Navigating EUDAMED implementation

Introduction

Submitting and maintaining medical device information in EUDAMED is a new requirement introduced by the European Medical Device Regulations (EU-MDR, EU-IVDR) which will be implemented gradually.

The primary objective of EUDAMED is to establish a centralised database that collects, stores, and circulates relevant information about medical devices (including in-vitro diagnostics) available in the EU market.

EUDAMED's implementation is a complex and multi-phased process. Timelines for go-live and mandatory use of the modules have been postponed several times.

Currently, it is expected that by Q4 ’25 – Q1 ’26 the first modules will become mandatory including those for Actor registration, UDI / Device registration,  Notified Bodies & Certificates and Market Surveillance.

The implementation of EUDAMED has significant implications for manufacturers throughout the medical device lifecycle, demanding a streamlined approach to information management in line with EUDAMED requirements. Additionally, manufacturers must establish appropriate processes, allocate sufficient resources, and employ suitable technology to facilitate the seamless exchange and maintenance of this data in the EUDAMED database.

Manufacturers are strongly recommended to expedite their preparations, given the considerable effort required from a Process, Organisation, Technology, and Information (POTI) perspective.

Background

The primary objective of EUDAMED is to establish a centralised database that collects, stores, and circulates relevant information about medical devices (including in-vitro diagnostics) available in the EU market. EUDAMED provides a platform for manufacturers to submit data and information related to their medical devices, aiding authorities and stakeholders in making informed safety and compliance decisions. It ensures better traceability of medical devices throughout the device lifecycle; the Unique Device Identification (UDI) system allows for straightforward identification and tracking of medical devices and enables a timely response to safety concerns.

Moreover, EUDAMED enhances the efficiency of and optimises crucial regulatory processes, including actor and device registrations, clinical study applications and monitoring, conformity assessment and consultation, and vigilance reporting. It also plays a key role in fostering coordination and proactive market surveillance efforts by equipping competent authorities with enhanced tools for monitoring device performance, identifying trends, and spotting potential safety issues with greater effectiveness. In addition, EUDAMED allows the public to access information about medical devices, enabling them to make informed decisions. This strengthens transparency and enhances patient safety and engagement. Furthermore, EUDAMED facilitates communication channels and information sharing among manufacturers and other Economic Operators, Notified Bodies, Competent Authorities, and the European Commission. 

EUDAMED Modules

EUDAMED will have six interconnected modules that facilitate data exchange, transparency, and regulatory compliance. EUDAMED will feature two interfaces: one reserved exclusively for EUDAMED actors and another open to the public. Especially healthcare providers and patients can benefit from the latter as they are able to search across all the devices placed on the market and access information such as: Device information, the Summary of Safety and Clinical Performance (SSCP), storage and handling information, expert panel opinions and the written justification provided by Notified Bodies, information on clinical investigations (summary of results of the study conducted) and vigilance information (such as Field Safety Notices). This strengthens transparency and enhances patient safety and engagement. 

Actor module (ACT module) - currently live (available since December 2020)

The actor module supports the registration of the various actors (Manufacturers, Authorised Representatives, Importers and system/procedure pack producers) involved in the medical device lifecycle; every actor is mandated to provide their administrative details during the registration. Through the Actor module, economic operators request an Actor Identifier or Single Registration Number (Actor ID/SRN) and provide the relevant information for this request. Following this, the national competent authority assesses the request for approval. After approval, an Actor ID/SRN is generated and transferred to the requesting economic operator. These Actor IDs and SRNs are key to linking economic operators to documents and data. Once registered, economic operators (specifically manufacturers, authorised representatives and importers) should confirm the accuracy of their data after one year. Subsequent reviews are required every two years to ensure the data is accurate and up to date. 

UDI / Device Registration Module (UDI/Device module) - currently live (available since October 2021)

The purpose of the UDI / Device module is to ensure that each device can be uniquely identified and traced throughout its lifecycle. Manufacturers must enter data for all devices they offer in the EU market into the UDI module. This includes information such as Basic UDI, UDI characteristics and other details, Device classification, Device Trade name(s), Model(s), Reference/Catalogue number and CE certificate number.

The Basic UDI and UDI-DI, assigned to devices by manufacturers, are key in EUDAMED and essential to achieve traceability. The Basic UDI serves as the primary gateway to device related information stored within EUDAMED; it is the main key for linking devices to documents and data. It is used in relevant documentation (such as the Declaration of Conformity (DoC), Technical Documentation and the Summary of Safety and Clinical Performance (SSCP). The purpose of the Basic UDI is to establish connections between devices that share the same intended purpose, risk class and design/manufacturing characteristics. The UDI-DI provides access to the information for a specific device. The Basic UDI and UDI-DI are also used in CI/PS module, Post Market Surveillance and Vigilance modules where applicable. 

Notified Bodies (NB) & Certificates Module (NB/Certificate module) - currently live (available since October 2021)

The purpose of the NB/Certificate module is linking devices to independent conformity assessment results, certificates and consultations. Within this module, NBs must register information about their operations and keep a record of CE-mark certificates they have issued, denied or updated. If a manufacturer's application is refused or a manufacturer withdraws their application before a decision is reached, the relevant Notified Body enters this in EUDAMED so that all other Notified Bodies will be able to access this information via this module. The Clinical Evaluation Consultation Procedure (CECP) will also be managed through this module and it enables the NB to provide full justification in its conformity assessment report where it has not followed the advice of the expert panel.

In addition, NBs can also upload the SSCP for medical devices (i.e. implantable and Class III devices) and the Summary of Safety and Performance (SSP) for IVDs (Class C and D devices). 

Clinical Investigation and Performance Studies Module (CI/PS module) - not live yet (under development)

This module is dedicated to the registration and tracking of clinical investigations/performance studies as well as Post-market clinical follow-up (PMCF)/ Post-market Performance Follow-up (PMPF) for medical devices and In-vitro diagnostics respectively. It provides a centralised platform for stakeholders to access and share information with and between Competent Authorities (CAs) about ongoing and completed studies. Sponsors must register in the Actor module upon using the CI/PS module. Each submitted study will be assigned a unique Single Identification Number (SIN); this number will be used for all relevant communications. Updates to the studies such as substantial modifications will also be tracked in this module, and competent authorities can approve or reject these in the system. In addition, adverse events that occur in the studies must be reported via this module. For PMCF investigations /PMPF studies, Sponsors must provide a notice to the Member States concerned including all required data and documentation at least 30 days prior to its commencement. 

Post market Surveillance (PMS) & Vigilance Module (PMS/Vigilance module) – not live yet (under development)

The PMS/Vigilance module aims to monitor the safety and performance of medical devices after they have been made available for use in the EU. The module assists manufacturers in implementing post-market surveillance activities which involves monitoring the device's performance, detecting any adverse events, and assessing whether the device continues to meet its intended purpose safely and effectively. Manufacturers are required to submit serious incidents, PSURs (for high-risk devices), Field Safety Corrective Actions (FCSAs) as well as Field Safety Notices (FSNs), Periodic Summary reports (PSRs) and Trend reports (TRs). CAs will utilise this module for sharing details regarding the assessment results, outcomes, and any necessary corrective measures related to severe incidents and/or FSCAs. This module will additionally serve to oversee post-market surveillance and vigilance data, with the objective of promptly detecting emerging trends, patterns, and signals that may unveil new risks or safety issues requiring communication to the European Commission (EC), CAs, and Coordinating CAs (CCAs). 

Market Surveillance Module (MSU module) – not live yet (under development)

All European competent authorities are expected to perform checks to ensure the conformity of devices made available in the EU. The market surveillance module enhances cooperation among competent authorities throughout the European Union. This module is designed to empower competent authorities to engage in joint market surveillance efforts by granting them access to inspection reports, assessments of conformity, notifications concerning devices with unacceptable risks, and supplementary data concerning non-compliance. Competent Authorities will be responsible for reporting and sharing the outcomes of their surveillance efforts to fellow CAs. Moreover, they will engage in follow-up actions concerning devices that pose unacceptable health and safety risks.

EUDAMED Timeline

EUDAMED's implementation has been a complex and multi-phased process. While the original deadline for full implementation was set for May 2020, multiple factors, including the COVID-19 pandemic, technical complexities and ongoing resource challenges, have delayed the launch considerably.

Originally, four key steps had to be completed before EUDAMED would become mandatory:

1. ALL EUDAMED modules should be fully functional.
2. An independent audit should be conducted, and results should be presented to the Medical Devices Coordination Group (MDCG).
3. After this, the publication of a Commission notice in the Official Journal of the European Union (OJEU) should take place.
4. Application of transition periods after publication of the Commission notice (6 or 24 months depending on the EUDAMED module).

However, the development of the CI/PS module is significantly delayed which is hindering the implementation timeline of the entire EUDAMED system and thereby the mandatory use of the individual modules. To facilitate the gradual implementation of EUDAMED and accelerate the mandatory use of the individual modules, Article 34 of the EU-MDR has been amended by Regulation 2024/1860. This Regulation mandates the use of each individual module starting 6 months after it is declared functional by the publication of a Commission notice in the OJEU.

Currently, four modules (ACT, UDI/Device, NB/Certificate, MSU) are expected to be declared functional by the publication of a Commission notice in the OJEU by Q2-Q3 ’25. The PMS/Vigilance module is expected to be declared functional by Q1-Q2 ’26. The development and release timeline of the CI/PS module has been delayed and is yet to be determined.

Following the publication of the notices in the OJEU, there will be a transitional period of 6 months during which economic operators can exchange all the necessary information before it becomes a mandatory requirement to enter information in different EUDAMED modules. This means that by Q4 ’25 - Q1 ’26, the use of the first four modules (ACT, UDI/Device, NB/Certificate & MSU) will become mandatory. By Q3-Q4 ’26, the use of the PMS/Vigilance module will be mandatory.

Impact of EUDAMED on Manufacturers Processes, Organisation, Technology and Information (POTI)

The implementation of EUDAMED has considerable implications for medical device manufacturers in various areas that affect their Processes, Organisation, Technology landscape and Information (data) (POTI).

Processes

Manufacturers are European Commission to anticipate their upcoming requirements: required to exchange a wide range of data and information related to their medical devices with the different modules of EUDAMED. It is critical to start with an assessment to identify what processes need to be created or updated. After this, missing procedures and work instructions must be established. For example: submitting, verifying and maintaining data and information to ensure ongoing compliance; this includes EUDAMED user tasks and activities such as requesting registration for economic operators, creation and termination of user accounts, UDI assignments, registration of devices and submitting/verifying related device information, registering clinical studies, submitting serious incidents, and many more. It is important to set up standardised formats for data submissions to ensure data accuracy and completeness. Moreover, appropriate change management processes should be in place to update and maintain the data in EUDAMED when necessary. As the UDI/Device registration module and the Actor module are already operational, manufacturers can review its requirements and initiate process setup immediately. Although the clinical investigation, post-market surveillance and vigilance modules are not yet active, manufacturers can prepare by examining the functional specifications published by the European Commission to anticipate their upcoming requirements: md_eudamed_fs_v7_2_en.pdf. 

Organisation

Personnel engaged in EUDAMED tasks and activities must possess a comprehensive understanding of both EU Medical Device Regulations and the associated EUDAMED requirements. A robust data governance framework is critical to ensure regulatory compliance, data accuracy, completeness, and consistency. Significant emphasis should be given to establishing well-defined roles and responsibilities for EUDAMED related activities; clear data ownership and accountability are established through data governance. In addition, user access profiles must be defined. Appropriate resources need to be allocated for data management and submission activities, as well as for IT support in case of queries or technical issues. Resources dedicated to these tasks should receive comprehensive training to ensure effective execution. Ongoing training and education programmes are imperative to ensure that employees remain well-informed and up-to-date on EUDAMED and pertinent regulatory updates.

Technology

Manufacturers should verify the adequacy of their systems for managing essential EUDAMED data. Moreover, they should adequately prepare to ensure their readiness for submitting EUDAMED data in the most optimal manner. There are three potential solutions to exchange data with EUDAMED:

1. The EUDAMED User Interface: This option is the simplest one from a data handling/manipulation/implementation point of view. The user only needs a PC with Internet connection and a browser to connect to EUDAMED.
2. Bulk XML upload: In this option the user will need to provide (upload) the data in XML format to EUDAMED. This will allow bulk upload of existing information by uploading the XML files through the User Interface.
3. Machine-to-machine Data exchange: In this case, the data will be automatically transmitted between an external system and EUDAMED. To achieve this, the external system must be extended to convert its data into the XML format requested by EUDAMED DTX and implement a specific data exchange protocol.

Choosing the right solution for the organisation depends mainly on the number of devices, frequency of updating data in EUDAMED, and potential costs. The figure below provides requirements, pro’s and con’s and conditions for each of these solutions to aid in determining the best solution. Larger organisations with a substantial inventory of medical devices, might want to look into opportunities of outsourcing parts of the data management and exchange process. After choosing the best solution, processes should be established and implemented within the organisation.

Additionally, it is important to guarantee that any patient or sensitive data submitted to EUDAMED conforms to data privacy and security regulations, such as the GDPR (General Data Protection Regulation). Technology solutions within the organisation should be able to support this.

Information

The information needed for EUDAMED comes from various sources and systems within the organisation. Manufacturers must adopt appropriate procedures, methods and tools to correctly collect, validate, and remediate information, and to exchange this information with EUDAMED in a secure and timely manner. Therefore, effective information management, protection and timely availability of the right information is essential. It is recommended to perform a data readiness assessment to define current and target state of data required for EUDAMED submissions. Manufacturers should systematically gather and validate required data for each device, ensuring strict adherence to standardised formats and terminologies. Any data that deviates from these standards should be evaluated and corrected. Manufacturers should also explore the option to invest in robust data validation tools to ensure the accuracy and reliability of the submitted data. Furthermore, it is crucial to verify that the data submitted to EUDAMED seamlessly harmonises with other systems, as well as documentation.

EUDAMED is also available in a Playground environment, serving exclusively to experiment with the application: https://webgate.training.ec.europa.eu/eudamed-play. You can use this for example to test data exchange (e.g. testing XML uploads).

Starting the EUDAMED compliance journey

Manufacturers must recognise that there are numerous complex tasks that need to be completed before EUDAMED becomes mandatory. They face the challenging job of carefully improving their processes, preparing the organisation, their technology, and information landscape. This demands significant effort and time, especially because a comprehensive and proactive approach must be adopted to ensure successful compliance with EUDAMED requirements.

A good resource to start the EUDAMED compliance journey is the EUDAMED information centre: Welcome to the EUDAMED information centre (europa.eu). Information such as infographics, guidance documents for the different modules and information on data exchange can be found here.

Have questions? Consult our experts!

Deloitte offers comprehensive support to medical device manufacturers in their EUDAMED compliance journey. We provide all-encompassing Readiness Assessments to gauge your preparedness for EUDAMED integration, thoroughly examining your internal processes, organisational structure, technological infrastructure, data and documentation practices for compliance with EUDAMED requirements.

EUDAMED preparations require significant tasks that demand considerable time and resources. To alleviate this, Deloitte provides tailored assistance, including data collection, validation, and remediation for submissions, establishment and implementation of EUDAMED processes, and the setup of a robust Data Governance Framework. We also assist in evaluating the requirements of new tools, selecting, and implementing the most suitable ones for EUDAMED data management and submissions. Our ultimate goal is to help manufacturers meet the EUDAMED requirements in a timely manner, ensuring the continuous presence of their medical device(s) in the European market.