For a US device or diagnostics maker, registration is the ministerial layer of FDA law: an establishment registration renewed in FURLS each fall under 21 CFR Part 807, a device listing, a GUDID feed kept current under 21 CFR Part 830, an annual fee. Europe has now switched on its counterpart, and it is not a counterpart. Since 28 May 2026, use of the first four modules of EUDAMED, the database the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) place at the center of their market architecture, is mandatory.1Regulation (EU) 2017/745 (MDR) [2017] OJ L117/1, Art. 33 (Eudamed), Art. 34 (functionality); Regulation (EU) 2017/746 (IVDR) [2017] OJ L117/176. What became mandatory is not a filing routine in a different portal. It is a set of gates wired through the regulations' chain of economic operators, with deadlines that reach devices already on the market and a sequencing logic that the FDA model does not prepare anyone for.
1. The Six Modules and What Makes One Mandatory
EUDAMED is presented as six modules built on the seven interconnected electronic systems Art. 33(2) MDR enumerates, the UDI database and device registration counting as one module but two systems: registration of economic operators, UDI and device registration, notified bodies and certificates, clinical investigations and performance studies, vigilance and post-market surveillance, and market surveillance. The original design of Art. 34 MDR made their use mandatory only once the whole database had been audited as fully functional, an all-or-nothing trigger that slipped for years. Regulation (EU) 2024/1860 rewrote that mechanism: each system can now be declared functional individually, by a Commission notice published in the Official Journal, and the obligations tied to that system apply six months after publication.2Regulation (EU) 2024/1860 [2024] OJ L 2024/1860: per-system notices; obligations apply six months after publication of each notice.
The first notice has issued. Commission Decision (EU) 2025/2371, published on 27 November 2025, confirmed that four systems had achieved functionality: actor registration, the UDI database together with device registration, notified bodies and certificates, and market surveillance.3Commission Decision (EU) 2025/2371 (published 27 Nov 2025): four Eudamed systems confirmed functional, starting the six-month clock. Six months later, on 28 May 2026, their use became mandatory for economic operators, notified bodies and competent authorities alike. The two systems missing from the notice are the ones that fire when something goes wrong: vigilance and post-market surveillance, and clinical investigations and performance studies. Neither had been the subject of a functionality notice as of publication, neither has a voluntary-use period planned, and each will start its own six-month countdown only when its notice appears.
Mandatory EUDAMED is not one deadline but a cascade of clocks: four modules became binding on 28 May 2026, backfill windows for devices already on the market are already running, and the two systems that matter most in a crisis have countdowns that have not yet started.
The gradual mechanism has a further consequence that is easy to miss. Three of the four modules had been open for voluntary use for years, actor registration since December 2020 and the UDI, device and certificate systems since October 2021, and many US manufacturers are already partially present in the database through entries made when nothing turned on them. Those voluntary-era records did not expire on 28 May 2026; they became the company's compliance record, and the accuracy duties that now attach to them are not retrospective housekeeping but live obligations with their own clocks. Whether anyone in the organization knows what was entered, by whom, and under which mandate, is a question worth asking before a competent authority does.
2. Actor Registration: SRN, Economic Operators, and the Authorized Representative
The US baseline is establishment-centric: a company registers its own facilities, lists its own devices, and answers for its own record. EUDAMED's actor layer is relational. Under Art. 31(1) MDR, the manufacturer, its authorized representative and each importer must register before a device other than a custom-made device is placed on the market, against the data set in Annex VI to the MDR; under Art. 31(2) MDR a competent authority then verifies the entry and issues an SRN.4MDR (n 1), Art. 31(1)–(5): registration before placing on the market, SRN issuance, one-week updates, biennial accuracy confirmation. The SRN looks like a receipt. It is not. Art. 31(3) MDR makes it the number the manufacturer must use when applying to a notified body for conformity assessment and when accessing EUDAMED to register its devices, which places actor registration upstream of certification rather than downstream of it. A US company planning its first MDR or IVDR submission does not encounter the database at the end of the project; the project cannot formally begin without it.
The relational structure runs deeper than sequencing. A manufacturer without a registered place of business in the Union may place devices on the market only through a sole authorized representative, and the mandate between them must, at a minimum, require the representative to comply with the registration obligations of Art. 31 MDR and to verify that the manufacturer has complied with the registration obligations of Art. 27 and Art. 29 MDR.5MDR (n 1), Art. 11(1), (3) and (5), Art. 13(2) and (4), Art. 30(3): representative and importer duties surrounding registration. Where the manufacturer has not complied with the obligations Art. 10 MDR places on it, the representative becomes legally liable for defective devices on the same basis as, and jointly and severally with, the manufacturer under Art. 11(5) MDR, which gives it every incentive to read those verification duties expansively. Importers, for their part, must confirm before placing a device on the market that a representative has been designated, must verify that the device itself is registered, and must add their own details to the record; within two weeks of placing a device on the market they are to check that the manufacturer or representative has entered the required actor data. One registration is thus touched by three private parties and one authority, each with duties defined against the others' performance, and representation or distribution agreements drafted while the database was voluntary were rarely written with that interdependence as a binding, dated obligation.
The maintenance regime is where the FDA analogy fails quietly, and not in the direction most teams expect. FURLS already carries a standing duty of its own, registration updates within thirty days of any change under 21 CFR 807.22(b)(2), layered on the October-to-December annual confirmation; what shifts in Europe is the cadence and who can act on a lapse. Data must be updated within one week of any change, its accuracy confirmed within one year of first submission and every second year thereafter, and where confirmation is more than six months overdue, any Member State may take appropriate corrective measures on its territory until the operator complies. The regulation does not say what makes a measure appropriate, or what one looks like. A US manufacturer whose voluntary-era entry names a representative it has since replaced, or an address it has since left, is not carrying a typo; it is carrying a non-compliance that the market-surveillance authority of any Member State is entitled to act on, and the contractual question of who was supposed to keep that record true is typically unanswered.
3. Device and UDI Data: What Must Be Filed and When
GUDID is a catalog keyed to the device identifier a company already prints on its labels. EUDAMED's device layer is built on an abstraction that has no US analogue: the Basic UDI-DI, which Annex VI Part C to the MDR calls the primary identifier of a device model and assigns at the level of the device unit of use, so that it sits above the packaging rather than on it and appears on no trade item; guidance, rather than the Regulation, supplies the familiar gloss that it groups devices sharing an intended purpose, a risk class and essential design and manufacturing characteristics. For class III devices, for class IIb implantables other than the items Art. 52(4) MDR exempts, and for class IIb devices taking the Annex X type-examination route, it must be assigned before the notified-body application is even made, and the notified body then puts a reference to it on the certificate; for every device it is the access key for everything filed about it afterwards. Before placing a device on the market, the manufacturer must provide the Basic UDI-DI and the core data elements to the UDI database under Art. 29(1) MDR and enter the device registration data under Art. 29(4) MDR. The data model does not map cleanly onto a GUDID export: the fields differ, and device coding runs through the EMDN, the EU's own nomenclature, rather than the GMDN codes a US regulatory team is likely to hold. The mapping exercise a US company assumes will take a week routinely turns out to be a data-governance project.
The timing rules split into two regimes. For devices placed on the market from 28 May 2026, registration is a precondition, part of the sequence that begins with the SRN and runs through the notified-body application. For devices already on the market by that date the amended transitional provisions open backfill windows, but only for devices that keep being placed on the market. Under Art. 123(3)(e) MDR, devices other than custom-made devices for which conformity assessment was undertaken under Art. 52 MDR, and devices other than custom-made devices placed on the market under Art. 120(3), (3a) or (3b) MDR, must be entered no later than twelve months after publication of the notice, commonly given as 28 November 2026, and then only where units of the same device are also placed on the market from 28 May 2026. A device whose last unit shipped before that date sits outside the window entirely, until the vigilance module goes live and a report on that device pulls it back in. That last route is narrower than it reads: Art. 123(3)(ec) MDR excludes from the trigger any device that was placed on the market in accordance with Directive 90/385/EEC or Directive 93/42/EEC, which is where pre-Regulation stock sits. The IVDR mirrors the structure for diagnostics on the same calendar.6MDR (n 1), Art. 123(3)(e) and (ea); IVDR (n 1), Art. 113(3)(fa) and (fb): backfill windows to 28 Nov 2026 (devices) and 28 May 2027 (certificates), each reaching only devices still placed on the market from 28 May 2026. Notified bodies have until 28 May 2027 to enter the Art. 56(5) MDR certificate information, including for the Art. 52 MDR devices caught by that twelve-month window, and for those devices only the latest relevant certificate and any subsequent decision taken on it, with new certificates recorded as they issue. The windows look generous until they are decomposed: a portfolio of a few hundred SKUs, each needing a Basic UDI-DI assignment, an EMDN code, and a verified data set entered by the right actor under the right SRN, does not compress well into a quarter.
For IVD makers the backfill has a longer tail than it first appears, and the tail is not one length. Regulation (EU) 2024/1860 rewrote the IVDR's transitional periods along two separate tracks. A legacy diagnostic covered by a notified-body certificate issued under Directive 98/79/EC may be placed on the market until 31 December 2027 whatever its class, under Art. 110(3a) IVDR. A diagnostic that was self-declared under that Directive and that requires notified-body involvement under the IVDR runs instead to 31 December 2027 in class D, 31 December 2028 in class C, and 31 December 2029 in class B and in sterile class A, under Art. 110(3b) IVDR. Neither track is unconditional: Art. 110(3c) IVDR makes both depend on continued compliance with the old Directive, on the absence of significant changes in design and intended purpose, on a quality management system in place by 26 May 2025, and on a formal application to a notified body and a signed written agreement lodged by dates that themselves move with the class. A device can fall out of its transitional period without anything about the device having changed. Those legacy diagnostics are not exempt from the database; they are legacy entries within it, registered under a regime whose data expectations were designed for IVDR-certified products. Which entity performs the entry where the manufacturer holds the SRN but the representative holds the verification duty, how a legacy device without an IVDR certificate is represented accurately, and what happens when the database entry, the technical documentation and the label fall out of alignment in a system that authorities and the public can search, are questions the regulations pose without answering. Registration is the visible act; the exposure lives in the divergence between what was registered and what is true.
4. Vigilance and Market-Surveillance Reporting Through EUDAMED
A US team calibrated to MAUDE tends to assume that a live European database means a single European reporting channel. It does not, and the gap runs in an unexpected direction. The system through which serious incidents, field safety corrective actions and periodic safety update reports are meant to flow, the vigilance and post-market surveillance system under Art. 92 MDR, was not covered by the November 2025 notice, and neither were the clinical investigation and performance study systems under Art. 73 MDR and Art. 69 IVDR. Until each receives its own notice and its own six-month period runs, serious-incident reporting under Art. 87 MDR continues through national channels, and PSUR submission reaches the notified body directly rather than through the electronic system that Art. 86(2) MDR contemplates for class III and implantable devices, Art. 86(3) MDR asking of every other device only that the report be made available. Both hold under the harmonized interim practices the Medical Device Coordination Group described for exactly this in-between state.7MDCG 2021-1 Rev. 1, harmonised administrative practices until EUDAMED is fully functional; for the IVDR, MDCG 2022-12. A manufacturer that stood up a EUDAMED project in spring 2026 and declared the European reporting problem solved has solved the inventory half and left the incident half exactly where it was: fragmented across member-state practices, in national forms, on national timelines.
The fourth module in the notice cuts the other way. The market surveillance system under Art. 100 MDR and Art. 95 IVDR is authority-facing: competent authorities use it to share the results of their surveillance activities with each other and the Commission. Its mandatory use means that what one authority finds, the others can see. A registration gap noticed in one Member State no longer stays there, and the penalties that attach are national ones, set separately by each Member State under Art. 113 MDR and Art. 106 IVDR, so identical facts can price very differently depending on where they surface. The asymmetry deserves attention: the operator-facing crisis systems are not yet networked, but the authority-facing one is. When the vigilance notice does publish, companies will have six months to rewire incident workflows that quality systems have hardcoded around national forms for years, against a start date that could not, as of publication, be put into a budget cycle. Whether the reporting chain is even internally settled, which of manufacturer and representative submits, in which capacity, under whose SRN, is a question many mandates do not answer, and it becomes harder, not easier, once the submission happens inside a database both parties can see.
5. Strategic Considerations
The first strategic question is archival before it is regulatory. The representation mandates, importer agreements and distribution contracts through which a US manufacturer reaches the EU were mostly drafted when EUDAMED was voluntary, and the regulation prescribes only a floor for what the mandate must contain. Who performs the initial entries, who owns the one-week update duty, who confirms accuracy on the biennial cycle, who pays when a lapse blocks a conformity assessment or an importer suspends supply against an unregistered device, and what happens to the record when the representative is replaced mid-cycle, are allocations the regulation permits but does not make. Before addressing any of them, one must ask a prior question: whether anyone has compared what the contracts assume against what the database now shows, because the two were written years apart and never had to agree until mandatory use began.
The second is that the European project is not one project. Switzerland sits outside EUDAMED entirely; the medical-device chapter of the 1999 mutual recognition agreement ceased to deliver its trade-facilitating effects on 26 May 2021, never having been updated for the MDR, and Switzerland has run its own representative regime and its own registration architecture ever since, a structural reality examined in the analysis of Swiss authorized representative requirements under the MDR and IVDR. An amending protocol to that agreement was signed on 2 March 2026 but had not been ratified as of publication. The Swiss layer registers different actors on different dates: manufacturers or their authorized representatives, together with importers, register with Swissmedic for a CHRN within three months of first placing a device on the market, a window that a Federal Council ordinance of 20 November 2024 replaces, from 1 July 2026, with a duty to register before first placing on the market, and that is the same date from which device-registration and UDI duties run through swissdamed, Switzerland's own database, with a transitional window to the end of that year.8Art. 55(1) and Art. 51(1) MepV, Art. 48(1) IvDV (CHRN); Art. 17(5) and Art. 108(2) MepV, Art. 16(5) and Art. 90(2) IvDV, as amended by AS 2024 742: swissdamed device-registration and UDI obligations from 1 July 2026. Swiss law lets a manufacturer without a seat in Switzerland place devices on the market only through a representative that has one, so in the EU the US manufacturer itself holds an SRN, while in Switzerland the registered actors are the Swiss-domiciled representative and importer. The two databases do not feed each other, their data models are not identical, and a compliance calendar built on the assumption that 28 May 2026 was the European deadline does not yet contain the second one.
The third is visibility. Much of what EUDAMED now holds is publicly searchable by design: who represents whom, which devices are registered, which certificates stand behind them. Competitors, plaintiffs' counsel and short-sellers read databases too, and a registration record that contradicts a label, a certificate or a 10-K risk factor is no longer a private inconsistency. For a US-listed company, a blocked notified-body application or an importer stand-down over a registration defect is a supply event with disclosure gravity, and the biennial accuracy cycle guarantees that the record's quality will be tested repeatedly, not once. Whether a portfolio's registrations, its contracts and its public statements actually describe the same state of affairs is a question that gets harder each time a module comes online, and the two modules still to come are the ones that will put incident histories next to the inventory. These questions require analysis tailored to the specific devices, certificates, contracts and markets at hand.