EUDAMED Goes Mandatory May 28, 2026: A Practical Pre-Flight Checklist for MDEL Holders and EU Manufacturers

The countdown is real. On 28 May 2026, the first four modules of the European Database on Medical Devices (EUDAMED) become mandatory for medical device and IVD economic operators selling into the European Union. After more than five years of voluntary use, the European Commission has confirmed the trigger date through Commission Decision (EU) 2025/2371, published in the Official Journal of the EU on 27 November 2025.
For Canadian Medical Device Establishment Licence (MDEL) holders exporting to the EU and for EU manufacturers, authorized representatives, importers and distributors, this is the regulatory milestone that closes the door on paper-era processes. If your Actor record, UDI submissions, certificates, or post-market data are not in EUDAMED by the deadline, your devices cannot lawfully be placed on the EU market.
This guide walks through a practical, field-tested pre-flight checklist — what to register, in what order, how to avoid the most common rejections, and what an MDEL holder or EU manufacturer should already have completed by mid-May 2026. We close with a downloadable EUDAMED Readiness Scorecard structured around the four mandatory modules.

At a glance (TL;DR): Mandatory date — 28 May 2026. Mandatory modules — Actor registration, UDI/Device registration, Notified Bodies & Certificates, Market Surveillance. Legal basis — Regulation (EU) 2024/1860 amending MDR (2017/745) and IVDR (2017/746). Transition trigger — Commission Decision (EU) 2025/2371.

Why 28 May 2026 Is the Date That Matters

EUDAMED has been built as a six-module electronic system under Articles 33–34 of the EU Medical Device Regulation (MDR) and Articles 30–31 of the IVD Regulation (IVDR). Until 2024, the Commission planned to launch all six modules together once full functionality was independently audited.

Regulation (EU) 2024/1860, in force since July 2024, changed that approach. It amended the MDR and IVDR to allow a gradual rollout — modules can become legally binding as soon as each is independently audited and declared functional. This unlocked the path for the four ready modules to go live without waiting on the remaining two (Clinical Investigations & Performance Studies, and Vigilance).

The Commission published its functionality declaration in Commission Decision (EU) 2025/2371 on 26 November 2025. That decision started a six-month transition window — ending 28 May 2026 — after which use of all four declared modules is no longer optional.

Translation for industry: the grace period is over. Late or rejected submissions will not just be administrative annoyances — they create a real risk of non-conformity, import holds, and interruptions to CE-marked product flow.

The Four Mandatory EUDAMED Modules

The four modules going mandatory on 28 May 2026 cover the full lifecycle data foundation of an EU-marketed device:

1. Actor Registration Module — issues the Single Registration Number (SRN) used in every other module. It is the gateway. No SRN, no further submissions.

2. UDI/Device Registration Module — covers Basic UDI-DI and UDI-DI records, device data, and (where applicable) SSCP / SSP summaries.

3. Notified Bodies and Certificates Module — Notified Bodies upload, suspend, restore, or withdraw CE certificates. Manufacturers must verify their certificates are accurately linked to their Actor and devices.

4. Market Surveillance Module — Competent Authorities publish surveillance activity, FSCAs (Field Safety Corrective Actions), and information requests; manufacturers must monitor and respond.

The remaining two modules — Clinical Investigations / Performance Studies and Vigilance — remain voluntary for now and will follow the same per-module audit-and-trigger model in subsequent regulatory cycles.

Who Must Register — and What Changes for MDEL Holders

EUDAMED's reach extends across the entire EU device supply chain. The following economic operators are in scope of the May 28 mandate:

• Manufacturers of medical devices and IVDs placed on the EU market (under MDR or IVDR, including legacy devices marketed under Directives transitional provisions);
• Authorized Representatives (ARs) acting on behalf of non-EU manufacturers — including Canadian MDEL holders;
• Importers of medical devices or IVDs into the EU;
• System / Procedure Pack Producers (SPPP) under Article 22 MDR;
• Notified Bodies (already integrated through their certification workflows);
• Sponsors of clinical investigations / performance studies (when those modules later go mandatory).

What Changes for Canadian MDEL Holders

If you hold a Canadian Medical Device Establishment Licence issued by Health Canada and you export Class I, IIa, IIb, or III devices to the EU, you remain a non-EU manufacturer in EU eyes. EUDAMED does not replace your Canadian obligations — it sits alongside them. Your Canadian MDEL, MDSAP audit cycle, and ISO 13485 obligations under Health Canada's Safety of Medical Devices Regulations continue unchanged.

What changes is that for the EU leg of your business you must:

1. Appoint and confirm a written mandate with an EU Authorized Representative (EU AR);
2. Ensure your EU AR registers first in EUDAMED and obtains an SRN;
3. Submit your manufacturer Actor record through your AR's verification flow;
4. Register your devices under Basic UDI-DI / UDI-DI with an EU-recognized issuing entity (GS1, HIBCC, ICCBBA, or IFA);
5. Verify your Notified Body certificate linkage is correct in Module 3 (for Class IIa+ devices).

This is where most non-EU manufacturers get caught: the AR must complete its registration before the manufacturer can be verified. Build that dependency into your timeline.

Module 1 — Actor Registration: Step-by-Step

The Actor Registration Module is the first stop for every economic operator. The output is the Single Registration Number (SRN) — a unique EU-wide identifier you will quote on every Declaration of Conformity, technical file, and certificate going forward.

Process flow:

1. Designate a Local Actor Administrator (LAA). This is the person who creates and manages the EUDAMED account on behalf of your organization. They must use an EU Login (the European Commission's identity service).
2. Prepare supporting documents — chamber of commerce extract (or Canadian corporate registry equivalent for non-EU manufacturers, certified and translated), evidence of insurance for ARs, and the written mandate between manufacturer and AR.
3. Submit the Actor request through the EUDAMED Production environment.
4. Wait for Competent Authority (CA) verification. Typical turnaround is 5–15 business days, but it can extend to 30+ days in peak periods or if data validation triggers a query.
5. Receive your SRN by email and through the EUDAMED dashboard.

Common Rejection Reasons — and how to avoid them

Working with both first-time registrants and remediation files, our team has seen the same rejection patterns repeatedly. The Competent Authorities have flagged these openly:

• Generic email addresses (info@, contact@, sales@) are routinely rejected. Use a named, traceable individual email for the LAA.
• Mismatch between submitted legal name / address and the official trade register. Even small discrepancies — Ltd vs Limited, missing suite numbers, abbreviated street types — trigger a hold. Pull your most recent registry extract and mirror it character-for-character.
• Missing micro/small enterprise declaration when an external Person Responsible for Regulatory Compliance (PRRC) is appointed under Article 15(2) MDR.
• Non-EU manufacturer submitting before the AR record is verified. The AR must hold its own SRN first.
• Incomplete proof of insurance for ARs (relevant under Article 11(5) MDR).
• Wrong actor type selected — for example, a manufacturer that is also an importer of someone else's product must register both roles.

A clean Actor file rarely takes more than two weeks. A messy one can burn 60–90 days, which is why we strongly recommend Actor verification be completed by mid-March 2026 at the latest if you are launching new devices into the EU during 2026.

Module 2 — UDI/Device Registration: Get Your Data Right Before You Submit

The UDI/Device Registration Module captures the device-level master data the EU regulator (and ultimately patients and clinicians) will rely on. Unlike Actor data, certain UDI fields cannot be edited after submission. Submitting wrong data is far worse than submitting it slightly later.

Hierarchy you must understand:

• Basic UDI-DI (BUDI) — the regulatory grouping identifier. One BUDI per group of devices that share the same intended purpose, the same risk class, and the same essential design and manufacturing characteristics. The BUDI is what links to the Declaration of Conformity, the certificate (Class IIa+), and the SSCP (Class III and implantable).
• UDI-DI — the commercial trade item identifier. New UDI-DI is required for any change that affects identification, safety, or performance of the device.
• UDI-PI — production identifier (lot, serial, expiry, manufacturing date). Captured at point of production, not in EUDAMED master data.

Issuing entities accredited by the European Commission: GS1, HIBCC, ICCBBA, and IFA (for medicinal-device combination products). Choose your issuing entity before you start coding, because the structure of your UDI string differs by issuer.

Device data required in EUDAMED includes — but is not limited to: device name, model, risk class, intended purpose, MDR/IVDR rule applied, applicable common specifications, single-use vs reusable status, sterile status, presence of medicinal substance, presence of human/animal tissue, latex content, magnetic resonance compatibility, and (where Class III or implantable) the SSCP.

Three traps we see repeatedly:

1. Duplicate Basic UDI-DI submissions — the system rejects them. Confirm your BUDI assignment logic against MedTech Europe's BUDI guidance before bulk loading.
2. Free-text fields filled in the local language rather than English. EUDAMED is multilingual at the interface but technical content is generally expected in English plus, where relevant, the official languages of the Member States of placement.
3. Mis-classification under MDR Annex VIII rules — particularly for software as a medical device (MDSW), which often gets pulled up a class under Rule 11.

Volume planning matters. Manufacturers with hundreds of SKUs should plan for bulk XML upload via the EUDAMED Machine-to-Machine (M2M) interface. Manual entry through the web UI is realistic only for small portfolios.

For a structured walk-through of MDR classification and technical file expectations, our Medical Devices Regulatory Affairs services page explains how MFLRC supports manufacturers from gap analysis to final submission.

Module 3 — Notified Bodies & Certificates: Manufacturer Responsibilities

For Class IIa, IIb, III, and implantable devices, your CE certificate flows from your Notified Body into Module 3. The Notified Body is the primary uploader. You, as manufacturer, are responsible for verifying that:

• Each certificate is correctly linked to your Actor record (your SRN);
• Each certificate is linked to the right Basic UDI-DI(s);
• Certificate scope, issue date, expiry date, and revision references match the document of record;
• Suspensions, withdrawals, and reinstatements are reflected promptly.

Errors in Module 3 cascade. A CE certificate that is not visibly tied to your BUDI in EUDAMED can stop importers from completing their own EUDAMED records — and importers (rightly) will not place product at risk by relying on emailed certificate copies.

Pre-flight action: request a Module 3 reconciliation report from your Notified Body no later than 30 days before launch dates in 2026. Cross-check it against your internal certificate register. Resolve any drift before May 28.

Module 4 — Market Surveillance: What's Coming

Module 4 brings post-market activities into a single transparent EU layer. Once mandatory, Competent Authorities publish:

• Market surveillance activities;
• Field Safety Corrective Actions (FSCAs) initiated by manufacturers;
• Periodic safety summaries;
• Restrictive measures (such as bans, recalls, sales restrictions).

Manufacturers must monitor and respond in EUDAMED — not in parallel email chains. From a quality-system perspective, your CAPA, complaint-handling, and PMS procedures should now name EUDAMED as the official record system. If your SOPs still reference paper or PDF-only workflows for FSCAs and CA notifications, they need an immediate revision before the deadline.

This is where MFLRC's Quality Assurance services come in. We rewrite QMS procedures so they are inspection-ready, auditor-defensible, and reflect the EUDAMED-first reality.

The Mid-May 2026 Pre-Flight Checklist

By mid-May 2026 — meaning the two weeks before the 28 May deadline — every MDEL holder and EU manufacturer should already have finished the work below. If you are reading this and any item is still open, escalate now.

Actor Registration (Module 1)

• LAA appointed and trained; EU Login active;
• Chamber of commerce / corporate registry extract dated within 90 days;
• Signed AR mandate on file (for non-EU manufacturers);
• SRN issued and recorded in your master data;
• PRRC contact details confirmed and documented;
• Insurance certificate uploaded (for ARs).

UDI / Device Registration (Module 2)

• Issuing entity selected and contracts in place;
• BUDI assignment matrix reviewed against MedTech Europe guidance;
• All MDR / IVDR devices placed on the EU market in 2026 registered;
• SSCPs (Class III, implantable) drafted, reviewed, and uploaded;
• Bulk XML upload validated in the Playground environment before Production;
• Internal change-control SOP updated to capture UDI/EUDAMED triggers.

Notified Bodies & Certificates (Module 3)

• Reconciliation completed with each Notified Body;
• Every active certificate linked to the correct Actor and BUDI(s);
• Certificate expiry calendar updated and shared with Regulatory and Sales;
• Process in place to capture certificate suspensions / withdrawals within 24 hours.

Market Surveillance (Module 4)

• QMS procedures updated to reference EUDAMED as the official channel;
• FSCA workflow re-mapped to EUDAMED submission paths;
• Designated owner monitoring CA notifications daily;
• Internal training delivered to RA, QA, and Customer Complaint teams.

Cross-cutting

• Business continuity and back-up plan in place if EUDAMED is degraded;
• Regulatory intelligence subscription active for ongoing MDCG guidance;
• Internal audit scheduled within 90 days of the deadline to verify operational readiness.

Need help converting this into a tracked, role-by-role plan? Our Audit and Inspection Readiness services deliver gap analyses, mock inspections, and remediation roadmaps tailored to your portfolio.

Special Note for Canadian MDEL Holders

Canadian MDEL holders who export to the EU sit at the intersection of two regulatory systems. The pre-flight work multiplies but the principle is straightforward: Health Canada compliance is the foundation; EUDAMED is the parallel EU layer.

A typical readiness pattern we see in MFLRC engagements with Canadian Class II and III device manufacturers exporting into the EU:

• Confirm MDEL is active and in good standing (no outstanding observations from the most recent Health Canada inspection);
• Map MDR equivalents of Health Canada device classes (Canada's Class II ≠ MDR Class IIa in every case);
• Ensure your ISO 13485 certificate is current and accepted by your Notified Body;
• Coordinate UDI strategy across both jurisdictions — you do not want two parallel UDI assignments unless absolutely required;
• Build the AR relationship contractually — including audit rights, data-sharing obligations, and escalation timelines for EUDAMED queries.

Cross-jurisdictional regulatory alignment is one of MFLRC's core strengths — see our Regulatory Affairs and Licensing services for the full scope of Canada–EU bridge engagements.

What Happens If You Miss the Deadline?

Non-compliance with EUDAMED registration obligations is treated as a breach of MDR / IVDR. Depending on the Member State, consequences can include:

• Removal of the device from the EU market until registration is complete;
• Fines and administrative penalties under national medical device legislation;
• Importer refusal to place product because their own EUDAMED records cannot close;
• Distributor de-listing by hospitals and group purchasing organizations that screen for EUDAMED presence;
• Loss of CE certificate validity in escalated cases involving Notified Body action.

The reputational layer compounds the regulatory layer. Hospital procurement teams in the EU now reference EUDAMED records directly. A device that is not findable is, commercially, a device that does not exist.

How MFLRC Helps You Land Cleanly

MFLRC is a Canadian, senior-led regulatory and quality consulting firm with 20+ years of experience across pharmaceuticals, medical devices, natural health products, food, cosmetics, cannabis, controlled drugs, and emerging psychedelics pathways. Our President, Mussarat Fatima, is a Health Canada-cleared Quality Assurance Person (QAP), an ASQ member, and a member of the European Qualified Person Association.

For EUDAMED projects we deliver:

• Pre-flight gap assessment scored against the four mandatory modules;
• AR appointment support — vetting, contracting, mandate drafting;
• Actor file preparation and submission with first-pass approval focus;
• UDI strategy and BUDI assignment including issuing-entity selection;
• Bulk XML packaging and validation in the EUDAMED Playground;
• SOP and QMS rewrites to make EUDAMED the system of record for FSCA, complaints, and PMS;
• Mock inspection and Notified Body audit-readiness reviews;
• Ongoing compliance monitoring post-launch.

Canadian MDEL holders preparing simultaneously for Health Canada inspection cycles and EUDAMED launch get the additional benefit of one consultancy managing both threads — eliminating the misalignment risk that comes from siloed advisors.

To start an EUDAMED readiness conversation, contact MFLRC directly or call +1-647-492-5301.