EUDAMED Is Now Mandatory: Registration Deadlines, Modules, and What Your Notified Body Will Check

What EUDAMED is designed to do

The Eudamed database is the European Commission’s IT system developed to implement MDR and IVDR. Its purpose includes, among others:

• Facilitating traceability of devices and strengthening market surveillance
• Supporting compliance for economic operators and notified bodies
• Enabling competent authorities and the Commission to perform regulatory tasks
• Keeping the public adequately informed

The origins of Eudamed go back to an earlier European Commission decision (2010/227/EU), which already defined the database as a tool to reinforce market surveillance. The Commission emphasized that the European database for medical devices should improve oversight by providing competent authorities with rapid access to information on manufacturers and their authorized representatives, devices and certificates, and vigilance data. It was also intended to support the exchange of clinical investigation information and promote the consistent application of reporting obligations across EU medical device legislation.

For manufacturers, this means EUDAMED is part of the compliance infrastructure in Europe, similar to how organizations already manage vigilance, certificates, and UDI requirements today, but with more structure and connectivity.

After the publication of Commission Decision (EU) 2025/2371 of 26 November 2025, the first four modules become mandatory from 28 May 2026 onward.

These mandatory modules include:

- Actor Registration (voluntarily available since December 2020)

- UDI/Device Registration (voluntarily available since October 2021)

- Notified Bodies and Certificates (voluntarily available since October 2021, with certain functionalities such as the scrutiny mechanism and CECP becoming fully operational later)

- Market Surveillance

This transition marks the shift of the Eudamed database from voluntary engagement to legally required operational use for core regulatory activities under MDR and IVDR.

The two remaining modules, Vigilance and Post-Market Surveillance, and Clinical Investigations / Performance Studies, are still under development. Unlike the earlier modules, these are not expected to have a voluntary use phase before becoming mandatory. They will apply directly once formally declared functional.

For manufacturers, this means that preparation for the mandatory modules should already be embedded in operational processes, while monitoring further Commission publications regarding the remaining systems.

For teams building familiarity, EUDAMED “Playground” environment is also a useful way to test workflows and understand the system behavior without affecting production records.

If you need assistance using the database or have questions about the reporting process, a detailed guide is available in the EUDAMED Information Center.

The Two Deadlines That Actually Matter

Most manufacturers are aware of May 28, 2026. Fewer have fully addressed the second deadline.

May 28, 2026 for new devices

Any device placed on the EU market on or after this date must be registered in EUDAMED before the first unit is placed on the market. No registration, no legal market access.

November 27, 2026 for legacy and existing devices

Devices already on the market before May 28, 2026 (including legacy devices still trading under MDR/IVDR transitional provisions) must be registered in EUDAMED by this date. This applies even to devices operating under transition arrangements. Devices with no remaining sales units are exempt, unless a vigilance or post-market surveillance action is initiated. The practical implication: manufacturers with large portfolios have weeks, not months, to complete registrations that require accurate UDI-DI data, correct economic operator roles, and consistent certificate linkages. Poor data quality is the single most common obstacle, and it takes longer to fix than most teams expect.

It also helps to clarify terminology early, because the terms affect registration expectations:

• Regulation devices are placed on the market in conformity with MDR/IVDR
• Legacy devices are placed on the market under the MDD, and individual sales units may still be placed after MDR/IVDR dates of application
• Old devices are those where the last sales unit was placed before the MDR/IVDR dates of application

One operational detail in the Eudamed database that is easy to overlook is that “device” is interpreted differently depending on context:

• Under MDR/IVDR, “device” refers to each individual device (sales unit)
• In EUDAMED, it refers at the level of the device identifier (UDI-DI)

That distinction influences how manufacturers plan registrations and how they maintain product records over time.

What EUDAMED Means for Your Notified Body Relationship

EUDAMED does not only create obligations toward the European Commission and competent authorities. It also directly affects the working relationship between manufacturers and their Notified Body.

Certificate linkage: Basic UDI-DI ↔ certificate ↔ SSCP

Every MDR certificate issued after the mandatory date must be registered in EUDAMED. The linkage between your Basic UDI-DI, the certificate scope, and (where applicable) the Summary of Safety and Clinical Performance (SSCP) must be accurate and consistent. Errors at the Basic UDI-DI level propagate across the entire registration and can create discrepancies that surface during surveillance audits.

What DQS assessors verify during surveillance

During QMS surveillance audits and technical documentation reviews, assessors expect to see that EUDAMED data governance is part of the manufacturer's controlled processes, not a separate administrative task. Specifically, assessors look for:

- Evidence that EUDAMED updates are linked to your change control process

- Clear ownership of EUDAMED data fields within the QMS

- Consistency between EUDAMED entries and internal regulatory records (UDI, device status, certificate scope)

- Documented workflows for triggering EUDAMED updates following design changes, certificate amendments, or economic operator role changes 

The most common gaps we see

Manufacturers who treat EUDAMED as a one-time registration exercise (rather than an ongoing data governance responsibility) tend to accumulate inconsistencies between their internal records and what is registered in the database. These inconsistencies become visible during surveillance and can generate findings that delay certificate renewal or require corrective action. The practical takeaway: EUDAMED readiness is not an IT project. It is a quality system responsibility, and it will be treated as such during conformity assessment.

For medical devices placed on the market before the date of mandatory use, expectations can include:

• new sales units of the same UDI-DI
• manufacturer responsibility to demonstrate devices were placed on the market prior
• registration within 12 months from the publication of notice
• no duplicate registration needed
• no registration needed if legacy devices are no longer placed on the market—unless a vigilance action occurs

The practical takeaway is that readiness depends not only on entering information, but also on having controlled records and evidence that supports device status and timing.

Typical triggers for updates include:

• legal entity name changes, address updates, PRRC contact updates, or changes in economic operator roles
• design changes impacting UDI-DI, new SKUs/configurations, discontinuation or market withdrawal
• certificate issuance, amendment, suspension, withdrawal, or scope changes
• new vigilance cases, follow-up reports, status changes, or linked UDI corrections
• PMS report updates, PSUR submissions, PMCF activity updates, and revised risk–benefit conclusions

In practice, medical device manufacturers should plan for EUDAMED updates the same way they plan for other regulated maintenance activities: through clear ownership, defined workflows, and internal controls.

Practical Steps to Build Sustainable EUDAMED Compliance

EUDAMED readiness is manageable when built into existing processes. These steps apply whether you are completing initial registration or building long-term governance:

1. Complete actor registration before anything else
Your Single Registration Number (SRN) is the prerequisite for all other EUDAMED activity. Non-EU manufacturers must register through their EU Authorized Representative. Without  a valid SRN, you cannot legally place devices on the EU market.

2. Prioritize the November 27 deadline for existing devices
If you have devices already on the market, map your full portfolio against the registration requirements now. Identify which UDI-DIs need to be registered, which are exempt, and which require clarification on device status.

3. Establish a single source of truth for EUDAMED data
Define where required data attributes live and ensure that source drives EUDAMED entries, not the other way around.

4. Link EUDAMED updates to change control
Any design change, certificate amendment, economic operator change, or device status update that triggers a EUDAMED update should flow through your existing change control process. This creates the audit trail your Notified Body will expect.

5. Assign clear ownership
Define who owns each data field, who maintains it, and who approves changes. EUDAMED data governance without named owners is a QMS gap.

6. Test workflows in the EUDAMED Playground first
The EUDAMED Playground environment allows teams to test submissions without affecting production records. Use it before submitting real data, especially for complex device families or economic operator configurations.

7. Build periodic internal checks into your audit calendar
EUDAMED data accuracy should be verified on a scheduled basis, not only when a change occurs. Assessors will look for evidence that your process is implemented and maintained over time, not just set up once.