Who Has to Tell Whom? The Law Behind UK–EU Infectious-Disease Surveillance After Brexit

The legal architecture that decides how a disease signal travels between Britain and Europe — and whether it moves faster than the pathogen.

Imagine that a laboratory in Manchester identifies something unusual. Several patients have infections caused by organisms that appear closely related, and whole-genome sequencing suggests the cluster may not be confined to Britain — similar infections are beginning to appear in Belgium and the Netherlands. Scientifically, the connection might become apparent remarkably quickly. Legally and institutionally, however, the information has to travel through a system that changed substantially when the United Kingdom left the European Union.

Before Brexit, the UK participated directly within much of the EU’s health-security architecture. Today, Britain operates its own surveillance and health-security arrangements while maintaining mechanisms through which information and expertise can be exchanged with European institutions. The pathogens, of course, have noticed none of this. A virus carried on an aircraft does not encounter a regulatory border; a bacterium moving through a food supply chain does not need to understand whether the United Kingdom is an EU Member State; and a mosquito, migratory bird or contaminated product can connect populations governed by completely different legal systems.

This creates a deceptively simple One Health Security question: when Britain and Europe detect different parts of the same biological event, who has to tell whom? It is the legal companion to our analysis of how the UK and EU cooperate on surveillance after Brexit — this time following not the institutions, but the law that connects them.

The signal starts locally

International disease surveillance ultimately depends on information generated somewhere much closer to the patient. In England, one important part of that foundation is the Public Health (Control of Disease) Act 1984 and the Health Protection (Notification) Regulations 2010, which establish notification requirements covering specified infectious diseases and causative agents. Registered medical practitioners have duties to notify relevant cases, and diagnostic laboratories have notification obligations when specified causative agents are identified in human samples.

This matters because international surveillance cannot compensate for weak detection at national level. Before an unusual infection can become a European signal, somebody has to recognise it locally: a clinician notices an unusual presentation, a laboratory identifies an organism, several cases begin to form a pattern, and genomic sequencing reveals relationships that would previously have remained invisible. Only once that information has moved into national surveillance does the question of international exchange arise.

There is not one UK system

Even the phrase “UK surveillance” hides some complexity, because health protection is substantially devolved. England, Scotland, Wales and Northern Ireland each have their own public-health institutions and legal arrangements, although they cooperate extensively on threats affecting the United Kingdom as a whole. The post-Brexit system therefore had to solve two related problems: Britain needed mechanisms for exchanging information internally between its public-health authorities, and it needed mechanisms through which the resulting UK system could communicate with European institutions from outside the EU.

The Health Security (EU Exit) Regulations 2021 are consequently one of the least glamorous but most interesting pieces of Britain’s post-Brexit health-security architecture. They establish arrangements for epidemiological surveillance, monitoring, early warning and response, and create a UK Health Protection Committee involving the UK’s public-health agencies — a body whose role includes determining which diseases are subject to UK-wide surveillance and ensuring that adequate procedures exist for collecting surveillance data. Their significance extends beyond domestic administrative tidying: they help implement the health-security relationship established between the UK and EU under the Trade and Cooperation Agreement.

Brexit did not end health-security cooperation

It is easy to describe Brexit as though the UK simply disconnected itself from European disease surveillance, but that is not quite what happened — the relationship changed rather than ended. The UK–EU Trade and Cooperation Agreement, which has governed much of the relationship since the end of the Brexit transition period, contains specific provisions concerning serious cross-border threats to health. These provisions recognise an unavoidable reality: an infectious-disease event affecting Britain may also affect the European Union, and vice versa. The Agreement therefore provides mechanisms for cooperation between the two systems, one of the most important of which involves the EU’s Early Warning and Response System, usually known as EWRS.

What is EWRS?

EWRS is the European Union’s secure system for communicating information concerning serious cross-border threats to health, allowing competent authorities to exchange alerts, risk information and the information needed to coordinate responses. For an EU Member State, participation forms part of the wider European health-security system. The UK’s position after Brexit is different: the Trade and Cooperation Agreement provides for the possibility of UK access to EWRS in relation to a particular serious cross-border health threat, where this is necessary for exchanging relevant information and coordinating measures. The arrangement is therefore not equivalent to permanent Member State participation — it is a gateway between two systems, and that distinction matters.

The gateway problem

From a governance perspective, gateways deserve attention because they are places where information can potentially slow down. Imagine that UK surveillance detects an unusual pathogen and investigators establish that it may constitute a serious cross-border threat. At some point the incident changes from being a UK surveillance event to being a UK–European health-security event — and that transition requires recognition. Someone has to decide that international exchange is warranted, the relevant mechanisms have to be activated, and European authorities have to receive enough information to understand the significance of the signal. The scientific relationship between cases may therefore exist before the institutional relationship between investigations has been fully established.

This is another example of governance latency. The important preparedness question is not merely whether a legal mechanism exists; it is how quickly that mechanism operates when an unfamiliar biological event appears.

Europe changed too

The system on the other side of the gateway has also changed considerably since Brexit, because the COVID-19 pandemic exposed weaknesses in European health preparedness and subsequently produced substantial reform. The central EU legislation is now Regulation (EU) 2022/2371 on serious cross-border threats to health, which establishes a framework covering prevention, preparedness and response planning, epidemiological surveillance, monitoring, early warning and coordinated responses. It also strengthens the role of the EU Health Security Committee, which brings together representatives of Member States and supports coordination of prevention, preparedness and response measures. This matters because infectious-disease governance is not simply about exchanging surveillance data — countries may need to coordinate what they actually do in response to those data.

ECDC sits in another part of the architecture

The European Centre for Disease Prevention and Control is frequently described as though it were Europe’s equivalent of a national public-health agency, but its role is more specific: ECDC supports European surveillance, epidemic intelligence, scientific assessment, preparedness and response to infectious-disease threats. Its legal foundation remains Regulation (EC) No 851/2004, but its mandate was substantially strengthened by Regulation (EU) 2022/2370 following the pandemic. For the UK, ECDC is particularly interesting because the Trade and Cooperation Agreement envisages scientific and technical cooperation between the Centre and the relevant UK bodies.

This is important because not every cross-border disease problem requires political escalation. Scientists need to exchange technical information, epidemiologists need to compare patterns, laboratories need to understand whether genomic signals match, and risk assessments need evidence from both sides. The quality of UK–EU health security therefore depends partly on what happens beneath the diplomatic relationship — on whether experts can continue to work across the institutional boundary.

A pathogen creates several kinds of information

This becomes more complicated once we put the One Health hat on. Imagine that the initial signal does not come from a hospital at all, but from wastewater, a poultry flock, an unusual infection in a pig, a food sample, or a mosquito surveillance programme. The human-health architecture is only one part of the picture, because different European systems govern animal disease, food safety, environmental surveillance and human infectious disease. A zoonotic or foodborne event may consequently create several information pathways at once: a food-safety signal might move through the Rapid Alert System for Food and Feed, an animal-disease signal might enter veterinary surveillance and notification systems, a human-health signal may reach ECDC and EWRS, and genomic information may connect organisms identified across different sectors. The biological event is singular. The governance architecture is plural. That is precisely where One Health becomes useful.

The law follows sectors more easily than biology

Legislation necessarily allocates responsibilities: food law governs food, animal-health law governs animals, public-health legislation governs threats to people, and environmental law governs environmental systems. Those divisions make administration possible, but they can also create blind spots. Consider an antimicrobial-resistance gene detected in wastewater: at first it may look like an environmental-surveillance issue; a related organism then appears in a livestock sample; and later, clinical laboratories identify related resistant infections in people. Which legal and surveillance architecture owns the incident? The answer is likely to change as evidence accumulates. One Health governance therefore requires something legislation finds inherently difficult — the ability to reorganise around the biological problem rather than around the institutional category in which the first signal happened to appear.

The global layer never disappeared

There is another important part of the architecture, because neither Britain nor the European Union operates in isolation from the global disease-surveillance system. The International Health Regulations (2005) provide the principal international legal framework through which WHO Member States detect, assess, notify and respond to public-health events with potential international implications. The IHR were significantly amended in 2024, and those amendments — including a new “pandemic emergency” alert level and a requirement to establish National IHR Authorities — entered into force on 19 September 2025 for most States Parties. This creates another layer of information movement:

1. Local detection
2. National surveillance
3. UK coordination (across the four public-health agencies)
4. UK–EU health-security mechanisms
5. European surveillance and coordination
6. WHO / International Health Regulations

The sequence will not always operate so neatly, and information can enter from several directions simultaneously. WHO may alert countries to an emerging threat elsewhere; ECDC may identify a European cluster before an individual country recognises its significance; and a national laboratory may generate the first genomic signal. Modern surveillance is a network, not a ladder.

Data have to cross the border too

There is also a less visible legal problem, because disease surveillance involves data — sometimes highly aggregated, but sometimes detailed enough to connect cases, exposures or laboratory results. Health information is particularly sensitive personal data, so cross-border surveillance has to operate within data-protection law as well as health-security law. The UK retained a data-protection regime derived substantially from the EU General Data Protection Regulation following Brexit, while the EU operates under the GDPR, and the continuing ability to move necessary public-health information lawfully and securely is therefore part of health-security infrastructure.

Data protection and disease surveillance are sometimes presented as competing objectives, but they should instead be designed together. A surveillance system that cannot protect sensitive information will lose trust, while a privacy regime that makes legitimate emergency information exchange unnecessarily difficult can itself introduce governance latency. Good governance requires both.

Northern Ireland adds another interface

Northern Ireland again demonstrates why the UK–EU relationship cannot be understood simply as Britain on one side and Europe on the other. It shares a land border with an EU Member State; people cross that border routinely; and healthcare relationships, communities and biological risks do not map neatly onto the political boundary. Northern Ireland also operates within distinctive post-Brexit arrangements under the Windsor Framework in areas relating to goods, so an infectious-disease event on the island of Ireland can require cooperation between institutions operating within different jurisdictions while serving populations connected by geography and daily movement — which makes information exchange particularly important. The border may matter legally, but epidemiologically the island remains an interconnected population, a point our analysis of the post-Brexit UK makes on the animal-health side too.

Where could the system still fail?

The existence of legislation does not guarantee the absence of governance gaps, and several potential weaknesses remain worth watching. The first is escalation latency — how quickly a national signal becomes recognised as a serious cross-border threat. The second is information interoperability — whether surveillance and genomic information generated in different systems can be compared rapidly enough. The third is sectoral fragmentation — whether a signal can move easily between human, animal, food and environmental surveillance when the evidence suggests they are describing the same biological event. The fourth is devolved coordination — whether information moves smoothly between the UK’s four public-health systems before it needs to move internationally. And the fifth is technical continuity — whether scientists and epidemiologists can cooperate quickly even when formal institutional participation differs from that which existed before Brexit. These are measurable governance questions, and they do not require taking a political position on Brexit.

What should improve?

The objective should not be to recreate EU membership through health-security policy, nor should Britain attempt to construct a completely independent biological-surveillance island; neither reflects the actual risk environment. Instead, the UK and EU should concentrate on interoperability. For serious cross-border threats, the threshold and process for activating enhanced information exchange should be clear, exercised and rapid. UK public-health agencies and ECDC should maintain strong routine scientific relationships, so that technical cooperation does not have to be invented during an emergency. Cross-border exercises should deliberately test events that begin outside conventional human-health surveillance — including zoonotic, foodborne and environmental signals — and should test how rapidly genomic information can be compared during emerging clusters.

Most importantly, exercises should measure time: signal detected → national recognition → cross-border recognition → information exchange → coordinated assessment → intervention. That would allow something normally hidden to become visible, so that governance latency could actually be measured rather than assumed.

Who has to tell whom?

The answer to the question in the title is therefore more complicated than a list of institutions. A clinician may have to tell a public-health authority; a laboratory may have statutory notification obligations; the UK’s public-health agencies need to tell one another; the UK may need to exchange information with European institutions; ECDC may need to connect information appearing in several countries; the Health Security Committee may need to coordinate responses; states may have obligations under the International Health Regulations; and in a genuine One Health event, veterinary, food-safety and environmental systems may all hold different parts of the answer.

That complexity is not inherently a failure — modern societies require specialised institutions and legal frameworks, and the governance challenge is making sure the interfaces between them work. Brexit changed one of those interfaces substantially, and the law has built a bridge back across it. The important question for health security is not simply whether that bridge exists. It is whether information can cross it faster than infection does.

Key legal framework

United Kingdom

• Public Health (Control of Disease) Act 1984
• Health Protection (Notification) Regulations 2010
• Health Security (EU Exit) Regulations 2021
• European Union (Future Relationship) Act 2020
• UK–EU Trade and Cooperation Agreement — in particular the provisions on serious cross-border threats to health

European Union

• Regulation (EU) 2022/2371 on serious cross-border threats to health
• Regulation (EC) No 851/2004 establishing the European Centre for Disease Prevention and Control
• Regulation (EU) 2022/2370 amending Regulation 851/2004 and strengthening ECDC’s mandate

International

• World Health Organization, International Health Regulations (2005), as amended (2024 amendments in force 19 September 2025 for most States Parties)

Questions & Answers

Related One Health Security analysis

This piece anchors our Law & Institutions pathway and is the legal companion to Separate Systems, Shared Outbreaks (how the UK and EU cooperate on surveillance), Outside the System, Inside the Risk (the animal-health side) and The EU Animal Health Law. It also sets up the global layer — the International Health Regulations and the emerging WHO pandemic instruments — that the next analyses take up.