EUDAMED’s Compliance Moment Has Arrived

The Date Companies Should Actually Circle

The date many companies keep repeating,  May 26, 2026, is not the operative trigger for the first EUDAMED obligations. The date that now matters is May 28, 2026. That is the day the first four modules of EUDAMED become mandatory after the six-month transition period triggered by the publication, on November 27, 2025, of Commission Decision (EU) 2025/2371. From that date, the mandatory modules are Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance. The two remaining modules, Vigilance/Post-Market Surveillance and Clinical Investigations/Performance Studies, are still under development and will become mandatory only after separate functionality notices are issued.  

This is not a surprise ambush. The Actor module has been available on a voluntary basis since December 2020, and the UDI/Device and Notified Bodies/Certificates modules since October 2021. EUDAMED was built to give regulators, economic operators, and the public a live picture of medical devices on the EU market, improve traceability, and help authorities monitor availability. The fact that the European Commission is running dedicated onboarding webinars on April 28, May 5, and May 7, 2026, shows that the system is no longer theoretical. It is in its final implementation phase.  

Why This Deadline Has Real Force

The reason this date matters is simple: EUDAMED is no longer just a useful portal. It is becoming the legally required route for the obligations tied to those four modules. Actor registration is the gateway. Manufacturers, authorised representatives, importers, and system or procedure pack producers must register before placing covered products on the EU market, and the Single Registration Number is issued only after validation by the responsible national competent authority. For non-EU manufacturers, an active authorised representative and a mandate summary document are part of the registration package.  

Device registration is equally unforgiving. For MDR- or IVDR-compliant devices whose first unit is placed on the EU market on or after May 28, 2026, the UDI/device record must be in EUDAMED before that first unit is placed on the market. For legacy devices, and for Regulation devices already on the market before mandatory use but still supplied afterward, the deadline to complete registration is November 28, 2026. Notified bodies then have until May 28, 2027, to register relevant MDR/IVDR certificate information issued before the certificate module became mandatory.  

What Manufacturers Really Must Do

The practical burden for industry is concentrated in three places: actor data, device data, and certificate-linked data. That sounds manageable until a company looks at the details. The Actor workflow is not instant. A non-EU manufacturer needs a registered authorised representative, the request must be verified by that representative, and then the competent authority must approve the file before the organisation is genuinely “registered” and has an SRN. In other words, this is not a form you complete on Friday afternoon if you hope to ship on Monday.  

The device side is broader than many teams expect, because EUDAMED registration is not product-marketing copy pasted into a portal. It is structured regulatory data. The system works at the UDI-DI or EUDAMED ID level, not at the level of casual catalogue descriptions, and downstream certificate records depend on upstream records already existing in the database. The Commission notes that certain elements referenced in certificates, including the manufacturer, the authorised representative where applicable, and relevant Basic UDI-DIs, must already be present in EUDAMED. That means late actor cleanup can delay device registration, and late device data can slow certificate visibility.  

There is also an important nuance that companies should understand without using it as an excuse to delay. Not every historic SKU has to be rushed into the system. If no individual units of a legacy or Regulation device will be placed on the market after the UDI/Device module becomes mandatory, registration is generally not required, unless a later post-market surveillance or vigilance action makes registration necessary. That exception is helpful, but it also means manufacturers need a disciplined portfolio review now, not a blanket assumption later.  

The Practical Path from Spreadsheet to Submission

The cleanest response is to treat EUDAMED as a data-readiness project before treating it as an IT project. The official EUDAMED documentation recognises three routes for entering data:

• The user interface
• XML bulk upload/download through the interface
• Machine-to-machine data exchange

The Commission’s own user guide suggests the user interface for portfolios of up to 100 devices, XML bulk upload for about 100 to 1,000 devices, and M2M for more than 1,000 devices.  

That is why a template-led process makes sense. A manufacturer can begin with a controlled intake file that gathers the exact fields needed for actor and UDI/device records, standardises identifiers and naming conventions, and exposes missing information early. Once the dataset is validated, it can be converted into the XML format EUDAMED accepts for bulk upload. The Commission’s own technical guidance warns that this is not trivial: XML packages must respect XSD structures, business rules, field sizes, tag positions, and mandatory-versus-optional logic. Producing the XML automatically is explicitly recommended to reduce validation errors.  

For companies with large or frequently changing portfolios, M2M may be the better long-term answer. But M2M is not a simple switch. It requires the external system to convert data into EUDAMED’s XML format, connect through a dedicated CEF eDelivery access point, and use AS4-compliant secure communication. The onboarding package also includes technical documentation, XML samples, service definitions, and, where a third-party service provider is involved, a third-party agreement.  

Where Outside Support Can Make a Difference

This is the gap that external specialists can help close, particularly where internal regulatory and IT resources are stretched. In practical terms, that support may include structured templates, data remediation, XML preparation for batch upload, or coordination of a machine-to-machine setup with internal or third-party technical teams. The objective is straightforward: reduce friction in data quality and submission mechanics, without shifting the manufacturer’s legal responsibility for the accuracy of the data.

In that sense, an effective operating model is simple and repeatable. The manufacturer completes a controlled template, the dataset is checked and normalised, the information is converted into the XML structure EUDAMED requires, and the file is either bulk-uploaded or transmitted via an M2M channel where scale justifies it. This approach aligns with the official EUDAMED data-input architecture and addresses a common failure point in compliance programmes: poor source data encountering rigid validation rules.

What Happens if Companies Miss the Mark

The risk of non-compliance is more immediate than dramatic. Without actor registration and the relevant SRN, a company cannot lawfully place covered devices on the EU market. Without device registration, a new device that should be in the UDI/Device module cannot legally be placed on the market after mandatory use begins. And because the EUDAMED-linked obligations replace the old directive-based handoffs once the mandatory date hits, companies should not assume that parallel national alternatives will keep them safe. In practice, the likely consequences are delayed launches, portfolio bottlenecks, extra remediation work, and uncomfortable audit conversations rather than a single spectacular enforcement headline.  

That is the real story here. EUDAMED spent years in the category of “not yet”, and the industry learned the wrong lesson from those delays. Now the calendar is fixed, the legal trigger has been published, the training sessions are underway, and the compliance clock is real. The manufacturers that move calmly now, by scoping their portfolios, fixing their master data, and choosing the right upload route, will treat EUDAMED as a manageable operational transition. The ones that wait will discover, too late, that the hard part was never the portal. It was the data behind it.

Disclaimer. The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official policy or position of Test Labs Limited. The content provided is for informational purposes only and is not intended to constitute legal or professional advice. Test Labs assumes no responsibility for any errors or omissions in the content of this article, nor for any actions taken in reliance thereon.