively evaluated capabilities may generate more documented weaknesses than capabilities for which less information is publicly available.

Seventh, several threat contexts were sparsely represented. Although deliberate biological and CBRN scenarios were identifiable, explicit evidence concerning hybrid campaigns, compound crises and cascading disruption was limited. No observation met the predefined threshold for classification as an explicitly documented compound crisis, and only a small number addressed cascading disruption. This finding may reflect both the current maturity of operational planning and limitations in public disclosure or terminology. It should therefore not be interpreted as evidence that EU/EEA systems lack relevant capabilities.

Eighth, community engagement, information integrity and some forms of digital or communication continuity generated substantially less operational evidence than material capabilities such as laboratories, stockpiles, deployments or medical evacuation. These differences may partly reflect an observability bias: tangible deployments and assets are more readily documented than relational, behavioural or societal capabilities. Future evaluations may therefore require dedicated indicators and data sources to assess these less visible dimensions of readiness.

Screening, extraction and coding were conducted using a predefined and frozen codebook. Independent duplicate coding was not performed and inter-rater reliability was therefore not estimated. To reduce interpretive drift, explicit decision rules, evidence definitions, ambiguity-resolution procedures and an audit trail were maintained throughout the analysis. The codebook further required that operational, exercise and real-world evidence be assigned only when explicitly supported by the source documentation.

Taken together, these limitations mean that the study should be interpreted as a structured assessment of publicly documented operational readiness rather than a direct measurement of the full latent capacity or effectiveness of European health systems. Its principal contribution lies in identifying where documentary evidence supports the translation of preparedness architecture into operational capability, where that translation remains incomplete, and where the available public evidence is insufficient to determine operational status.

7. Conclusions

The EU/EEA has developed an increasingly comprehensive architecture for health emergency preparedness, encompassing surveillance, crisis coordination, workforce mobilisation, scalable care, medical countermeasures, digital and cyber resilience, and structured preparedness assessment. The findings of this study indicate, however, that the existence of this architecture should not be equated with operational readiness. Across the eight capability domains, established mechanisms and institutional arrangements were more extensively documented than repeated exercise-based validation, sustained scalability and real-world operational use.

The analysis identified a series of preparedness–readiness translation gaps rather than a single deficit. These included incomplete operationalisation of strategic plans, fragmented interoperability and situational visibility, constraints on scalable workforce and supply capacity, uneven exercise-based validation, and inconsistent conversion of identified lessons into monitored corrective action. Operational readiness therefore depends not only on whether capabilities exist, but on whether they can be activated, coordinated, scaled and sustained while critical dependencies remain functional.

This distinction becomes particularly important for hybrid, compound and cascading health crises. European preparedness increasingly addresses deliberate biological threats, cyber disruption, CBRN events, information manipulation and cross-sector dependencies, yet publicly documented operational validation of scenarios involving interacting and cascading disruptions remains comparatively limited. The evidence was stronger for selected capabilities, including laboratory surge, deployable public-health expertise, medical-countermeasure mechanisms and cross-border patient transfer, than for system-wide performance under simultaneous disruption.

The framework developed in this study therefore conceptualises operational readiness as a dynamic and conditional property of health-security systems, produced through the interaction of capability, activation, scalability, validation, critical dependencies and adaptive learning. Rather than reducing readiness to a single composite score, the framework distinguishes the different forms of evidence through which operationalisation can be demonstrated and identifies where capability remains insufficiently validated or documented. Applied longitudinally, this approach could help determine whether the expanding European preparedness architecture is translating into increasingly interoperable, scalable and adaptive operational capability under future crisis conditions.