Understanding the EUDAMED system, meeting the deadlines and getting your data right.

The medical device regulatory landscape has shifted

For years, EUDAMED existed in the background. Manufacturers heard about it, watched the delays and treated it as a problem for another day.

That day is here. As of 28 May 2026, four EUDAMED modules are mandatory.

At Quality First International we have spent the past several months helping clients prepare for this exact moment. What we have seen across the industry is that many organisations treated EUDAMED as a distant concern and are now facing immediate compliance obligations with real consequences for EU market access.

Whether your organisation is already registered or still working through the process, this guide sets out what EUDAMED is, what it demands and the practical steps to take from here. It reflects what we advise our own clients, drawn from decades of regulatory experience across the EU, UK and international markets.

What is EUDAMED? The European Database on Medical Devices explained

EUDAMED stands for the European Database on Medical Devices. The European Commission built it to support the EU Medical Devices Regulation (MDR 2017/745) and the In Vitro Diagnostic Medical Devices Regulation (IVDR 2017/746).

Before EUDAMED, information about medical devices, the companies behind them, the certificates supporting them and the safety data connected to them was scattered across separate national databases in each EU Member State. There was no single, unified picture. EUDAMED changes that. It brings together device registration, company identification, certificate records, clinical investigation data, safety reporting and market surveillance into one interconnected system.

The goal is simple: make it possible for regulators, Notified Bodies and the public to see who is placing what on the market, whether it has been properly assessed and what happens to it after it reaches patients.

What triggered the mandatory deadline?

On 27 November 2025, the European Commission published Commission Decision (EU) 2025/2371 in the Official Journal of the European Union. This formally confirmed that four of the six EUDAMED modules meet the required functional specifications.

Under Regulation (EU) 2024/1860, that publication triggered an automatic six month transition period. Once the six months expire, the obligations connected to those modules apply in full.

The result: from 28 May 2026, four EUDAMED modules are mandatory for all relevant economic operators, Notified Bodies and Competent Authorities.

This is a legal obligation, not a recommendation. If a regulatory requirement falls under one of the four operational modules, it must now be fulfilled through EUDAMED. Previous national registration processes no longer satisfy these requirements.

What are the six EUDAMED modules and which are mandatory?

EUDAMED is built around six modules. Each one addresses a different part of the medical device lifecycle. Together, they create a connected record from the point a company enters the EU market through to ongoing safety monitoring.

We regularly walk clients through these modules in our consultations. Here is what each one does and why it matters.

Module 1: Actor Registration — your gateway to the system

This is where it all begins. Every economic operator that places medical devices or IVDs on the EU market must register as an "actor" and receive a Single Registration Number (SRN).

At QFI, we describe the SRN as the master key. It unlocks every other part of EUDAMED. Without it, a manufacturer cannot register devices, link certificates or interact with the system in any meaningful way.

The registration requirement applies to EU manufacturers, non EU manufacturers, Authorised Representatives, importers and system or procedure pack producers.

There are several practical realities that we consistently raise with clients:

One company, multiple roles. If your organisation operates as both a manufacturer and an importer, for example, you must submit a separate registration for each role. Each one generates its own SRN. Missing a registration means that role is non compliant.

Distributors are excluded. We see this misunderstanding regularly. Distributors do not have an actor role in EUDAMED and will not receive an SRN. This sometimes creates confusion in supply chain teams that expect to see their distribution network reflected in the system.

Non EU manufacturers face an additional step. To register in EUDAMED, a non EU manufacturer must have an active Authorised Representative already in place. The registration request must include a signed mandate summary document. Without this, the application cannot proceed.

Competent Authority approval is required. The SRN is not issued automatically. The relevant national Competent Authority must validate the registration. In our experience, processing times vary significantly between Member States. Leaving this to the last moment creates unnecessary risk.

Two administrators are the minimum. At least two Local Actor Administrators (LAAs) must be assigned to your organisation's EUDAMED account before the UDI/Device module becomes accessible. This is a system requirement that is easy to overlook.

Module 2: UDI/Device Registration — cataloguing your portfolio

Once your SRN is in place, the next step is registering your devices in the UDI/Device module. This is where the detailed product data lives.

Every medical device placed on the EU market must be recorded here using the Unique Device Identification system. The module captures information at two levels:

The Basic UDI DI sits at the "family" level. It groups devices that share the same intended purpose, risk classification and core design characteristics. Think of it as the regulatory anchor for a product family.

The UDI DI sits beneath it, identifying the specific product variant or packaging level. Every packaging tier and variant must be registered separately to ensure full traceability.

The data requirements are defined in Annex VI Part B of the MDR. Manufacturers must provide the device name, risk class, intended purpose, EMDN nomenclature code, conformity assessment route, certificate references, market countries and additional technical attributes. All of this must follow EUDAMED's controlled vocabularies and language specifications.

From our work with clients, we know that the biggest challenge here is not the system itself. It is the data preparation. Many manufacturers discover that their internal product records do not map cleanly to EUDAMED's required fields. Addressing this takes time and cross functional coordination.

Two deadlines govern device registration:

28 May 2026 for any device placed on the EU market from this date onwards must be registered in the UDI/Device module before it reaches the market.

28 November 2026 for legacy devices that were already on the market before 28 May 2026 (and are still being sold) must be registered by this date. This is twelve months from the November 2025 functionality notice.

For legacy devices that have not yet been assigned a UDI DI, EUDAMED generates substitute identifiers (a EUDAMED DI in place of the Basic UDI DI and a EUDAMED ID in place of the UDI DI) to keep the system functional.

Module 3: Notified Bodies and Certificates — connecting the evidence chain

This module records information about notified bodies designated under the MDR and IVDR, together with the certificates they issue, amend, suspend, withdraw or restrict.

Its purpose is to create a transparent and verifiable link between a device on the EU market, the certificate that supports its conformity assessment and the notified body that issued it.

There is an important dependency here that we always flag to clients: the system requires a manufacturer to register a device at the Basic UDI DI level before a Notified Body can upload the related certificate. The manufacturer must act first.

For devices that require Notified Body certification (anything above Class I under the MDR, or Class A under the IVDR), the device enters a "Submitted" state once registered. It remains in that state until the notified body confirms the data. Only then does the status move to "Registered" and appear on the public website.

The deadlines for this module are:

From 28 May 2026 for any newly issued MDR or IVDR certificate must be uploaded to EUDAMED immediately upon issuance.

By 28 May 2027 for notified bodies must complete the upload of all relevant information for existing legacy certificates. This is an eighteen month window from the November 2025 notice.

We advise clients to engage with their notified bodies early on this. Waiting for the Notified Body to act without confirming their readiness can delay the registration of your own devices.

Module 4: Market Surveillance — the regulator's window

This module is primarily a tool for national Competent Authorities. It supports the sharing of inspection findings, non compliance actions, restrictions and corrective measures across EU Member States.

Manufacturers do not interact with this module directly in most cases. However, it draws on the data held in the Actor, UDI/Device and Certificates modules. Incomplete or inaccurate registrations in those modules feed directly into the information regulators use when conducting surveillance.

In practical terms, this means that data quality in the other modules is not just a compliance matter. It shapes how your organisation appears to the regulators responsible for market oversight.

Module 5: Vigilance and Post Market Surveillance — not yet mandatory

This module is still in development. When it goes live, it will replace the current patchwork of national reporting systems with a single interface for serious incident reports, trend analyses and field safety corrective actions.

Under Regulation (EU) 2024/1860, this module will become mandatory six months after the Commission declares it functional. Unlike the first four modules, there will be no period of voluntary use beforehand. When the notice is published, the transition timeline begins immediately.

Until that happens, manufacturers must continue reporting through their existing national processes.

At QFI, we advise clients to begin reviewing their post market surveillance and vigilance procedures now. When this module goes live, the transition will be swift. Companies with well structured PMS processes will adapt far more easily than those still relying on informal or inconsistent reporting workflows.

Module 6: Clinical Investigations and Performance Studies — not yet mandatory

This module will centralise the management of clinical investigations (under the MDR) and performance studies (under the IVDR). It will handle submissions, substantial modifications, lifecycle reporting and summary information.

Like the Vigilance module, it remains in development. It will follow the same activation path: six months after the functionality notice, with no voluntary use period.

For manufacturers planning clinical investigations or performance studies in the near term, we recommend beginning to align internal procedures with anticipated EUDAMED requirements now. The Commission's published functional specifications provide a reasonable basis for preparation. Waiting until the module launches leaves no margin for adjustment.

Who must act and when?

The obligations created by EUDAMED apply across the medical device supply chain. At QFI, we work with manufacturers at every stage of this process, from initial actor registration through to ongoing data governance.

Here is a summary of the key deadlines:

• 28 May 2026

The four mandatory modules are now in effect. All economic operators must hold valid actor registrations with SRNs. Any device placed on the EU market from today must be registered in the UDI/Device module before market placement. Newly issued certificates must be uploaded by Notified bodies upon issuance.

• 28 November 2026 

 Legacy devices (those already on the EU market before 28 May 2026 and still being sold) must be registered in the UDI/Device module.

• 28 May 2027

Notified Bodies must complete the upload of all relevant legacy certificate information.

• Date to be confirmed

The Vigilance/PMS and Clinical Investigations/Performance Studies modules will become mandatory six months after their respective functionality notices. No voluntary use period will apply.

Getting your organisation ready: QFI's recommended approach on how to prepare for EUDAMED

Drawing on our experience advising medical device manufacturers through MDR and IVDR transitions, we recommend a structured five step approach to EUDAMED readiness.

1. Secure your Actor Registration and SRN

This is the non negotiable first step. Every other EUDAMED activity depends on it. If your organisation has not yet registered, treat this as the immediate priority. Allow time for Competent Authority processing and ensure your Authorised Representative arrangements are in place if you are a non EU manufacturer.

2. Audit and prepare your device data

EUDAMED requires structured, detailed product data that aligns with Annex VI Part B of the MDR. Before entering anything into the system, we recommend creating a single controlled data source that maps each EUDAMED field to your internal records.

This is where many manufacturers run into difficulty. Internal product databases were not designed with EUDAMED in mind. Gaps in device naming, classification, intended purpose descriptions and nomenclature codes need to be identified and resolved before data entry begins.

Consistency matters. The information in EUDAMED must match what appears in your technical documentation, your labelling and your instructions for use. Regulators and Notified bodies will cross reference these records. Any discrepancy is visible and creates audit risk.

3. Engage your Notified Body

The Certificates module creates a direct dependency between manufacturer and Notified Body. Your devices must be registered first. Your Notified Body uploads the certificate second. Confirm that your Notified Body understands this workflow and is prepared to act on their end.

4. Align your Quality Management System

EUDAMED is a regulatory obligation that sits across multiple business functions. Treating it as a standalone IT task is one of the most common mistakes we see.

Your QMS should clearly define who is responsible for EUDAMED data entry, review, maintenance and lifecycle updates. Processes for handling device modifications, certificate renewals, market withdrawals and recalls should all reference the corresponding EUDAMED actions.

5. Prepare for what is still to come

The Vigilance and Clinical Investigations modules will arrive without a voluntary familiarisation period. We advise clients to review their post market surveillance processes, vigilance reporting workflows and clinical investigation procedures against the Commission's published specifications now. Early alignment reduces disruption when these modules go live.

What are the most common EUDAMED compliance mistakes?

In our advisory work, certain EUDAMED preparation errors come up repeatedly:

• Assuming all six modules are mandatory at the same time. Only four modules are currently live. We have seen manufacturers divert resources into vigilance system redesigns while leaving their core actor and device registrations incomplete. Focus on what is mandatory today.

• Treating EUDAMED as a one off exercise. The database requires ongoing data maintenance. Devices are modified. Certificates are renewed or withdrawn. Markets expand. Keeping EUDAMED records current is a continuous obligation, not a task you complete once and set aside.

• Starting Competent Authority applications too late. SRN issuance requires Competent Authority validation. Processing times are not standardised across Member States. In some cases, approval takes weeks. Planning for this avoidable delay is essential.

• Allowing data to drift between systems. If the device description in EUDAMED does not match the description in your technical file, or if your labelling references a different intended purpose, regulators will notice. Data alignment across EUDAMED, your QMS, your technical documentation and your labelling is a compliance requirement, not a best practice suggestion.

• Overlooking legacy device timelines. The 28 November 2026 deadline for registering legacy devices is separate from the 28 May 2026 mandatory date. For manufacturers with large product portfolios, six months is a compressed timeline to audit, prepare and submit all required data.

How can QFI support with EUDAMED registration and compliance?

Quality First International has advised medical device manufacturers on European regulatory compliance since 1995. Our founder, Haroon Atchia, brings an MHRA background and serves as Honorary Lecturer at the University of Cambridge and member of the Editorial Advisory Board of the Journal of Medical Device Regulation.

We work with manufacturers ranging from early stage companies entering the EU market for the first time to established enterprises managing large device portfolios across multiple jurisdictions.

Our EUDAMED support covers:

• Actor registration guidance and SRN applications
• UDI strategy and device data preparation
• Notified Body coordination for certificate linkage
• QMS alignment for ongoing EUDAMED data governance
• Legacy device portfolio assessment and registration planning
• Preparation for the Vigilance and Clinical Investigations modules

Whether you are approaching EUDAMED for the first time or managing the transition of a legacy portfolio to meet the November 2026 deadline, QFI provides the regulatory expertise to keep your EU market access secure.

Contact QFI for expert guidance on EUDAMED compliance.

Email: enquiries@qualityfirstint.com 

Quality First International. Client First, Quality Assured.