EUDAMED Is Now Mandatory: The Four Live Modules, the Deadlines and What Is Still Missing

EUDAMED stopped being voluntary on 28 May 2026. Four of its six modules are now mandatory, and the deadline that matters most for anyone selling existing devices in the EU falls at the end of November 2026 — roughly a month away at the time of writing.

For a system that spent five years in voluntary limbo, the switch has been quiet. Many manufacturers registered in the Actor module years ago and assume that is the extent of it. It is not.

How the switch happened

Rather than wait for all six modules to be finished, Regulation (EU) 2024/1860 amended both the Medical Device Regulation (EU) 2017/745 and the IVD Regulation (EU) 2017/746 to allow EUDAMED modules to be released as each is verified as functional.

The Commission then used that mechanism. Commission Decision (EU) 2025/2371, published in the Official Journal on 27 November 2025, declared four modules functional and started a six-month transition, which expired on 28 May 2026. From that date the relevant EUDAMED obligations under the MDR and IVDR apply in full to economic operators, notified bodies and competent authorities.

The four modules that are live

• Actor registration (ACT) — Article 1(a). Registration of economic operators. Available voluntarily since December 2020.
• UDI/Device registration (UDI/DEV) — Article 1(b). The UDI database and device registration, covering diagnostics as well as devices. Available voluntarily since October 2021.
• Notified bodies and certificates (NB/CRF) — Article 1(c). Available voluntarily since October 2021.
• Market surveillance (MSU) — Article 1(d). Never available voluntarily, and access is restricted to competent authorities and notified bodies.

What is still missing, and why it matters

Two modules remain under development: Vigilance (VGL) and Clinical Investigations and Performance Studies (CI/PS). Until they are declared functional, economic operators continue to use national processes for vigilance reporting and for clinical investigation submissions.

This is the part most likely to cause an error of assumption. EUDAMED going live does not centralise vigilance. A manufacturer that stops filing through national competent authority routes because “EUDAMED is mandatory now” will miss reporting obligations entirely.

The deadlines, in order

Actor module — 28 May 2026. Manufacturers and authorised representatives were required to be registered by this date. There is a practical consequence attached: before submitting any post-market surveillance or vigilance report, the manufacturer and the authorised representative must be registered in the Actor module.

New devices — from 28 May 2026, before first placement. New MDR and IVDR-compliant devices, and system and procedure packs, placed on the market from that date must be registered in the UDI/Device module before the first unit is placed on the EU market. Custom-made devices, investigational devices and performance study devices are excluded.

Legacy devices — end of November 2026. Devices placed on the market before 28 May 2026 that are still being sold afterwards must be registered in the UDI/Device module twelve months after publication in the Official Journal. One registration covers all units sharing a UDI-DI.

Notified body certificates — 28 May 2027. Certificates issued before the module became mandatory must be registered within eighteen months of OJEU publication. Only the latest certificate version and the most recent related notified body decision need registering. Certificates issued after the module became mandatory must be registered immediately.

Devices no longer sold. Devices with no units placed on the market after 28 May 2026 do not need UDI/Device registration — unless a post-market surveillance or vigilance action is initiated, in which case registration will be required once the Vigilance module becomes mandatory.

One date to check carefully

On the legacy-device deadline, published commentary differs by a single day: some sources give 27 November 2026 (twelve months from OJEU publication on 27 November 2025) and others give 28 November 2026. The discrepancy is immaterial to planning but not to a filing made on the day itself.

Anyone relying on the final week should work to the earlier date and verify against Commission Decision (EU) 2025/2371 directly rather than against a summary. More sensibly, a registration exercise covering a full legacy portfolio should not be landing in the last seventy-two hours in any case.

These are gates, not parallel tasks

The sequencing is worth drawing out, because it changes how the work should be planned. Actor registration is not simply the first item on a list — it is a precondition for post-market surveillance and vigilance submissions, so an unregistered or out-of-date Actor record blocks a regulatory filing the manufacturer may be legally obliged to make. Similarly, UDI/Device registration is a precondition for placing a new device on the market at all, not a follow-up administrative step after launch.

A plan that treats these as four workstreams running in parallel misses that two of them are blocking dependencies. The order is: Actor record current, then device data prepared to the functional specifications, then registration, then placement — and separately, Actor record current before any vigilance report leaves the building.

The module you cannot see

Market surveillance is the one module that was never available voluntarily and to which economic operators have no access. That asymmetry has a practical implication: competent authorities and notified bodies will be working from a consolidated European view of your devices and certificates that you cannot inspect.

The only lever a manufacturer has over what sits in that view is the accuracy of what it puts into the modules it can see. Inconsistencies between a UDI/Device record and the technical documentation, or between a certificate record and the device registration, become visible to a regulator on a single screen. Data quality stops being an internal housekeeping matter and becomes the face the company presents to every authority in the Union simultaneously.

Who actually has to do the work

The obligations sit with manufacturers and authorised representatives. They must register their organisations in the Actor module and prepare device data to EUDAMED’s functional specifications before launching new products. Notified bodies register certificates in the NB/Certificates module.

For non-EU manufacturers the practical point is dependency: the registration path runs through EU-based authorised representatives and importers, so the quality of that relationship determines whether deadlines are met. A manufacturer outside the EU cannot discharge these obligations unilaterally.

Before 28 May 2026, the pre-MDR and pre-IVDR directive registration provisions continued to apply, which was the mechanism preventing double registration during the transition.

Why this is a competence problem as much as a data one

EUDAMED registration looks like a data-entry exercise and is usually resourced as one. It is not. The data submitted has to be consistent with the technical documentation, the UDI assignment has to be right, and the person doing it has to understand what a UDI-DI groups together and what requires a separate registration.

That competence obligation has a named owner. Under MDR Article 15 every manufacturer must have a Person Responsible for Regulatory Compliance, with defined qualification routes and statutory duties covering registration and technical documentation — set out in our guide to the PRRC under MDR Article 15. EUDAMED is one of the places where that role becomes visible, because an incorrect registration is traceable to a person with a defined responsibility.

The surrounding quality-system expectations point the same way. The FDA’s Quality Management System Regulation, in force since February 2026, adopted ISO 13485 clause 6.2 and its requirement for competence checks proportionate to the risk of the work — covered in our guide to the QMSR and ISO 13485 competence requirements. Data integrity expectations require reviewers who can actually interrogate a record rather than approve it, as set out in our guide to data integrity training and MHRA GxP expectations.

What to do this month

Confirm the organisation is registered in the Actor module and that the registration details are current, because PMS and vigilance submissions depend on it. Produce a list of every device still being sold that was on the market before 28 May 2026, and confirm each has a UDI/Device registration or a scheduled one before the end of November. Check which registrations are covered by a shared UDI-DI so the exercise is not duplicated. Confirm with your notified body which certificates it is registering and when, against the May 2027 date. And keep national vigilance and clinical investigation routes running until the VGL and CI/PS modules are declared functional.

For the wider regulatory picture on devices and software, our guide to AI software as a medical device covers the classification questions that determine whether something needs registering at all, and our guide to draft EU GMP Annex 22 covers the parallel direction of travel on AI in regulated manufacturing.