EUDAMED Is in Force. How Is Your Data Holding Up?

By Annette Horman, Principal Consultant QARA

EUDAMED's first four modules have been mandatory since May 28, 2026. For many manufacturers, the first registrations are done and the immediate pressure has eased.

But the work isn't finished. Devices already on the EU market have a registration deadline of November 28, 2026. The Post-Market Surveillance and Vigilance module is expected to follow, with no voluntary trial period before it becomes mandatory. And every record already submitted now sits in a database that regulators, healthcare professionals and the public can see.

So this is a good moment to step back and ask: is the data you've put into EUDAMED complete, consistent, and controlled? And is your organization set up for what comes next?

Quick answer: where do things stand?

• Mandatory since May 28, 2026: Actor Registration, UDI and Device Registration, Notified Bodies and Certificates, and Market Surveillance.

• Next deadline, November 28, 2026: registration of certain legacy and Regulation devices first placed on the market before mandatory use began.
• May 28, 2027: registration deadline for certain MDR and IVDR certificates issued before May 28, 2026.
• Coming next: the Post-Market Surveillance and Vigilance module. Emergo by UL reports it is in audit, with Official Journal publication anticipated in Q4 2026 and mandatory use six months after that. The Clinical Investigations and Performance Studies module has no publication date yet.
• Regulatory information management databases
• Quality management systems
• Product lifecycle management (PLM) systems
• ERP and supply-chain platforms
• Labeling and packaging systems
• Notified-body certificate repositories
• Clinical and post-market surveillance systems
• Public-facing information is accurate and current.
• Confidential or commercially sensitive information hasn't been entered into the wrong field.
• Device and certificate statuses remain aligned.
• Changes go through document-control review and approval.
• Regulatory, quality, legal and communications teams agree on who owns public information.
• Confirm your EUDAMED actor roles and verify that your SRN, legal-entity, address and authorized-representative information is correct.
• Confirm the right people have system access and clearly defined responsibilities.
• Inventory devices, systems and procedure packs on the EU market, or planned for it.
• Identify legacy devices and products with uncertain registration status.
• Determine which transitional deadlines apply to each part of the portfolio, and flag anything that falls inside your implementation window.
• Reconcile Basic UDI-DI, UDI-DI, device, certificate and manufacturer records across internal systems.
• Validate EMDN classifications.
• Build a controlled device-to-UDI-to-certificate-to-notified-body mapping.
• Review public-facing records for accuracy and approval.
• Establish document-controlled processes for changes to company, authorized-representative, device and certificate information.
• Test internal data-extraction, review and submission workflows.
• Create escalation and evidence-retention procedures for system outages or access problems.
• Assign an accountable EUDAMED program owner, supported by Regulatory, Quality and IT.
• Maintain a controlled EUDAMED data dictionary.
• Establish approval workflows for creating and modifying records.
• Periodically reconcile EUDAMED against ERP, PLM, QMS and regulatory systems.
• Monitor European Commission notices, module releases and applicable transition dates.
• Prepare data ownership and reporting workflows for the Post-Market Surveillance and Vigilance module.
• For clinical investigation sponsors, plan for manual processes until automation is available.

Sources:

• European Commission — EUDAMED Overview
• European Commission — Mandatory Use of EUDAMED From May 28, 2026 (factsheet)
• European Commission — The EUDAMED four first modules will be mandatory to use as from 28 May 2026
• EUR-Lex — Regulation (EU) 2024/1860
• Emergo by UL — EAAR 2026: Key EU Regulatory Developments
• MedTech Europe — Ensuring a smooth implementation and use of the EUDAMED Clinical Investigation and Performance Studies module

A quick recap: who owns what in EUDAMED?

Even where a manufacturer isn't the primary user, its data feeds the record. A certificate entered by a notified body is only as good as the device and manufacturer information it links to.

Getting registered was step one. Keeping the data right is the real job

EUDAMED is becoming the EU-wide system of record for medical device lifecycle data. That shifts the compliance risk. It's no longer only about meeting a registration date. It's about whether what you submitted is accurate, and whether it stays accurate as products, certificates and organizations change.

That's harder than it sounds, because the same product information rarely lives in one place. It's typically spread across:

Each uses its own identifiers, naming conventions, product hierarchies and ownership rules. Many companies got through the May deadline with a push from Regulatory Affairs and a well-maintained spreadsheet. That works once. It doesn't hold up as a way to keep records current over years, across thousands of device variants, with every change publicly visible.

How are you doing? Five questions to ask now

1. Are your records consistent across systems?

Do your Basic UDI-DIs, UDI-DIs, European Medical Device Nomenclature (EMDN) codes, certificate data and economic-operator information match what's in your RIM, QMS, PLM and ERP systems? If you entered data into EUDAMED under deadline pressure, it's worth checking that it still reconciles with your internal sources of truth.

2. Is your legacy portfolio covered before November 28?

For large manufacturers, this can mean thousands of devices, variants, accessories, systems and procedure packs. It requires controlled mapping across products, Basic UDI-DIs, UDI-DIs, certificates, notified bodies and regulatory status, not just data entry. If any products still have uncertain registration status, they should be at the top of the list.

3. Who owns EUDAMED data end to end?

Regulatory Affairs may manage submissions, but Quality, IT, supply chain, legal, clinical operations and product teams each control part of the underlying data. If no one owns the whole picture, changes in one system won't make it into EUDAMED, and gaps fall between functions.

4. Would your public-facing records hold up to scrutiny?

EUDAMED is designed to make device information visible. Check that:

5. Are you ready for vigilance and clinical investigations?

The next modules will bring ongoing reporting workloads, not one-time registrations. The Commission has indicated they will be released when their use becomes mandatory, without a voluntary-use period first, so there won't be a practice window. For the Clinical Investigations and Performance Studies module, MedTech Europe has raised concerns about duplication and has called for stronger automation, machine-to-machine functionality and XML capabilities. Sponsors should plan for manual workflows until those exist.

A practical EUDAMED readiness roadmap

The roadmap below runs from Day 0, the day your organization kicks off its EUDAMED implementation effort. That might be a readiness review of records you've already submitted, a legacy-portfolio clean-up, or preparation for a new EU product launch. Wherever you start, map the regulatory deadlines that apply to your portfolio onto this plan and prioritize anything due soonest.

Day 0 to Day 30: confirm the foundations

Day 31 to Day 90: reconcile and control the data

Day 90 onward: ongoing governance

Launching a new device in the EU?

Devices first placed on the market after May 28, 2026, generally must be registered *before* placement on the market. For a new product, set Day 0 early enough in launch planning that registration is complete well ahead of the target EU launch date.

The strategic issue is bigger than any single deadline

EUDAMED will increasingly serve as the EU-wide reference point for medical device lifecycle information. Companies should assume that data accuracy, traceability, public visibility and timely regulatory reporting will all face growing scrutiny.

Organizations that treated May 28 as the finish line will find themselves rebuilding the same data foundations for each new module. Those that use this window to put disciplined, cross-functional data governance in place, spanning Regulatory Affairs, Quality, IT, supply chain, clinical operations, legal, master-data management and cybersecurity, will be far better positioned for everything that follows.

Make your EUDAMED data defensible

EUDAMED sits right where regulatory strategy, quality systems and clinical operations meet, which is exactly why gaps slip between teams. MEDIcept brings regulatory, quality and clinical expertise together in one team, with more than 600 regulatory submissions supported over 30+ years across Class I, II and III devices. We can help you check how your current EUDAMED records are holding up, close out legacy registrations, reconcile device and certificate data, and build governance that's ready for the vigilance module and beyond.

Compliance takes more than registration. It takes accurate, controlled and defensible data across the entire device lifecycle. Talk to our team about where your organization stands.

Frequently asked questions

Is EUDAMED mandatory now?

Yes. Four EUDAMED modules have been mandatory since May 28, 2026: Actor Registration, UDI and Device Registration, Notified Bodies and Certificates, and Market Surveillance.

What is the November 28, 2026 EUDAMED deadline?

It's the registration deadline for certain legacy and Regulation devices that were first placed on the EU market before mandatory use began on May 28, 2026.

When must existing MDR and IVDR certificates be registered?

Certain MDR and IVDR certificates issued before May 28, 2026, must be registered by May 28, 2027. New certificates issued after mandatory use began must be entered into EUDAMED.

When will the EUDAMED vigilance module become mandatory?

No date has been fixed. Emergo by UL reports that the Post-Market Surveillance and Vigilance module is in audit, with Official Journal publication anticipated in Q4 2026 and mandatory use six months after publication. The Commission has indicated there will be no voluntary-use period beforehand.

Do new devices need to be registered in EUDAMED before launch?

Devices first placed on the EU market after May 28, 2026, generally must be registered before they are placed on the market, so EUDAMED registration should be built into launch planning.

Who is responsible for EUDAMED data inside a manufacturer?

Regulatory Affairs often manages submissions, but the underlying data is usually owned across Quality, IT, supply chain, legal, clinical operations and product teams. An accountable EUDAMED program owner, supported by a controlled data dictionary and approval workflows, helps keep that data consistent.

About Annette Hormann

Annette Hormann is an experienced leader in Quality Assurance and Regulatory Affairs with 18+ years of developing and implementing successful outcomes for global companies. Although her area of expertise is QA/RA, she has an in-depth knowledge and understanding of Clinical Affairs.

She received a Master of Science in Quality Assurance and Regulatory Affairs, with an emphasis in Pharmaceutical Medicine, from Temple University in Fort Washington, PA.

About MEDIcept

MEDIcept is your integrated lifecycle partner, bringing regulatory, quality, clinical, and commercialization expertise together in one team to move medical technologies from concept to patients, faster and with confidence. With 30+ years supporting medical devices, 600+ regulatory submissions, and a clinical leadership bench with 125+ years of combined oncology and device experience across 25+ countries, we help reduce risk and keep critical programs moving. Because patients are waiting.