EUDAMED Readiness: Why Registrations Fail in Practice

In many companies, EUDAMED is still treated as an IT project: a portal you load data into once the deadline draws near. That framing is the heart of the problem. The European Database on Medical Devices (EUDAMED) is not an upload tool but the prescribed reporting channel for regulatory obligations that exist regardless. Since May 28, 2026, use of the first four modules has been mandatory: actors, UDI and devices, notified bodies and certificates, and market surveillance. New devices must be registered before being placed on the market, legacy devices by November 28, 2026, and certificates issued earlier by May 28, 2027. Anyone without that registration does not fail on the technology; they fail on the deadline.

EUDAMED Is Mandatory, Not Optional

The legal basis is set out in Art. 33 of Regulation (EU) 2017/745 (MDR) for medical devices and in Art. 30 of Regulation (EU) 2017/746 (IVDR) for in vitro diagnostics. EUDAMED comprises six modules: actor registration, UDI and device registration, notified bodies and certificates, clinical investigations, performance studies, and vigilance and post-market surveillance.

The phased mandatory use of these modules was triggered by Regulation (EU) 2024/1860: a module becomes mandatory once the Commission formally confirms that it is functional, followed by a six-month transition period. For the first four modules that has happened; the decision of November 26, 2025, was published in the Official Journal on November 27, 2025, and the obligation has applied since May 28, 2026.

One distinction matters for planning: so far, the mandatory modules are actors, UDI and devices, notified bodies and certificates, and market surveillance. The market surveillance module serves coordination between authorities, not manufacturer reporting. The vigilance and clinical investigation modules are not yet mandatory; confirmation of their functionality is still pending and, on the Commission's roadmap, they follow after 2026. Until then, incident and FSCA reports continue through the existing national channels.

Actor registration is the prerequisite for every further activity in EUDAMED. Without it, a company simply does not exist in the database, and no UDI and no report can be submitted.

The obligations apply to manufacturers, authorised representatives and importers in the medical device and IVD domains. For IVD, the risk class is additionally relevant: the IVDR staggers the transition periods by class, so full applicability takes effect at different points in time depending on the device. This is precisely where the first misjudgements arise, because companies with a mixed portfolio assume that a single deadline applies to everything.

Four Clusters Where Registrations Get Stuck

In implementation projects, we encounter the same four patterns, almost regardless of company size.

• Incomplete actor registration. Without a valid Single Registration Number (SRN) under Art. 31 MDR, nothing moves forward. The EORI number or consistent commercial register data are often missing, which blocks the application. Manufacturers based outside the EU additionally require an authorised representative with their own SRN under Art. 11 MDR. If this constellation is not cleanly set up, the entire project stalls before it has begun.

• Inconsistent UDI data. Basic UDI-DI and UDI-DI are confused or assigned incorrectly. Device changes, new pack sizes or software versions are not updated promptly, so the EUDAMED entry no longer reflects the actual version on the market. UDI assignment runs through designated issuing entities such as GS1, HIBCC or ICCBBA (Implementing Decision (EU) 2019/939). During an inspection, any discrepancy between labeling, certificate scope and database entry is treated as a documentation deficiency, not a trivial matter.

• Vigilance workflow without a switchover plan. Many manufacturers still report serious incidents and field safety corrective actions (FSCA) under Art. 87 MDR to the national authorities by email, and right now that is the correct route: the vigilance module is not yet mandatory. The mistake sits elsewhere. Once functionality is confirmed, exactly six months remain, and the short reporting deadlines of Art. 87 continue to apply unchanged. If you start actor and UDI registration only inside that window, you cannot report through the channel that will then be prescribed, even though the vigilance team is perfectly able to handle the substance. MDCG 2023-3 sets out the relevant terms and concepts.

• PMS documentation not upload-ready. The PSUR for Class III and implantable devices will be submitted to the notified body through EUDAMED under Art. 86(2) MDR once the corresponding module becomes mandatory; for the other classes it is only made available to the notified body (para. 3), and the PMSR for Class I under Art. 85 MDR goes to the competent authority only upon request. Reports that are strong on content are nonetheless often incompatible, because their structure and format do not meet the database's requirements. The rework takes more time than expected, especially where there is no interface to the eQMS and everything has to be transferred manually.

Why Mistaking It for an IT Project Becomes Costly

Treating EUDAMED as a pure data problem means scheduling it wrong. The central sticking point is rarely the upload itself but data quality: the consistency between the Basic UDI-DI, device labeling and the scope of the certificates. Establishing this consistency is regulatory work and requires lead time, because it calls for coordination with the notified body, with quality management and, in part, with suppliers.

There is also the ongoing nature of the obligation. EUDAMED is not a one-off project with a completion date. Device changes, vigilance reports and reporting cycles must be maintained continuously. Where a clearly assigned responsibility is missing, gaps form in exactly those places, surfacing at the next inspection. With larger portfolios, the problem intensifies, because manual duplicate maintenance without an eQMS interface is not only time-consuming but error-prone.

What to Do Now

A sensible approach is a module-by-module gap analysis prioritized by the time remaining. In concrete terms, this means:

• SRN first. Secure actor registration under Art. 31 MDR and, for non-EU manufacturers, verify the authorised representative constellation under Art. 11 MDR. Everything else builds on this.
• Clean up UDI data. Map Basic UDI-DI to UDI-DI, reconcile against labeling and certificate scope under Art. 27 and Art. 29 MDR, then carry out a structured migration.
• Schedule the legacy devices. For devices already on the market before May 28, 2026, the registration deadline of November 28, 2026, applies only if they continue to be placed on the market from that date (Art. 123(3)(e) MDR), and certificates issued before that date are due on May 28, 2027. One planning detail matters: the upload is done by the notified body, and its window closes a day earlier, on May 27, 2027. If you ask in late May, you depend on a deadline you do not control. Both are hard dates with portfolio-scale effort behind them, not formalities.
• Prepare vigilance and PMS instead of waiting. Set up the SOPs for incident and FSCA reporting so that moving to EUDAMED reporting under Art. 87 MDR stays a change of channel rather than a project. Check the PSUR for Class III and implantable devices under Art. 86 MDR for upload compatibility before the module becomes mandatory.

Entourage supports manufacturers, authorised representatives and importers in medical devices and IVD across all six modules, from the SRN to the vigilance workflow. The starting point is usually a gap analysis that records the status per module and derives a realistic sequence toward being able to meet the reporting obligations, with the two open deadlines of November 28, 2026, and May 28, 2027, as the fixed points. Where the parallel obligations of the IVDR apply, the same actor, UDI and vigilance logic holds, with Art. 30 IVDR as the EUDAMED legal basis for in vitro diagnostics.

Image notice: The images in this article were generated using artificial intelligence. They do not depict real people, places, or events.