EUDAMED Mandatory 2026: Compliance Guide for MedTech

EUDAMED became mandatory on 28 May 2026, when the first four modules (Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance) came into force under Regulation (EU) 2024/1860. Any new MDR or IVDR device must now hold a valid Single Registration Number (SRN) and be registered in EUDAMED before it is placed on the EU market. Legacy devices still in active distribution must be registered by late November 2026.

What is EUDAMED, and what are its six modules?

The European Database on Medical Devices (EUDAMED) is a centralized platform designed to increase transparency, improve traceability, and enhance patient safety across the EU. It acts as a single secure digital hub where manufacturers, authorized representatives, importers, notified bodies, and national competent authorities share regulatory data.

EUDAMED is built around six interconnected, dedicated modules:

1. Actor Registration: Registers organizations (manufacturers, authorized representatives, and importers) and assigns unique Single Registration Numbers (SRNs).
2. UDI and Device Registration: Captures essential product attributes and maps physical device labels to unique identifiers for complete supply chain transparency.
3. Notified Bodies and Certificates: Centralizes certificates issued under Medical Device Regulation (MDR) and In Vitro Diagnostics Regulation (IVDR), making the scope and validity traceable.
4. Clinical Investigations and Performance Studies: Tracks clinical trial approvals, study protocols, and performance evaluations.
5. Vigilance and Post-Market Surveillance: Manages reports of serious adverse events, incident logs, and Field Safety Corrective Actions.
6. Market Surveillance: Allows competent authorities to share inspection findings, coordinate control activities, and post non-compliance alerts.

How the gradual EUDAMED rollout works under Regulation (EU) 2024/1860

To accelerate compliance and transparency, the EU enacted Regulation (EU) 2024/1860, introducing a gradual, module-by-module rollout. Under this framework, modules become legally binding individually as they pass audit:

• Audit and Functional Notice: Once a module is ready, the European Commission audits it and publishes a notice of full functionality in the Official Journal of the European Union (OJEU).
• The Transition Countdown: The OJEU publication triggers a strict six-month transition timeline.
• Mandatory Cut-off: At the end of the six months, voluntary use ends, and the module becomes legally mandatory, replacing alternative national systems.

On November 27, 2025, the Commission published Decision (EU) 2025/2371, declaring the first four modules (Actor, UDI/Device, Notified Bodies, and Market Surveillance) functional. This triggered the countdown to the May 28, 2026 mandatory enforcement date. The remaining modules (Vigilance and Clinical Investigations) will follow a separate timeline, with Vigilance expected to become mandatory later (target dates stretching into 2027).

EUDAMED deadlines in 2026: who made the May 28 cut-off

The May 28, 2026 milestone established immediate market entry requirements. Any new medical device certified under the MDR or IVDR must be registered in EUDAMED before it can be legally placed on the EU market. However, Regulation (EU) 2024/1860 established distinct grace periods for legacy portfolios:

What is breaking since the EUDAMED mandate took effect

Real-world feedback reveals the following major technical and administrative failure points:

• “No Registration, No Trade” Enforcement: Supply chain partners (like importers and distributors) are legally freezing or rejecting shipments if a product lacks a valid Single Registration Number (SRN) or Basic UDI-DI in the European Commission EUDAMED dashboard.
• Intense Data Governance Pressure: Many medical device companies realized compliance is not just an IT task. They spent recent weeks scrambling to clean up massive backlogs of UDI data, ensuring that database entries perfectly align with technical documentation and Notified Body certificates.
• Accelerated Timelines for Legacy Devices: Manufacturers are facing an aggressive rush to upload legacy and regulation devices before the rapidly approaching November 2026 deadline.

Missed the deadline? What to do now

If your organization missed the May 28th deadline, you are completely prohibited from launching any new medical devices on the EU market. You must execute a prioritized recovery plan immediately to restore market access:

• Submit Complete Actor Data: If you haven’t yet, file an actor registration request. Incomplete or incorrect information is the number one cause of SRN issuance delays. Submit all required qualifications, certificates, and organization details to your Competent Authority correctly the first time.
• Appoint LAAs Quickly: Assign at least two Local Actor Administrators (LAAs) as soon as your SRN is issued. The UDI/Device module will not activate for device registration until this requirement is met.
• Compile UDI/Device Information: Gather all Basic UDI-DIs, catalog numbers, risk classes, and applicable notified body certificates. Because Notified Bodies face a queue for processing, having perfectly mapped data ready to upload speeds up the process.
• Engage Your EU Authorized Representative: If you are a non-EU manufacturer, ensure your EU Authorized Representative (AR) is actively managing your EUDAMED submission process.

The next big milestone: prepare for November 28, 2026

If you are a manufacturer with existing devices on the market, your runway is rapidly shrinking. While the May 28 deadline applied to new MDR/IVDR devices, a critical second milestone is looming:

• The Legacy Device Deadline: By November 28, 2026, all “legacy devices” (devices that were placed on the market before May 28, 2026, but continue to be sold) must be fully registered in EUDAMED.
• The Impending Volume Bottleneck: Thousands of manufacturers managing broad portfolios are delaying registration, meaning a massive influx of submissions will hit EUDAMED’s servers later this year. Waiting until the last minute risks system lag, support desk backlogs, and delayed approvals from overwhelmed Competent Authorities and Notified Bodies.

Compliance with a compliant AS4 software

As portfolio sizes scale, relying on EUDAMED’s manual web interface to input hundreds of attributes per device is a recipe for operational failure. It is highly time-consuming, prone to typing errors, and highly vulnerable to backend system rejections.

For high-volume data exchange, the European Commission mandates the use of the AS4 (Applicability Statement 4) secure communication protocol over valid Access Points for automated Machine-to-Machine (M2M) integration.

M2M submissions must navigate a complex, two-tiered validation architecture:

1. XML Schema (XSD) Validation: Ensuring the file is syntactically correct according to the Commission’s technical specifications.
2. Backend Business Rules: Evaluating the data against hundreds of conditional dependencies (e.g., verifying that the selected risk class matches the corresponding conformity assessment procedure).

EUDAMED compliance FAQ

Is EUDAMED mandatory now?

Yes. The first four EUDAMED modules (Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance) became mandatory on 28 May 2026 under Regulation (EU) 2024/1860. Any new MDR or IVDR device must be registered in EUDAMED before it is placed on the EU market. The Vigilance and Clinical Investigations modules follow a separate timeline expected in 2027.

What is the EUDAMED deadline for legacy devices?

Legacy devices placed on the market before 28 May 2026 that continue to be sold must complete UDI/device registration in EUDAMED by late November 2026 (confirm the exact date against the European Commission’s guidance). A single registration covers all units sharing the same UDI-DI, so grouping under the correct Basic UDI-DI matters.

What happens if I miss the EUDAMED registration deadline?

Without a valid Single Registration Number and Basic UDI-DI, you cannot legally place new devices on the EU market, and supply-chain partners may freeze or reject shipments. Recovery means filing complete actor data, appointing at least two Local Actor Administrators, and preparing accurately mapped device data for upload.

Do I need AS4 for EUDAMED?

For high-volume submissions, yes in practice. The European Commission mandates the AS4 protocol over valid Access Points for automated machine-to-machine exchange with EUDAMED. Manual web entry is viable only for small portfolios; larger portfolios rely on compliant AS4 software to avoid manual errors and backend rejections.

Does EUDAMED apply to IVDs as well as medical devices?

Yes. EUDAMED obligations apply to both medical devices under the MDR and in vitro diagnostic devices under the IVDR.

Simplify EUDAMED compliance with Aayu’s AS4

To meet these standards, using compliant, automated AS4 software is a strategic necessity. Aayu Technologies provides a fully compliant AS4 software solution designed specifically to streamline and automate your EUDAMED submissions. Our platform handles the complex cryptographic digital handshakes, manages certificate lifecycles, and most importantly runs your datasets through an integrated pre-validation engine. By programmatically catching XSD discrepancies and business rule violations before submission, our software eliminates rejections and ensures a seamless transition into mandatory compliance.

For organizations looking to connect to EUDAMED or evaluate AS4 support, we welcome the conversation.

Contact the Aayu team to discuss your specific requirements.