EUDAMED Mandatory (2026)

EUDAMED is the European database on medical devices established by the MDR and IVDR to centralize actor registration, device identification, certificate oversight, vigilance, clinical investigations, and market surveillance. After a prolonged voluntary phase, mandatory use now starts in 2026. The change is driven by Regulation (EU) 2024/1860, which entered into force on 9 July 2024 and fixes the rollout by tethering each module’s start date to a formal notice of full functionality in the EU Official Journal.

Practically, most economic operators will need to use the Actor, UDI/Device, Notified Body and Certificates, and Vigilance modules from the fourth quarter of 2026. The Clinical Investigations/Performance Studies and Market Surveillance modules will follow approximately six months later. This sequencing enables regulators and Notified Bodies to consolidate foundational data first, then activate research and surveillance workflows with consistent identifiers already in place.

For manufacturers and authorized representatives, the pivot from voluntary to mandatory is more than a systems change. It requires organizational readiness to govern master data, align certificate and device hierarchies, and respond to post‑market signals with documentation that stands public and regulatory scrutiny. For Notified Bodies, it standardizes certificate publication and surveillance transparency.

The legal architecture of EUDAMED rests primarily on Regulation (EU) 2017/745 (MDR) Articles 30–33 and Regulation (EU) 2017/746 (IVDR) Articles 27–30. These provisions establish the database’s objectives, define the data domains, and specify which parties must participate. Regulation (EU) 2024/1860 amends transitional and activation provisions so that each module’s mandatory use begins only after the Commission attests to full functionality in the Official Journal.

The scope covers manufacturers, authorized representatives, importers, and where relevant distributors, who must obtain a Single Registration Number (SRN) and maintain current data about their identity and devices. Notified Bodies must register and publish certificates and associated status changes, including suspensions and withdrawals, ensuring that conformity assessment outcomes are transparent and traceable. Sponsors of clinical investigations and performance studies, as well as competent authorities, also have defined responsibilities.

Applicability is product‑agnostic within the MDR and IVDR regimes. General medical devices, implantables, software, and in vitro diagnostics are all in scope. MDR and IVDR actors should prepare for module activation on the same legal footing, while recognizing that operational timing can differ across modules. Engagement with a notified-body remains critical, since certificates and surveillance outcomes in EUDAMED influence market access and public visibility.

Finally, EUDAMED obligations are integral to the broader MDR framework rather than optional add‑ons. Device identification, vigilance reporting, and investigational transparency were already legal duties; EUDAMED provides the harmonized infrastructure that makes those duties consistently auditable across the Union.

Actor registration is the gateway. Manufacturers, authorized representatives, importers, and Notified Bodies obtain their SRN and maintain organizational master data, including legal addresses, person responsible for regulatory compliance (PRRC) details, and contact channels. Timely updates are essential because the SRN anchors all subsequent device and certificate submissions.

In the UDI/Device module, manufacturers submit device identifiers and attributes in line with MDR Annex VI, including the Basic UDI‑DI, device UDI‑DIs, trade names, risk class, intended purpose, and packaging hierarchy. Accurate structuring of Basic UDI‑DI families, direct marking claims, and kit configurations is vital for downstream searchability and linkage. The module complements, and in the EU context supersedes, national device listings by centralizing the authoritative record of identifiers under UDI.

The Notified Body and Certificates module centralizes certificate metadata, validity periods, scope, and status changes. Notified Bodies upload certificate details and make them discoverable, which enables competent authorities and stakeholders to verify current conformity assessment outcomes against the public registry. Manufacturers must ensure their device entries are aligned with the certificate scope to avoid mismatches.

The Vigilance module supports serious incident reporting, field safety corrective actions, trend reporting, and periodic safety updates under MDR Articles 87–90. Sponsors and investigators use the Clinical Investigations/Performance Studies module to register studies, submit applications, and maintain status and results, consistent with iso-14155-clinical-investigation. Competent authorities coordinate in the Market Surveillance module to record inspections, non‑compliances, and enforcement measures. Together, these modules operationalize evidence generation and post-market-surveillance across the device lifecycle.

Regulation (EU) 2024/1860 creates a simple, legally durable trigger: a module becomes mandatory only once the Commission publishes an Official Journal notice stating the module is fully functional. This decouples activation from IT project planning and ties it to a formal legal act. The practical reading communicated to industry is that four modules—Actor, UDI/Device, Notified Body and Certificates, and Vigilance—will become mandatory in the fourth quarter of 2026, with Clinical Investigations/Performance Studies and Market Surveillance beginning about six months later.

Transitional provisions for placing devices on the market under legacy certificates, including those extended by MDR Regulation (EU) 2023/607, continue to apply. However, the arrival of mandatory EUDAMED does not nullify identification or vigilance obligations; rather, it provides the infrastructure to meet them uniformly. Manufacturers should therefore align their internal plans so that data and processes are ready to flow the day each module is legally switched on.

To avoid last‑minute rushes, treat the anticipated dates as hard planning anchors while monitoring Official Journal publications. Build contingency into validation and training plans, since activation sequences will be legal facts the day they are published, not negotiable timelines.

If your product portfolio relies on legacy pathways enabled by mdr-extension-regulation-2023-607, map those certificates and associated Basic UDI‑DI families to EUDAMED early. This prevents misalignment between certificate scope and public device records when the Notified Body and Device modules become mandatory.

Operationally, organizations start by obtaining an SRN in the Actor module. The SRN is your identifier for all downstream submissions, so ensure governance over legal entity details, roles, and administrators. Access management matters; define who drafts versus who validates submissions, and document procedures for role changes and delegation.

Next, structure device data so that Basic UDI‑DI families, device models, and packaging hierarchies are clear and stable. Align your external identifiers with issuing agency rules and your internal material masters. Mismatches at this layer create reconciliation problems when certificates, vigilance cases, and clinical studies need to reference the same device records.

For certificate visibility, coordinate with your Notified Body on naming conventions and scope statements to reduce downstream confusion. When vigilance events occur, build submissions that link the incident, corrective actions, and affected UDI‑DIs precisely. Timeliness and completeness are assessed by authorities, and public extracts increase reputational sensitivity.

Automation helps. Many organizations use machine‑to‑machine interfaces to pre‑validate payloads and synchronize status changes. Whether you submit via user interface or API, maintain a clear audit trail, retain evidence of review and approval, and align your templates with current guidance. Consistency across modules lowers the burden when competent authorities seek cross‑references.

High‑quality master data is the hinge that makes EUDAMED workable. The Basic UDI‑DI must correctly represent a device family, the device UDI‑DI must uniquely identify each model, and packaging hierarchies must be consistent across labels and submissions. Any drift between enterprise resource planning data, labeling, and EUDAMED entries will surface through vigilance and market surveillance activity.

Clarify the difference between static device identifiers and variable production identifiers early. Organizations that delineate batch, lot, and serial elements in their systems can generate reliable submissions and respond rapidly to incidents. If your product is direct‑marked or software, capture the specifics of how identifiers are applied and displayed.

Data governance must extend into post‑market processes. Periodic safety updates, trend analyses, and field safety notices must reference the same identifiers and intended purpose statements present in EUDAMED. This alignment improves signal detection quality and reduces the risk of rework when authorities request clarifications or public extracts prompt customer inquiries.

Use your quality system to institutionalize checks. Document responsibilities, second‑person review of submissions, and reconciliation with label files. Sustained quality hinges on training and auditability as much as on tooling, so embed controls within your procedures, not only within your IT layer.

Two common reference points help teams stay precise: the distinction between identifier types explained in udi-di-vs-udi-pi, and quality system practices framed in what-is-qms-quality-management-system. Robust trace data then supports lifecycle evidence and post-market-surveillance activities that authorities will evaluate within EUDAMED.

Missteps around EUDAMED typically stem from underestimating the precision required to keep identifiers, certificates, and vigilance records aligned. Because EUDAMED sits at the junction of labeling, regulatory, and quality processes, small inconsistencies propagate quickly into public records and authority queries.

Another source of error is treating the voluntary phase as indicative of the mandatory phase. Mandatory modules are legal obligations that start the day an Official Journal notice is published. Relying on ad hoc workarounds or manual reconciliations that worked during voluntary use is unlikely to scale under scrutiny.

• Assuming modules are voluntary until the entire system is declared complete, rather than tracking module‑specific Official Journal notices.
• Misaligning Basic UDI‑DI families with certificate scope, leading to device listings that do not match Notified Body attestations.
• Confusing static device identifiers with production identifiers, which undermines incident traceability and recall effectiveness.
• Publishing device data that diverges from labeling, creating discrepancies during inspections and market surveillance actions.
• Under‑coordinating with the Notified Body on certificate naming and scope, which later forces rework when certificates are public.
• Treating vigilance as a standalone activity instead of integrating it with risk management and device master data.

Teams that build a single source of truth for identifiers, labels, and certificates, and rehearse their vigilance submission workflows with realistic scenarios, minimize rework and protect timelines once the modules become mandatory. Precision upfront pays dividends when public transparency magnifies even small errors.

EUDAMED is the EU’s central platform for device transparency and oversight; it does not replace obligations in third‑country jurisdictions. For example, the United States maintains its own Global Unique Device Identification Database (GUDID). While identifier principles converge globally, submission formats, data dictionaries, and publication rules are jurisdiction‑specific. Organizations operating across regions must harmonize master data while meeting each authority’s technical specifications.

Within the EU ecosystem, EUDAMED complements legal duties embedded in the MDR and IVDR. The system provides the infrastructure to register actors and devices, publish certificates, and operationalize vigilance and study transparency. It also supports cooperation among competent authorities in market surveillance. Public extracts amplify the importance of accurate data and consistent narratives across regulatory dossiers and labeling.

Quality system standards and clinical investigation norms remain the backbone of compliance. ISO 13485 continues to shape organizational controls over documentation, training, and production, while ISO 14155 informs clinical investigation conduct and reporting that will be surfaced through the investigations module. EUDAMED exposes the outputs of those systems, making inconsistencies easier to spot.

Strategically, treat EUDAMED readiness as part of your broader EU regulatory planning. Preparation should align with dossier practices described in eu-medical-device-regulatory-readiness, anticipate interactions with health technology assessment timelines, and ensure that communication plans reflect the public nature of EUDAMED entries once modules switch on.

Treat the anticipated Q4 2026 activation as a hard milestone. Work backwards to build durable processes, validated data flows, and trained teams. The organizations that transition smoothly are those that resolve identifier architecture and certificate alignment early, then practice end‑to‑end submissions before the legal switch is flipped.

Establish executive sponsorship and cross‑functional governance that includes regulatory affairs, labeling, IT, and quality. Map your product portfolio to Basic UDI‑DI families and current certificates, including legacy devices, and resolve gaps now. Simultaneously, define access roles and backup approvers so that submissions are not delayed by personnel changes.

1. Secure your SRN and finalize role‑based access for submission, review, and approval.
2. Freeze identifier architecture (Basic UDI‑DI, UDI‑DI, packaging) and reconcile with labels and ERP records.
3. Align device families with certificate scope and naming conventions agreed with the Notified Body.
4. Build and validate submission payloads, then dry‑run end‑to‑end scenarios for each module.
5. Train staff on procedures, public transparency implications, and escalation paths for vigilance.
6. Stand up monitoring for Official Journal notices and maintain a cutover checklist for each module.

Pair this plan with dossier hygiene and document control habits so that what you publish externally mirrors what auditors will see internally. Guidance in eu-medical-device-regulatory-readiness is a useful companion for process depth, while technical documentation alignment benefits from the discipline common to EU submissions work.

EUDAMED readiness is fundamentally a data governance and process orchestration challenge. The smoothest transitions blend controlled master data, auditable review and approval, and reliable machine‑to‑machine automation. V5 Ultimate’s capabilities are designed to connect those dots without creating parallel, manual work for regulatory teams.

Our quality and manufacturing platforms centralize master data for device families, packaging hierarchies, and certificates, then propagate approved changes downstream to labels and production records. That means Basic UDI‑DI and UDI‑DI structures in your system mirror what you publish, and vigilance submissions can reference the exact identifiers used in batch documentation. Configurable workflows enforce review by regulatory and quality before anything leaves your four walls.

Integration‑ready connectors and audit trails support both user interface submissions and API payloads. Role‑based access, version control, and timestamped approvals make it straightforward to demonstrate who created, who reviewed, and who released each dataset. Notifications can be tuned to alert teams when Official Journal notices land or when certificate data changes require synchronized updates to device entries.