EUDAMED Registration: What Became Mandatory in May 2026

For five years EUDAMED was the thing everyone was going to get to. Registration was voluntary, the database was partially built, and the deadline kept receding. That changed on 28 May 2026, and a surprising number of manufacturers have not noticed.

Four modules are now mandatory. Actor registration, UDI and device registration, and notified bodies and certificates are direct manufacturer obligations. A manufacturer without a Single Registration Number is not behind on a project — it is non-compliant, and because Article 31(7) makes the data publicly accessible, the gap is visible to anyone who looks.

What changed, and how the date was set

Regulation (EU) 2024/1860 rewrote Article 123(3)(d) of the EU MDR to introduce a gradual roll-out. Instead of waiting for the whole database, obligations relating to each electronic system now apply six months after the Commission publishes a notice under Article 34(3) that the system is functional and meets its functional specifications.

Commission Decision (EU) 2025/2371 of 26 November 2025 gave that notice. Six months later, on 28 May 2026, the obligations bit.

The two remaining modules will each start their own six-month clock when the Commission gives notice. That is a schedule, not a surprise — but only if someone is watching for the notice.

Two registrations, not one

The commonest structural confusion in this area is treating EUDAMED as a single registration. It is two, under different articles, with different triggers.

Actor registration under Article 31 registers the economic operator. It produces the Single Registration Number. Device registration under Article 29 registers the device, with the Basic UDI-DI and the core data elements in Annex VI Part B.

One organisation may need more than one actor registration where it occupies more than one role — manufacturer for some devices, importer for others. Each role registers separately.

The sequencing rule people miss

Article 31(1) requires the actor information to be submitted before placing a device on the market. It then adds a condition that catches programme plans: where the conformity assessment procedure requires a notified body, the information must be provided to the electronic system before applying to the notified body.

Registration is therefore not a launch task. It sits at the point the conformity route is chosen, months earlier.

The same logic applies to device registration. Article 27(3) and Article 29(1) both require the Annex VI Part B data to be submitted and correctly transferred before the device is placed on the market. Those two dates sit in different systems and can be compared — a device shipped before its record existed is visible in the record itself.

The SRN is issued, not generated

Article 31(2) provides that after having verified the data, the competent authority obtains an SRN from the electronic system and issues it. It is not instantaneous and it is not self-service. Record the submission date, any queries raised, and the date the number was issued, and allow for the elapsed time in a launch plan.

The number matters downstream. Article 89 requires the field safety notice to permit correct identification of the manufacturer, in particular by including the SRN. Without one, you cannot issue a compliant field safety notice — which is a poor time to discover the gap.

Two clocks that catch registered manufacturers

Getting registered is the beginning. Article 31 then imposes two separate maintenance obligations, and organisations routinely satisfy one and miss the other.

The one-week clock is the awkward one, because it is triggered by events that never start in the regulatory function: a change of registered address, a legal entity rename, a new contact person, the appointment or departure of the person responsible for regulatory compliance. Legal and HR know first. Unless there is a defined path from them to Regulatory Affairs, the week is gone before anyone opens EUDAMED.

The biennial confirmation needs to be a dated task with an owner and a deputy, not a reminder — and each confirmation should be recorded even when nothing changed. “We check it regularly” is not evidence; a dated confirmation is.

Legacy devices are in scope too

Article 120(3d) applies the Regulation’s registration requirements — along with post-market surveillance, market surveillance and vigilance — to devices still supplied under a Directive certificate, in place of the Directive equivalents.

So registering only MDR-certified devices leaves the legacy portfolio unregistered. Given the deadlines in the Article 120 transition run to 2027 and 2028, that portfolio is often the larger one.

Data quality is a manufacturer problem

Article 31(6) provides that the competent authority verifies the confirmed data without prejudice to the economic operator’s responsibility for it. Verification by an authority is not a quality-control step and does not transfer responsibility.

The commonest defect in a device record is not an omission but a divergence: the registered warning text and the printed warning text drifted apart at some point and nobody reconciled them. Worth checking against the current artwork:

• Basic UDI-DI — must match the EU declaration of conformity
• Risk class — must match the classification rationale
• Device name or trade name — must match the label
• Sterile state and single-use status — must match the label
• Critical warnings and contra-indications — must match the instructions for use
• Package configurations and quantities — must match the artwork and carrier placement
• Authorised representative details — must match the mandate and the actor registration

Access, and the single-holder problem

Two failure modes are specific to this system.

The first is single-holder risk. Where one person holds the only Local Actor Administrator account and leaves, the organisation can lose the ability to meet a one-week update clock. Appoint a deputy and test that the deputy can actually act — an untested deputy is an assumption.

The second is delegated access without accountability. Where a consultant or the authorised representative submits on your behalf, responsibility for the data stays with you. Define what they may submit, what needs approval first, and what evidence of each submission comes back.

Where to start

Establish the position honestly before planning anything. Are you registered as an actor? Do you hold an SRN? Are all your devices registered, including legacy ones? When was the last accuracy confirmation, and when is the next due?

Where the answer to the first is no, treat it as a non-conformity with a documented remediation plan rather than as an open project — because that is what it is, and Article 31(7) means it is visible.

Our EU MDR Toolkit includes the actor registration and SRN procedure, the device registration and UDI data submission procedure, a EUDAMED data governance procedure covering access and delegation, and a module status log that tracks the remaining modules and the six-month clock each will start — alongside 64 other templates covering Regulation (EU) 2017/745 as consolidated on 19 July 2026.

Frequently asked questions

Is EUDAMED registration mandatory now?

Yes for four modules. Following Commission Decision (EU) 2025/2371 of 26 November 2025 and the six-month clock in Article 123(3)(d), actor registration, UDI and device registration, notified bodies and certificates, and market surveillance became mandatory on 28 May 2026.

What is a Single Registration Number?

The SRN is the identifier issued to an economic operator after a competent authority verifies its actor registration data under Article 31(2). It is required in the field safety notice under Article 89 and is used across the device registration.

How often must EUDAMED data be updated?

Within one week of any change to the registered information, under Article 31(4). Separately, the accuracy of the data must be confirmed no later than one year after submission and every second year thereafter, under Article 31(5).

Do legacy devices need to be registered in EUDAMED?

Yes. Article 120(3d) applies the Regulation’s registration requirements to devices still supplied under a Directive certificate, in place of the Directive equivalents.

Is EUDAMED data public?

Actor registration data is. Article 31(7) provides that the data entered under Article 31(1) is accessible to the public, which is why an inaccurate or missing registration is visible to customers, competitors and authorities at the same time.

Can my authorised representative register on my behalf?

An authorised representative registers in its own right and holds its own SRN, and Article 11(3)(c) requires it to verify that the manufacturer has complied with its registration obligations under Articles 27 and 29. Where it also submits data for you, responsibility for that data remains yours.